AI agent
One request, in plain words
You ask for the repo's env setup in chat. The starting point is an AI request in your editor, not memorized commands.
Only key names and statuses reach the AI
The env vault for Claude Code & Cursor
Secrets your AI can use. Values it's never handed.
Ask once in chat. manage-env generates what it can, and provider keys like Stripe's are entered only in your local terminal. Even after CI sync and app runs, the AI gets back only statuses and key names.
Only key names and statuses reach the AI The server stores only ciphertext
AI chat · local MCP
You
Set up this repo's env. Generate what you can, ask me only for provider keys, then run the app.
AI agent
I'll handle it with local manage-env tools. Values stay out of chat and tool results.
setup_project
4 generated locally · 2 config defaults ready
request_value_from_user
Local prompt · STRIPE_SECRET_KEY, DATABASE_URL
sync_to_target
GitHub Actions synced · key names only
run_with_secrets
App ran successfully · 1.8s · output hidden from AI
What the agent sees: statuses, key names, next steps. No values on this screen.
How it works
Skip the copy-paste. Ask once.
Your machine
local MCP
Safe values, generated automatically
The agent reads .env.example, mints random secrets and signing keys, and fills non-secret defaults - without seeing the generated values.
Provider keys go to you, only
Externally issued values - Stripe keys, DATABASE_URL - are pasted into your local terminal, never into chat.
Runs and syncs, returns no values
MCP tool results carry status, duration, target, and key names — never secret values. If a run fails, you get a snippet of its output with the values masked out, so debugging still works.
run_with_secrets
sync_to_target
manage-env server
The server stores only ciphertextStores ciphertext and metadata without values. The server cannot turn that data back into plaintext.
What goes where
Three roles. Values visible in one place.
AI agent
Gets statuses, key names, and the next step. Plaintext values never travel back; a failed run's output returns only with values masked.
Your machine
Decryption always happens on this machine. Values are injected only into the process you run and the sync targets you approved.
manage-env server
Stores ciphertext and metadata without values. The server cannot turn that data back into plaintext.
Why it's safe to hand your secrets to an agent
MCP tools inject secrets into a process and return exit codes and key names. There is no tool that fetches a value, so there is no path for one to come back through a tool result.
no get_secret tool
2
Decryption happens locally, full stop
Values are unlocked on this machine and travel only to the process you run and the sync targets you approved. What stays on the server is ciphertext it cannot open.
3
Even diff and history carry no values
Version compare, changed-key lists, and sync status are computed from per-key fingerprints, not plaintext. Versions are compared without ever seeing a value.
One-time setup
Connect once. Talk from then on.
The terminal is only for the first trust setup and for typing values yourself. After that, you work from the AI request in your editor.
-
Agent-led repo setup
The AI discovers required keys, links the project, and fills what's safe to create automatically.
-
No-reveal MCP execution
run_with_secrets injects values into the process and returns only status, duration, and key names.
-
Trusted CI sync
Syncs to GitHub Actions, Vercel, or Cloudflare - only to targets you approved beforehand.
Claude CodeCursorGitHub ActionsVercelCloudflare
curl -fsSL https://manage-env.com/install | shmenv signupmenv connectmenv init me/my-appThe prompt to send your AI
Set up this repo with manage-env. Generate safe random/config values, ask me locally for provider-issued secrets, sync trusted CI targets, then run the app without returning secret values.
The button copies the full step-by-step guide (English), not just the sentence above.
Pricing
Free for individuals. Team in the works.
Individual features are open today. Team sharing and billing launch separately once operations are ready.
Individual
$0 Free forever
Manage secrets safely for the projects you build alone.
- Individual projects
- CLI and local MCP
- Version history and CI sync
Team
Coming soonShare projects and manage member roles as a team.
- Shared team projects
- Member roles and access control
- Team activity and access records
Pricing will be announced here once billing and operational checks are complete.
Env chores go to the AI. Values stay in the vault.
Create an account and connect your first repo - from then on, one sentence to your agent is enough.