enveilSecrets for you.Leashes for your agents.
One self-hosted store instead of scattered .env files. You sign in; every AI agent and CI job gets its own identity — scoped, read-limited, audited, revocable.
Self-host from GitHub · Read the docs · No values ever on screen
the .env problem, now with agents
Your .env is in the context window
A coding agent that can read your repo can read .env — and paste it into a prompt, a log, or a pull request.
One token means everything
Hand an agent your personal token and it holds your reach across every project, with nothing slowing it down.
Nobody knows who read what
When a key leaks, the first question is who had it. With files, the answer is everyone and every backup.
This is the whole thing, running.
Import once, then prefix your commands. Values stay on the server; the page and the terminal only ever show key names.
An agent is not a user. enveil does not pretend it is.
Every design choice starts from the same question: what happens when the thing holding the credential is running unattended?
Machine identities with read budgets
Each agent gets a token scoped to the environments it needs, with its own expiry and a limit on secrets read per minute and per hour. Going over is refused and recorded — a runaway loop shows up in the trail instead of draining prod.
agent claude-dev · stepshots/dev · read · 600/minNothing on disk
enveil run puts secrets into the child process and writes no file.
enveil run -- cargo testCI without stored tokens
GitHub Actions proves who it is with its OIDC token. Each one is exchanged once, for an identity that expires in minutes.
permissions: id-token: writeEncryption that knows where it lives
Values are sealed under a per-project key and bound to their project, environment and name — ciphertext copied from prod into dev fails to decrypt. The master key rotates with one command, without re-encrypting a single value.
enveil-server rotate-master-keyEvery read is on the record
The audit write sits inside the decrypt. If it cannot be recorded, the value is not returned.
read · who · what · when · from whereUndo without looking
Every write keeps the old value. Roll back a bad rotation without the credential ever being shown.
enveil rollback STRIPE_KEY 3From twenty .env files to one command.
Sign in once
Browser login; the token goes to your OS keychain, never a file.
$ enveil loginMove a project in
.env goes to dev, .env.production to prod. Templates are skipped.
$ enveil init --create && enveil importRun with it
Delete the files. Prefix the command instead.
$ enveil run -- dx servewhat it does not do (yet)
An agent allowed to run commands can still run enveil run -- env and print what it was given. enveil bounds how much it can read, how fast, and makes every read attributable — it does not yet let an agent use a secret without seeing it.
That needs a credential-injecting proxy, and it is the next thing on the roadmap. Until then: give agents dev, keep prod for people and CI.
Your secrets, on your server.
Rust, PostgreSQL, one container. Open source, built on the Oxidt kit.