Secure secrets for AI agents — local, encrypted, reference-only.

^{Français | Español | 한국어 | 中文 | Tiếng Việt | 日本語}

 

 

Secure environment variable management for AI-assisted coding.
MCP server that lets AI reference your secrets by name — never by value.

---

Why EnvCP?

• Local-only storage — Your secrets never leave your machine
• Encrypted at rest — AES-256-GCM with Argon2id key derivation (64 MB memory, 3 passes)
• Reference-based access — AI references variables by name, never sees the actual values
• Automatic .env injection — Values can be automatically injected into your .env files
• AI Access Control — Block AI from proactively listing or checking your secrets
• Universal Compatibility — Works with any AI tool via MCP, OpenAI, Gemini, or REST protocols

---

What's New in v1.2.0

• Rust Core Library: AES-256-GCM encryption, Argon2id key derivation, and HMAC-SHA256 implemented in Rust for maximum performance and security
• Memory Hardening: Zero-sensitive memory, prevent swapping, core dump protection
• Brute-Force Protection: Progressive delays and permanent lockout after repeated failures
• Email/Webhook Notifications: Alert on security events (lockouts, unlocks)
• Auto-Startup System Service: Install as systemd/launchd/Windows service for always-on availability
• API Key Enforcement: Stricter validation when AI access is enabled
• Config File Integrity Protection: HMAC-SHA256 signatures detect tampering
• Release Channels: Latest, Experimental, and Canary channels for different risk profiles
• Python Native Binding: pip install envcp-core for Python applications without Node.js
• Security Audit Fixes: All High and Medium severity findings addressed (CORS bypass, backup auto-restore, Windows injection, etc.)

Quick Start

Install and initialize:

npm install -g @fentz26/envcp
envcp init

Add your secrets (you'll set a vault password on first use):

envcp add API_KEY --value "your-secret-key"

Start the MCP server for AI tools:

envcp serve

Your AI can now reference secrets by name without ever seeing the values. Full guide: SETUP.md

---

Documentation

Guide	Description
Setup Guide	Installation, CLI reference, integrations, configuration
Verification	SLSA 3 provenance verification — npm, GitHub CLI, slsa-verifier
Security Policy	Vulnerability reporting, encryption details, best practices

---

Security & Supply Chain

• SLSA Level 3 — Build provenance for supply chain integrity (verify →)
• Encrypted at rest — AES-256-GCM with Argon2id key derivation
• Local-only — Your secrets never leave your machine
• SHA-pinned CI — All GitHub Actions pinned to immutable commit SHAs
• Signed npm releases — npm audit signatures verifiable from v1.2.0+

License

SAL v1.0 — See LICENSE file for details.

Support

• Email: contact@envcp.org
• GitHub Issues: https://github.com/fentz26/EnvCP/issues
• Documentation: https://envcp.org/docs