Run your command with the right environment.
Secrets decrypt on your machine — never on ours.

mkenv is a secrets manager shaped like a command runner. Declare your environment in one typed JSONC document, then put mkenv in front of anything: mkenv bun test, mkenv terraform plan, mkenv ./deploy.sh.

Early access. The CLI is open source (Apache-2.0); hosted sign-in opens soon at app.mkenv.net.

// the document

One file. Typed. Layered. Yours.

Environments are declared in JSONC validated by a JSON Schema — comments welcome, typos caught before anything runs. Documents layer with ordered extends (RFC 7396 merge), so production is a patch on base, not a copy of it.

{
  // mkenv.jsonc — checked into your repo
  "$schema": "https://mkenv.net/schemas/environment-document.v1.json",
  "extends": ["../base.jsonc"],  // ordered layering
  "tenant": "acme",
  "variables": {
    "PORT": 3000,                // any JSON value
    "FLAGS": { "beta": true },
    "DATABASE_URL": { "$secret": "DATABASE_URL" }  // ← decrypts locally
  }
}
// zero knowledge

How secrets stay secret

  1. 1

    Encrypt on your machine

    mkenv secrets set DATABASE_URL encrypts the value with AES-256-GCM under your team's data key before it touches the network.

  2. 2

    We store ciphertext

    The backend holds encrypted envelopes and per-member wrapped keys. It has no key material that can open either.

  3. 3

    Teammates decrypt locally

    Each machine unwraps the data key with its own private key — generated at mkenv login, never uploaded.

The backend cannot read your secrets. Not by policy — by construction.

// open source

Apache-2.0 where it counts

The CLI and the crypto/document core are open source under Apache-2.0 — the code that touches your plaintext is the code you can read. The hosted backend runs on Cloudflare; a self-host build is on the roadmap.

// pricing

A bill you can predict in your head

Free $0 Up to 3 people per team. Full encryption, full CLI.
Teams $9 / $19 / $29 per month Flat per team. No per-seat billing, no per-secret metering, no per-identity math. Tiers finalize at launch.