Secure secrets for AI agents — local, encrypted, reference-only.
Français | Español | 한국어 | 中文 | Tiếng Việt | 日本語
Secure environment variable management for AI-assisted coding.
MCP server that lets AI reference your secrets by name — never by value.
- Local-only storage — Your secrets never leave your machine
- Encrypted at rest — AES-256-GCM with Argon2id key derivation (64 MB memory, 3 passes)
- Reference-based access — AI references variables by name, never sees the actual values
- Automatic .env injection — Values can be automatically injected into your .env files
- AI Access Control — Block AI from proactively listing or checking your secrets
- Universal Compatibility — Works with any AI tool via MCP, OpenAI, Gemini, or REST protocols
npm install -g @fentz26/envcp
envcp init
envcp add API_KEY --value "your-secret-key"
envcp serve --mode auto --port 3456| Guide | Description |
|---|---|
| Setup Guide | Installation, CLI reference, integrations, configuration |
| Verification | SLSA 3 provenance verification — npm, GitHub CLI, slsa-verifier |
| Security Policy | Vulnerability reporting, encryption details, best practices |
- SLSA Level 3 — Build provenance for supply chain integrity (verify →)
- Encrypted at rest — AES-256-GCM with Argon2id key derivation
- Local-only — Your secrets never leave your machine
- SHA-pinned CI — All GitHub Actions pinned to immutable commit SHAs
- Signed npm releases —
npm audit signaturesverifiable from v1.2.0+
SAL v1.0 — See LICENSE file for details.
- Email: contact@envcp.org
- GitHub Issues: https://github.com/fentz26/EnvCP/issues
- Documentation: https://envcp.org/docs