Secure secret management with a Human-In-The-Loop (HITL) interceptor for agent mutations.
Envault is a secure, modern vault application built with Next.js, Supabase, and Tailwind CSS. It provides a robust authentication system and a sleek user interface for storing and managing sensitive information.
/[username]/[project-slug]) for easy sharing and navigation.Envault natively supports the Model Context Protocol (MCP), so AI coding assistants like Claude Desktop, Cursor, and RooCode/Cline can pull and push your secure environments effortlessly.
# Automatically configure your AI clients (Global & Local Workspaces)
envault mcp install
# Or install strictly for the current workspace
envault mcp install --local
macOS & Linux (Universal)
curl -fsSL https://raw.githubusercontent.com/DinanathDash/Envault/main/install.sh | sh
macOS (Homebrew)
brew tap DinanathDash/envault
brew install --formula envault
Homebrew cask installs are deprecated. If you installed via cask, migrate with:
brew uninstall --cask dinanathdash/envault/envault
brew install --formula envault
For more details, check out the CLI Documentation.
Envault local development now uses portless with HTTPS hostnames.
npm install -g portless
To use the Envault CLI with the local development server, set the ENVAULT_CLI_URL environment variable:
export ENVAULT_CLI_URL="https://envault.localhost:1355/api/cli"
envault login
For one-command envault run local app startup, prefer hosted API fetch-first behavior by not setting ENVAULT_CLI_URL/ENVAULT_BASE_URL.
Envault uses a hybrid encryption model to ensure maximum security:
Follow these steps to get the project running locally.
Clone the repository
git clone https://github.com/dinanathdash/envault.git
cd envault
Install dependencies
npm install
# or
yarn install
# or
pnpm install
# or
bun install
Environment Setup
Copy the example environment file:
cp .env.example .env.local
Open .env.local and add your Supabase credentials:
NEXT_PUBLIC_SUPABASE_URL=your-project-url
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
# Generate a secure key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY=your-64-char-hex-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
UPSTASH_REDIS_REST_URL=your-upstash-url
UPSTASH_REDIS_REST_TOKEN=your-upstash-token
# Used for securely signing and verifying frontend API mutations (POST, PUT, DELETE, PATCH)
NEXT_PUBLIC_API_SIGNATURE_SALT=your-secure-random-hmac-secret
Run the development server
npm run dev
Open https://envault.localhost:1355 with your browser to see the result.
If you plan to use native Vercel sync (recommended for Vercel serverless runtimes), add these variables:
VERCEL_CLIENT_ID=your_vercel_oauth_client_id
VERCEL_CLIENT_SECRET=your_vercel_oauth_client_secret
VERCEL_REDIRECT_URI=https://your-domain.com/api/integrations/vercel/callback
VERCEL_WEBHOOK_SECRET=your_vercel_webhook_signing_secret
NEXT_PUBLIC_VERCEL_INTEGRATION_INSTALL_URL=https://vercel.com/<team-or-user>/~/integrations/envault
Use production URLs in production. Do not use ngrok or localhost callback URLs outside local development.
Test Email Configuration (Optional)
To verify that your Resend API configuration is working, you can send a test email to yourself:
npm run test:email -- your-email@example.com
This repository contains multiple publishable/runtime components. Use this map when cloning and contributing.
| Folder | Purpose | Install | Common Commands |
|---|---|---|---|
./ | Main Next.js app | npm install | npm run dev, npm run build, npm run lint, npm run test:all |
cli-go/ | Go CLI (envault) | go mod download | go test ./..., go build ./... |
src/lib/sdk/ | npm SDK package (@dinanathdash/envault-sdk) | npm install | npm run typecheck, npm run build |
mcp-server/ | npm MCP package (@dinanathdash/envault-mcp-server) | npm install | npm run check, npm start |
cli-wrapper/ | npm wrapper for CLI install/bootstrap | npm install | node install.js |
git clone https://github.com/dinanathdash/envault.git
cd envault
npm install
cp .env.example .env.local
cd src/lib/sdk && npm install
cd ../../.. && cd mcp-server && npm install
cd ..
npm run lint
npm run test:all
npm run build
@dinanathdash/envault-sdk (source: src/lib/sdk/)@dinanathdash/envault-mcp-server (source: mcp-server/).github/workflows/publish.yml.github/workflows/publish-sdk.yml.github/workflows/publish-mcp.ymlEach package versions independently via semantic-release when changes occur in its own folder:
v<version>sdk-v<version>mcp-v<version>This keeps SDK and MCP release streams decoupled from CLI version bumps.
npm run sdk:check
npm run mcp:check
npm run sdk:publish
npm run mcp:publish
Use these commands so users can quickly verify what version they are on and update safely.
envault)Check installed CLI version:
envault --version
Update via Homebrew formula:
brew update
brew untap dinanathdash/envault || true
brew tap dinanathdash/envault
brew upgrade --formula envault
@dinanathdash/envault-sdk)Check installed and latest SDK versions:
npm ls @dinanathdash/envault-sdk
npm view @dinanathdash/envault-sdk version
Update SDK (preferred via Envault CLI):
envault sdk update
Update SDK (npm fallback):
npm install @dinanathdash/envault-sdk@latest
Runtime behavior:
@dinanathdash/envault-mcp-server)Check installed MCP version (standalone MCP package installs):
envault-mcp-server --version
Check MCP update availability (standalone MCP package installs):
envault-mcp-server --check-update
Update MCP integration (preferred via Envault CLI):
envault mcp update
Update MCP globally (npm fallback for standalone installs):
npm install -g @dinanathdash/envault-mcp-server@latest
Copyright (c) 2026 Dinanath Dash. All Rights Reserved.
The repository root source code is provided strictly for transparency, security auditing, and education. This is not open-source software.
You may inspect and analyze the code for security purposes. You may not execute, compile, run, deploy, copy, modify, fork, redistribute, sublicense, or provide any service using proprietary repository code without prior explicit written permission.
License scope exception: mcp-server/ and src/lib/sdk/ are distributed under MIT licenses in their respective directories.
See the LICENSE file for the complete legal terms.
Source-derived launch command. Check the maintainer’s required arguments and credentials before running:
npx -y @dinanathdash/envault-mcp-serverMerge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.
{
"mcpServers": {
"io-github-dinanathdash-envault": {
"command": "npx",
"args": [
"-y",
"@dinanathdash/envault-mcp-server"
]
}
}
}Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.
Claude Desktop setup reference@dinanathdash/envault-mcp-servernpmio.github.DinanathDash/envault works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.
~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.~/.cursor/mcp.jsonRestart Cursor for changes to take effect..vscode/mcp.jsonReload VS Code window for changes to take effect.~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect..mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.