envpact — the vault that lives in your own repo

SPEC v3 · ZERO BACKEND · YOUR REPO, YOUR KEYS

One vault. Cut to fit every project.

envpact keeps your secrets in a private repo you own, then cuts them into project-scoped .env files on demand. Rotate a key once — every project that references it picks up the new value on its next run.

01 / CUSTODY

Your vault, your account

Secrets live in <you>/envpact-secrets — a private GitHub repo only you can read. envpact never holds a token of yours.

02 / REUSE

One key, many cuts

Define OPENAI_API_KEY once in shared. Every project referencing shared.OPENAI_API_KEY picks up the value next run.

03 / REACH

Meets your agent where it works

MCP server for Claude Code, Cursor, Windsurf, Cline, Goose. Plus CLI, VS Code extension, GitHub Action, Python module.

04 / LOCUS

Dashboard, no middleman

This page reads and writes your vault straight through the GitHub API. No envpact server sits between you and your keys.

# cut envpact into any AI agent that speaks MCP
$ npx -y envpact-mcp

# or generate .env from your vault on the CLI
$ npx -y envpact-cli

CLI · MCP SERVER · GITHUB ACTION · VS CODE · PYTHON

FULL DOCUMENTATION →

Your keys, served from your own repo.

Your envpact-secrets repo is the single source of truth. This dashboard reads and writes it directly from your browser through the GitHub API — no backend in between.

Privacy model: your access token is held ONLY in this tab's sessionStorage — cleared the moment you close it. Every call goes straight to api.github.com. No envpact server is involved.