Envault –- A local, minimum, encrypted vault for coding agents

Envault, a new open-source tool from developer MildyNora, provides a local, encrypted vault that lets coding agents like Claude Code, Codex, and opencode use API keys and secrets without ever seeing the plaintext values. The tool, available as a prebuilt binary or from source for macOS, Windows, and Linux, encrypts secrets with age, stores the private key in the OS keychain, and masks secrets from command output, with features including Touch ID/Windows Hello gating and an audit log.

A local, minimum, encrypted secrets vault for coding agents — let your AI works with your keys and secret, but never sees them. English · 简体中文 /MildyNora/envault/blob/master/README.zh-CN.md Store your API keys, tokens, and passwords once. Your coding agent refers to them by name and runs commands through envault — the plaintext only ever exists inside the process envault launches, never in the model's context, a .env , or your chat history. The only one command yourun is— it opens the dashboard above, where you add keys and change settings. Every other envault envault … command below run , link , request , … is written by yourcoding agent, which learns them from the skill envault installs. You rarely type them yourself. Prebuilt binary — no Rust needed: curl -fsSL https://raw.githubusercontent.com/MildyNora/envault/master/install.sh | bash Windows PowerShell irm https://raw.githubusercontent.com/MildyNora/envault/master/install.ps1 | iex Or from source needs Rust https://rustup.rs : git clone https://github.com/MildyNora/envault.git && cd envault && ./install.sh Any of these installs the binary, creates your vault, and sets up the agent skill. Runs on macOS, Windows, and Linux; re-run to upgrade. Run envault . Everything is inside the TUI shown above : add and edit secrets, toggle Touch ID and the audit log , and rotate your keypair — no commands to memorize. Changing a setting or rotating is gated behind Touch ID / Windows Hello, so an agent can't do it in your place. Your agent only ever sees names and age-encrypted ciphers . It maps a name to an environment variable and runs your command through envault, which injects the real value and masks it out of the output : bash $ envault link OPENAI API KEY openai $ envault run -- python app.py value injected · output masked When it needs a key you haven't stored, it would not ask you to paste it into chat — it requests a window opens for you: You paste it once the agent never sees it or decline. envault skill install teaches this workflow to Claude Code, Codex, and opencode. Or you can manually set up the keys and tell the agent their names. The commands your agent runs — you don't need these | Command | What it does | |---|---| envault ls --json | list secret names never values | envault link <VAR <name | map an env var to a name | envault run -- <cmd | run with secrets injected + output masked | envault request <name | ask you for a secret it doesn't have | envault fill <name | type a secret into a browser field opt-in | envault import <.env | encrypt a dotenv file into the vault | Secrets are age https://age-encryption.org -encrypted; the private key lives in your OS keychain and never touches disk in the clear. Full design and threat model: docs/how-it-works.md /MildyNora/envault/blob/master/docs/how-it-works.md . envault keeps secrets out of your agent's context and your files — the prompt-leak and accidental-exposure threat. It is not a runtime sandbox : In a very rare case a genuinely malicious process running as you can still use a secret through envault run , and a fully compromised machine can halt the audit log. If that's your threat model, you need OS-level isolation. Details in SECURITY.md /MildyNora/envault/blob/master/SECURITY.md . Issues and PRs welcome — see CONTRIBUTING.md /MildyNora/envault/blob/master/CONTRIBUTING.md . Found a vulnerability? Please don't open a public issue — SECURITY.md /MildyNora/envault/blob/master/SECURITY.md . MIT /MildyNora/envault/blob/master/LICENSE · beta — verify the keychain / biometric paths on your own hardware.