envault-cli

Envault

Git-backed, zero-trust secrets manager for developer teams.

Envault encrypts your API keys and tokens directly inside your existing Git repo. No central vault, no third-party trust, no .env files committed in plaintext. Private keys never leave your machine. Secrets are injected into processes in memory at runtime — never written to disk.

Why Envault

Most teams leak secrets without realising it:

• .env files committed to repos (anyone with clone access has the keys)
• Secrets passed over Slack, email, or copy-paste
• A shared vault that requires trusting a third-party server

Envault is different: it uses your team's existing Git remote as the transport. Each secret is encrypted end-to-end — only team members who have been granted access can decrypt. Remove a member from the vault and they lose future access. No new infrastructure required.

Install

One-line install (macOS / Linux, amd64 / arm64) — downloads the latest signed release, verifies its checksum, and drops envault on your PATH:

curl -fsSL https://raw.githubusercontent.com/MicheleColella/envault-cli/main/scripts/install.sh | sh

Override the target with ENVAULT_VERSION=v0.9.0 or ENVAULT_INSTALL_DIR=~/.local/bin.

With Go (any platform Go supports):

go install github.com/MicheleColella/envault-cli/cmd/envault@latest

From source:

make build && sudo make install   # builds ./envault and installs to /usr/local/bin

Releases are cross-compiled in CI and published to GitHub Releases with a checksums.txt signed via keyless cosign. Windows binaries are not yet published (pending a Windows keychain backend).

Claude Code plugin

Envault ships as a Claude Code plugin: the AI Privacy Shield hooks, an embedded MCP server, the /envault:* slash commands, and a skill that teaches Claude the vault workflow, all enabled per-project (never globally by default).

The MCP server (envault mcp serve) exposes typed, JSON-Schema-validated tools (envault_status, envault_add, envault_list, envault_rotate, envault_run, envault_protect, envault_push, envault_pull) so Claude calls Envault directly instead of constructing bash commands — there's no shell string to parse, so no shell-injection surface, and tool responses carry only metadata (name, algorithm, recipient count, timestamps), never a secret value. It runs headless, per Claude Code session, with no persistent daemon.

/plugin marketplace add MicheleColella/envault-cli
/plugin install envault@envault

envault@envault is <plugin>@<marketplace> — both are named envault in marketplace.json.

Enabling the plugin is reversible (/plugin uninstall envault) and scoped via .claude/settings.json (enabledPlugins). The plugin is additive — the CLI installs above are still the way to use Envault from a plain terminal.

Packaging decision: the plugin's hooks call envault on your PATH; it does not bundle platform-specific binaries. Install the binary once via any method above, then enable the plugin. Run envault doctor if the hooks report the binary is missing.

Quick start

# 1. Initialise a vault in your repo
envault init

# 2. Generate your identity key (sealed in your OS keychain, encrypted at rest
#    under a passphrase you choose — the key never leaves your machine)
envault key new --id you@example.com

# 3. Add a secret
echo "sk-abc123" | envault add OPENAI_KEY

# 4. Push the encrypted vault to your remote
envault push

# 5. A teammate pulls and runs their app with secrets injected in memory
envault pull
envault run -- npm start

Reading a key (e.g. run, cat, export) asks for the passphrase that protects it. For non-interactive/CI use, supply it via the ENVAULT_PASSPHRASE environment variable (less secure — visible to same-user processes).

Commands

Add --agent-safe (alias --json) to any command for structured JSON output; in this mode cat/export refuse to print plaintext unless you pass --force.

Security model

Envault is designed so that you do not have to trust anyone except your Git remote:

• End-to-end encryption — secrets are encrypted on your machine before they are committed. Each secret uses a random data key (AES-256-GCM) wrapped to every recipient's X25519 public key. Only recipients with a matching private key can decrypt.
• Private keys never leave your machine — they are sealed in the OS keychain (macOS Keychain via security, Linux kernel keyring via keyctl) and are never sent anywhere.
• Private keys are encrypted at rest — the keychain blob is itself encrypted under a passphrase-derived key (Argon2id → AES-256-GCM), so even a process that reads your keychain gets useless ciphertext without your passphrase.
• Zero-trust remote — the Git remote only ever stores ciphertext. Even if the remote is compromised, no secrets are exposed.
• No disk writes — secrets are decrypted in memory and injected directly into the child process. Nothing is written to a temp file.
• Per-recipient access control — adding or removing a teammate from the vault controls who can decrypt. rotate re-seals a secret with a fresh data key for the current recipients, truly revoking a removed member.
• Leak prevention — an optional Git pre-commit hook (envault hook install --git) scans the staged diff for .env files, private keys, and known API tokens, blocking the commit before a secret ships.
• AI Privacy Shield — the Envault Claude Code plugin blocks AI agents from reading protected paths or running envault cat/export, masks any vault secret that appears in tool output, and records every access in a tamper-evident audit log.
• Integrity guaranteed — ciphertext is authenticated; any tampering is detected and rejected before decryption.

Status

Active development — the full core workflow is implemented end-to-end: init a vault, manage keys, add/import secrets, push/pull over Git, envault run -- <cmd> to inject secrets in memory, AI-agent integration (Claude Code Privacy Shield), and one-line install from signed cross-platform releases.

Requirements

• Go 1.25+
• macOS or Linux
• Git (any version with remote support)

Build

make build          # static binary → ./envault  (CGO_ENABLED=0)
go test ./...       # run the test suite

The binary embeds its version from the latest git tag:

./envault --version

Contributing

The project is in active development. The roadmap is managed internally. Feel free to open an issue to discuss ideas, report bugs, or ask questions.

License

MIT