Connect your AI through one Gateway. Keep your keys and environment variables in one Vault. For the agents you use today and whatever you build next.
Your tools make the request. Gateway connects it. Vault’s client-side encryption is separate from Gateway’s provider credentials.
Illustrative routes between supported tools and providers.
Two products. One clear workflow.
Gateway handles the AI connection. Vault handles the credentials. Together, they give your projects a more controlled foundation.
A front door between your agents and the models they use. Choose where requests go, see what happened, and keep track of spending.
Keep API keys, environment variables, and service credentials together. Give each project, environment, and agent the access it needs.
Built for your way of building
Claude, Codex, Cursor, or your next favorite tool can help turn an idea into an app. The keys, model connections, and production access still need boundaries. AIRCTRL brings that layer together, without tying the way you build to one assistant.
Give your assistant the context to build, not a prompt full of database passwords and API keys. Organize credentials in Vault and keep private service keys out of browser bundles.
Your secrets belong outside the conversation.
Give an experiment development credentials. Keep production database and payment access scoped to the people and services that actually need it.
Same project. Different boundaries.
Route supported AI connections through Gateway to see model usage and costs together. Set spending boundaries before an experiment becomes an expensive habit.
Visibility into the requests you connect.
Connection options depend on your tool’s API or MCP support and configuration. Gateway covers routed requests. Your generated code, app authentication, and database permissions still deserve a review.
Open AIRCTRLYour whole ecosystem
Claude Code, Cursor, Codex, OpenClaw, or an agent you made yourself. Keep building where you’re comfortable. Bring the connections, credentials, and controls together in AIRCTRL.
Write code, run tasks, and work with an AI assistant.
Connect through supported API endpoints or MCP.
Build a website, prototype, or product in your own way.
Theo VibesAI app builderConnect your app’s AI requests and environment variables.
Choose your model, without building around one provider.
Route requests and review usage through Gateway.
Local models, databases, payments, and deployment tools.
Route local models through Gateway. Keep service credentials in Vault.
An ecosystem overview, not a list of verified native integrations. Connection options depend on each tool’s API, MCP support, and configuration. Brand names and logos belong to their respective owners.
AIRCTRL Vault
Your app needs settings and credentials to work. Vault encrypts secret values on your device and organizes access by project and environment, instead of scattering copies through code and AI conversations.
Your app reads a name and a value to know how to run. A setting such as APP_ENV=staging isn’t a secret. An environment variable is a way to supply configuration, not a security boundary.
An API key, payment token, or database URL containing a password can unlock a service. The value needs protection, whether it lives in an environment variable, a file, or a tool.
Development is for building, staging is for testing, and production serves real users. The same variable name can have different values and access rules in each.
Interactive example. These values stay masked.
Local app & coding agents
Your local app and the agents you approve for development.
Keep production access separate. Give each environment only the credentials it needs.
The Vault architecture
Give each credential a name and a project, rather than scattering copies across code, notes, and chat.
Choose the environment and which people, apps, or agents should be allowed to use the connection.
Configure supported integrations to use the access they need. Keep raw credentials out of prompts.
Revisit permissions as your project changes. Replace outdated keys and remove access that is no longer needed.
The details that matter
Central storage is one part of the picture. Where a value is used, who can read it, and how you replace it matter just as much.
A .env file is useful for loading settings locally, but it is not an encrypted vault. Keep real values out of version control and use placeholders in .env.example. Vault provides a central place to organize credentials and access, instead of emailing files or keeping different copies on every machine.
Only the people and services that need it. A development agent should not automatically inherit production database or payment credentials. Scope access to the project and environment, and grant the minimum needed for the task. Any runtime that receives a raw secret can read it, so the code and tools you authorize still need to be trusted.
Public settings can; private credentials must not. Anything bundled into browser JavaScript is visible to visitors. In Next.js, NEXT_PUBLIC_ variables are specifically exposed to the client. Keep privileged service calls on the server, with appropriate authentication and permissions. Masking a value in a dashboard does not make a browser-delivered value private.
Revoke or rotate it with the service that issued it first. Then replace the saved value, update or restart dependent services as required, and verify the old key no longer works. Deleting it from a file or removing someone’s Vault access does not invalidate a copy they already have. Rotation is a credential lifecycle task, not just a visual refresh.
Security, by design
Vault encrypts secret values on your device. Gateway governs AI connections using a separate credential model. Understand who holds the keys, what gets stored, and how access is checked.
Explore the security architectureAIRCTRL is built on AWS, CoreWeave, and Crusoe, infrastructure providers with independently assessed SOC 2 controls for specified services. Provider reports do not constitute a SOC 2 attestation for AIRCTRL or TheoVex.
Zero-knowledge Vault
Vault secret values are encrypted on your device. AIRCTRL stores ciphertext and wrapped keys, while authorized clients hold the keys needed to decrypt them.
Gateway controls
Gateway uses server-encrypted provider keys to make upstream calls. Request-body logging and caching are configurable, so review your settings before sending sensitive data.
Infrastructure
AIRCTRL-managed infrastructure is hosted and managed in the United States.
Setup should be a conversation
You’re already building with AI. Let your assistant help you understand the configuration, then set up your connections and environments in AIRCTRL. You review the permissions. Your assistant helps with the details.
Claude Code, Cursor, Codex, OpenClaw, or your own agent. Start with your project and the tools you want to connect.
Choose your models, store your environment variables, and decide which projects and agents can access each connection.
Review access and spending, then test a connected request. Your assistant helps with the details; you stay in control.
You
“Help me connect my app’s AI through Gateway and keep its environment variables in Vault.”
Your setup checklist
Start with the connections your project needs. Review each environment before you put it to work.
Less “what just happened?”
When an AI tool makes a request through your gateway, that’s something you should be able to understand, not another mystery running in the background.
Cursor
Storefront · development
Through AIRCTRL Claude
OpenAI Codex
Background worker · staging
Through AIRCTRL GPT
OpenClaw
Research agent · development
Through AIRCTRL Gemini
Monthly budget
$24.80 / $100
Model, usage, and cost. Configure logging and caching to match your data requirements.
AIRCTRL’s scope is activity routed through the gateway. It is not a monitor for everything an agent or your computer does.
Gateway sits between supported clients and AI providers. Model routing, access policies, and usage reporting belong at that connection point. Vault is the separate home for the credentials and environment variables your projects use.
Connection options depend on the client’s API and MCP support. Request metadata is separate from prompt and response content. A gateway does not replace your app’s authentication, database permissions, or application security.
Three accounts. Clear pricing.
Vibe Coder and Pro are priced per account. Teams Enterprise is priced per user. No percentage usage fees.
0%percentage usage fees, on every accountFor independent builders
$19.99/ month
A monthly account for turning your next idea into something real.
For your next chapter
$30/ month
A straightforward account rate as your projects and ambitions grow.
For building together
$60/ user / month
Per-user monthly pricing for teams and organizations.
Monthly account subscription prices. Review plan allowances and any AI-provider usage charges before subscribing.
Have a question about your account or setup? Let’s talk.
Don’t take our word for it. Try the numbers.
Put a limit on one model. Hand off to the next approved option. Keep building within the budget you chose—not the bill you discover later.
Your rules. Followed automatically.
Only the alternatives you approve
Start with your first choice
$0.05 / request
Your first approved alternative
$0.02 / request
Your next approved alternative
$0.01 / request
Same completed work. A different bill.
Comparing 10,000 completed requests at the example rates.
In this scenario, lower-cost alternatives more than offset the account fee. You decide which models are suitable for the work.
Estimated net monthly savings
$252.50
Estimated net monthly savings: $252.50. 10,000 requests completed; 0 held. Total including Pro: $247.50.
Rates of $0.05, $0.02, and $0.01 per request are illustrative, not provider quotes. Requests have equal assumed size. Real costs depend on model, tokens, caching, retries, and provider pricing; alternative models may differ in quality and capability.
Direct usage assumes every request uses the first model. Savings compare only completed work and include the selected account’s monthly fee, excluding taxes. No savings are assigned to blocked work, security features, or time saved.
This sandbox models sequential requests with known costs. Actual token billing, concurrent requests, routing options, and budget enforcement depend on your configuration. Only traffic routed through AIRCTRL is in scope.
Both account options use the same illustrative routing rules here; this is not a feature-entitlement comparison. Confirm plan allowances and supported model fallbacks before subscribing. Nothing you change here modifies a real gateway.
Scope people and agents to the resources they need, instead of sharing an all-powerful credential.
Vault encrypts secret values on your device. Gateway provider keys use a separate, server-side boundary.
Review routed usage and costs alongside tamper-evident security activity. Less guesswork, more context.
No. AIRCTRL works around a broader ecosystem: coding agents such as Claude Code and Codex, editors such as Cursor, OpenClaw, app builders, hosted models, and local model runtimes. How a tool connects depends on its API or MCP support and configuration.
Gateway is the connection point for your AI requests: which model they use, what they cost, and which access rules apply. Vault is where you organize API keys, environment variables, database URLs, and other credentials. They have different jobs and are designed to work together.
They’re settings your app reads to know how to run and connect to services. Some are harmless settings; others contain private values, such as a database password or payment API key. Vault is designed to keep sensitive values organized by project and environment, with controlled access.
Vibe Coder is $19.99 per month; Pro is $30 per month; Teams Enterprise is $60 per user per month. No percentage usage fees. These are monthly account subscription prices. Review plan allowances and any AI-provider usage charges before subscribing.
Your AI assistant can help you understand configuration in plain language. Open AIRCTRL to set up your connections and environments, and review the access each project needs. Keep raw credentials out of the conversation, and check generated code and permissions before deploying.
No. The activity view covers requests sent through AIRCTRL. Local commands, files, browser activity, and requests that bypass the gateway are outside that view.
Vault secret values are encrypted on your device. AIRCTRL stores ciphertext and wrapped keys, while authorized clients hold the keys needed to decrypt them. Gateway processes AI requests on your behalf. Prompt and response retention depends on request-body logging and caching settings. Review those settings and your model provider’s policies before sending sensitive data. Gateway provider credentials use server-side encryption for proxy operations. Record metadata, account information, usage, billing, and audit records are separate from encrypted Vault values.
No single product can do that. Gateway focuses on AI connections, access, and usage; Vault focuses on credentials and environment access. Your app still needs its own authentication, database permissions, and other security controls.
You’ll open the AIRCTRL application directly. That’s where you manage your account, connect your tools and models, and organize your Vault and environments.
Your choice of agent. Your choice of model. One Gateway for the connections. One Vault for the secrets.
Or talk through your setup with us
