How do I install the Researchvault skill?

Run npx skillmds@latest add javimosch/researchvault in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Researchvault safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Researchvault?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Researchvault free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Researchvault?

javimosch (@javimosch) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Researchvault by javimosch — Agent Skill

Name: Researchvault
Author: javimosch

File contents

ResearchVault 🦞

Local-first research orchestration engine.

ResearchVault manages persistent state, synthesis, and autonomous verification for agents.

Security & Privacy (Local First)

Local Storage: All data is stored in a local SQLite database (~/.researchvault/research_vault.db). No cloud sync.
Network Transparency: Outbound connections occur ONLY for user-requested research or Brave Search (if configured).
SSRF Hardening: Strict internal network blocking by default. Local/private IPs (localhost, 10.0.0.0/8, etc.) are blocked. Use --allow-private-networks to override.
Manual Opt-in Services: Background watchers and MCP servers are in scripts/services/ and must be started manually.
Strict Control: disable-model-invocation: true prevents the model from autonomously starting background tasks.

Installation

python3 -m venv .venv
source .venv/bin/activate
pip install -e .

Quick Start

Initialize Project:

python scripts/vault.py init --objective "Analyze AI trends" --name "Trends-2026"

Ingest Data:

python scripts/vault.py scuttle "https://example.com" --id "trends-2026"

Autonomous Strategist:

python scripts/vault.py strategy --id "trends-2026"

Portal (Manual Opt-In)

Start the portal explicitly:

./start_portal.sh

Backend: 127.0.0.1:8000
Frontend: 127.0.0.1:5173
Backend auth strictly uses RESEARCHVAULT_PORTAL_TOKEN
./start_portal.sh loads/generates .portal_auth and exports RESEARCHVAULT_PORTAL_TOKEN before backend launch
Token login: URL hash #token=<token> (token from .portal_auth)
Allowed DB roots are controlled by RESEARCHVAULT_PORTAL_ALLOWED_DB_ROOTS (default ~/.researchvault,/tmp)
OpenClaw workspace scan is effective only when RESEARCHVAULT_PORTAL_SCAN_OPENCLAW=1 and ~/.openclaw/workspace is inside allowed DB roots
Provider secrets are env-only (BRAVE_API_KEY, SERPER_API_KEY, SEARXNG_BASE_URL) and injected into subprocesses only when RESEARCHVAULT_PORTAL_INJECT_SECRETS=1
Both hosts are supported for browser access:
- http://127.0.0.1:5173/#token=<token>
- http://localhost:5173/#token=<token>

Operational commands:

./start_portal.sh --status
./start_portal.sh --stop

Security parity with CLI:

SSRF blocking is on by default (private/local/link-local targets denied).
Portal toggle Allow private networks is equivalent to CLI --allow-private-networks.

Optional Services (Manual Start)

MCP Server: python scripts/services/mcp_server.py
Watchdog: python scripts/services/watchdog.py --once

Provenance & Maintenance

Maintainer: lraivisto
License: MIT
Issues: GitHub Issues
Security: See SECURITY.md

---name: researchvaultdescription: Local-first research orchestration engine. Manages state, synthesis, and optional background services (MCP/Watchdog).---# ResearchVault 🦞**Local-first research orchestration engine.**ResearchVault manages persistent state, synthesis, and autonomous verification for agents.## Security & Privacy (Local First)- **Local Storage**: All data is stored in a local SQLite database (~/.researchvault/research_vault.db). No cloud sync.- **Network Transparency**: Outbound connections occur ONLY for user-requested research or Brave Search (if configured). - **SSRF Hardening**: Strict internal network blocking by default. Local/private IPs (localhost, 10.0.0.0/8, etc.) are blocked. Use `--allow-private-networks` to override.- **Manual Opt-in Services**: Background watchers and MCP servers are in `scripts/services/` and must be started manually.- **Strict Control**: `disable-model-invocation: true` prevents the model from autonomously starting background tasks.## Installation```bashpython3 -m venv .venvsource .venv/bin/activatepip install -e .```## Quick Start1. **Initialize Project**: ```bash python scripts/vault.py init --objective "Analyze AI trends" --name "Trends-2026" ```2. **Ingest Data**: ```bash python scripts/vault.py scuttle "https://example.com" --id "trends-2026" ```3. **Autonomous Strategist**: ```bash python scripts/vault.py strategy --id "trends-2026" ```## Portal (Manual Opt-In)Start the portal explicitly:```bash./start_portal.sh```- Backend: `127.0.0.1:8000`- Frontend: `127.0.0.1:5173`- Backend auth strictly uses `RESEARCHVAULT_PORTAL_TOKEN`- `./start_portal.sh` loads/generates `.portal_auth` and exports `RESEARCHVAULT_PORTAL_TOKEN` before backend launch- Token login: URL hash `#token=<token>` (token from `.portal_auth`)- Allowed DB roots are controlled by `RESEARCHVAULT_PORTAL_ALLOWED_DB_ROOTS` (default `~/.researchvault,/tmp`)- OpenClaw workspace scan is effective only when `RESEARCHVAULT_PORTAL_SCAN_OPENCLAW=1` and `~/.openclaw/workspace` is inside allowed DB roots- Provider secrets are env-only (`BRAVE_API_KEY`, `SERPER_API_KEY`, `SEARXNG_BASE_URL`) and injected into subprocesses only when `RESEARCHVAULT_PORTAL_INJECT_SECRETS=1`- Both hosts are supported for browser access: - `http://127.0.0.1:5173/#token=<token>` - `http://localhost:5173/#token=<token>`Operational commands:```bash./start_portal.sh --status./start_portal.sh --stop```Security parity with CLI:- SSRF blocking is on by default (private/local/link-local targets denied).- Portal toggle **Allow private networks** is equivalent to CLI `--allow-private-networks`.## Optional Services (Manual Start)- **MCP Server**: `python scripts/services/mcp_server.py`- **Watchdog**: `python scripts/services/watchdog.py --once`## Provenance & Maintenance- **Maintainer**: lraivisto- **License**: MIT- **Issues**: [GitHub Issues](https://github.com/lraivisto/ResearchVault/issues)- **Security**: See [SECURITY.md](SECURITY.md)

Frequently asked questions

Researchvault