Vault-0 is a local desktop app that encrypts your AI agent's API keys and injects them ephemerally at launch. Keys exist on disk for about 2 seconds instead of sitting in plaintext .env files forever. It also runs a policy engine that enforces domain allow/block lists, output redaction, and spend caps on outbound requests. Built for OpenClaw agents with MCP hardening, a SHA-256 chained evidence ledger, and native x402 payment support. Rust + Tauri, macOS, fully local.