Connect Claude Code

What it doesCopy Anchor Link

• Risky commands wait for your phone. A force push, rm -rf, a database drop, a deploy or a publish, a download piped into a shell, an edit to Vando’s own files or Claude Code’s settings: Claude Code stops, your phone shows the command, and you tap Run or Deny. Everyday commands never touch the network.
• Claude asks you for a secret. When Claude needs an API key, it asks by a hint, like “stripe test key”. Your phone shows which thing and why. You pick it and tap Give. It travels sealed to your computer and is opened there.
• Every answer gets a receipt, signed on your phone.

Before you startCopy Anchor Link

• The Vando app on your phone, signed in, with your recovery kit made.
• Node 22 or later on your computer. node -v tells you.
• A copy of the Vando code, with its packages installed: run pnpm i in it once.
• Claude Code.

Paste this into Claude CodeCopy Anchor Link

Open Claude Code in the project you want to protect, and paste this. Put the folder of your copy of the Vando code where it says [PATH]. Claude does the setup with you and stops when it needs you or your phone.

Set up Vando in this project with me, step by step. The full steps are at https://getvando.com/docs/for-agents.md
1. Find the vando command: if `command -v vando` finds it, use `vando`; otherwise use `node [PATH]/packages/mcp/bin/vando.mjs`, where [PATH] is my copy of the Vando code (ask me if you don't know it). Run `vando` on its own: it says what this computer needs next.
2. If it says "not connected", stop and ask me to run the connect command my phone shows (Connections, Connect an AI, Claude Code) in my own terminal. It asks me to compare words with my phone, so you can't run it for me. When I say it's done, run `vando` again.
3. If this project has .env files, run `vando init --dry-run` and show me the names (it never shows values). I'll run `vando init` myself.
4. Run `vando setup` and show me what it printed.
5. Run `vando doctor` and tell me anything it says to fix.
Never ask me to paste a secret into this chat, and never open my .env files. When a command needs a secret, run it as `vando run --secret NAME -- <command>` (or `vando run -- <command>` in a project after `vando init`), and I'll approve it on my phone. To save a new one, run `vando add NAME`: it opens a page in my browser.

Claude Code asks before it runs each command. Choose Yes each time. You don’t need “don’t ask again” for any of them, and never choose it for vando run: it would let any command run through vando run skip Claude Code’s own check.

A whole project. In your own terminal, in the project, run vando init. It reads your .env, .env.staging, .env.production and the like on your computer, shows the names it found (never the values), and after you say yes sends the values to your phone, locked so only your phone can open them, as one import. Your phone shows each folder (Work/acme/dev, staging, prod) with how careful it starts (dev Easy, staging Just me, prod Fort Knox), which you can change, and saves it all with one tap; anything already in your vault is left as it is. Then vando init writes a .vando.toml (names only) and a .env.example (no secret values) for you to commit. Your .env files stay as they are: when everything runs through Vando, vando clean moves them to the trash. Claude may run vando init --dry-run to show you the names first. The .vando.toml holds names only: project = "Work/acme", and under [environments] one line per environment, like dev = [".env"]. Then vando run -- pnpm dev asks your phone once for everything directly in Work/acme/dev, and vando run --env staging -- pnpm dev picks another environment. A line like DB_URL=vando://Work/acme/prod/DB_URL in .env is filled in when the program runs; your phone shows where it lives, and if it isn’t given, the program doesn’t start. vando env lists the names a run would get. vando get NAME prints one value, in your own terminal only; Claude Code asks you before it runs either.

Coming soon, not working yet: a published vando package, so step 1 becomes a one-line install and nobody needs a copy of the code. The same block will still work then: Claude will find vando on your PATH.

Or do it yourself, step by stepCopy Anchor Link

Not sure where you are? Run vando on its own: it says what this computer needs next. vando doctor checks everything and says how to fix each thing.

1. Set up the command onceCopy Anchor Link

In a terminal, in your copy of the Vando code:

pnpm i
alias vando="node $PWD/packages/mcp/bin/vando.mjs"
vando

The alias lasts for that terminal window. To keep it, add the same line, with the full folder path, to your ~/.zshrc or ~/.bashrc. Claude Code doesn’t see your aliases, which is why the paste block uses the full node … form.

2. Get a code on your phoneCopy Anchor Link

In the app: Connections → Connect an AI → Claude Code. The screen shows the command to run, with the code and the server’s address in it, and a Copy button. The code is 8 letters and digits. It works once, for 10 minutes.

3. Connect, in your own terminalCopy Anchor Link

Run the command your phone shows. It looks like this (yours has its own code, and may have an --api part):

vando connect K7M2XQ4B

Run it in your own terminal, not through Claude. It asks you a question, and Claude Code’s tools have no keyboard to answer with: there, it stops with “there is no terminal to check the words at” and sends nothing.

Check the wordsCopy Anchor Link

Once the terminal reaches Vando, your phone shows six owner key words and the terminal shows three numbered sets of six words. Type the number of the set your phone shows. If none match, type n: someone may be in the middle, and nothing is saved.

The words come from your own keys, not from Claude’s, so they are the same every time you connect. They only change if your keys change. If they changed and you didn’t change anything, don’t connect.

Your phone also shows the key fingerprint of the key your computer just made; the terminal prints the same one. Then tap Connect on your phone. The terminal waits for it, says Connected as "Claude Code", and then what to do next.

4. Set up the projectCopy Anchor Link

If the project has .env files, run vando init first (see “A whole project” above). Then, in the project folder:

vando setup

It shows what it writes, then writes it: a note in AGENTS.md that tells Claude to run commands with vando run (and @AGENTS.md in CLAUDE.md), Claude Code permission rules in .claude/settings.json (vando request, status and grants without asking; vando run, get and env always ask), and the guard, so risky commands wait for your phone. Your other settings are left alone. vando guard --global covers every project; sudo vando guard --managed puts the guard where Claude can’t edit it; vando unguard takes it out again.

5. Check itCopy Anchor Link

vando doctor

It checks Node, the connection, the keychain, Vando’s server and your clock, the guard, the note and the rules, and under anything wrong prints the command that fixes it. Now ask Claude to run your command: it uses vando run, and your phone asks you to give the secret, once or for as long as you pick.

Optional: the Vando tools in ClaudeCopy Anchor Link

claude mcp add vando -- node /path/to/vando-code/packages/mcp/bin/vando-mcp.mjs

This lets Claude ask you for one secret by a hint (get_secret), which puts the value in the conversation; vando run doesn’t, so you only need this for a value Claude must read itself. (Or claude mcp add vando -- vando-mcp if that command is on your PATH.) Start a new Claude Code session to load the tools. vando test sends a harmless ask to your phone to try the connection.

What each phone screen meansCopy Anchor Link

Connect an AI

Pick Claude Code. It will ask you on your phone before it pays, sends, deletes or gets a password.

Connect Claude Code

The steps for your computer: set up the command once, then the command to run, with its code and how long it lasts. How to set it up opens this page.

Claude Code on your computer wants to connect

The owner key words and the key fingerprint. Check they match your terminal, then tap Connect. If the screen says Don’t connect: your keys don’t match, tap Deny.

Claude Code is connected

A checklist of what to do next: protect a project, let Claude ask for passwords, test it. Each step ticks when Vando sees it done.

Wants a password

Claude asked for a secret. You see its hint and why, and pick which of your things it means. The line This reveals the secret is there because once given, it can’t be taken back. Tap Give or Deny.

Wants to run a command

The guard stopped a command. You see the command and the folder. Tap Run or Deny.

Approved · receipt signed, or Denied

What happened. After a Deny you can pause Claude Code for an hour, or disconnect it. How approvals work.

What it can’t do yetCopy Anchor Link

Undo itCopy Anchor Link

vando unguard
claude mcp remove vando
vando disconnect

vando disconnect refuses while the guard is on, so take the guard off first. You can also disconnect from your phone: Connections, the AI, Disconnect.

When it goes wrongCopy Anchor Link

Run vando doctor first: it says what is wrong and the command that fixes it.

“Not connected.”

Run the connect step again with a new code from your phone.

“Vando doesn’t know that code.”

It was mistyped, used already, or older than 10 minutes. Get a new code.

“There is no terminal to check the words at”

The connect step was run without a keyboard, for example by Claude. Run it in your own terminal.

“Can’t reach Vando”

Check the --api address matches what your phone showed. Run it again with VANDO_DEBUG=1 in front to see each try.

Claude says the Vando tools answer “not connected”

Connect first, then start a new Claude Code session.

Last verified 15 October 2026, against the vando command in the Vando code as it is today