mkenv is a secrets manager shaped like a command runner. Declare your environment in one typed JSONC document, then put mkenv in front of anything: mkenv bun test, mkenv terraform plan, mkenv ./deploy.sh.
Early access. The CLI is open source (Apache-2.0); hosted sign-in opens soon at app.mkenv.net.
Environments are declared in JSONC validated by a JSON Schema — comments welcome, typos caught before anything runs. Documents layer with ordered extends (RFC 7396 merge), so production is a patch on base, not a copy of it.
{ // mkenv.jsonc — checked into your repo "$schema": "https://mkenv.net/schemas/environment-document.v1.json", "extends": ["../base.jsonc"], // ordered layering "tenant": "acme", "variables": { "PORT": 3000, // any JSON value "FLAGS": { "beta": true }, "DATABASE_URL": { "$secret": "DATABASE_URL" } // ← decrypts locally } }
mkenv secrets set DATABASE_URL encrypts the value with AES-256-GCM under your team's data key before it touches the network.
The backend holds encrypted envelopes and per-member wrapped keys. It has no key material that can open either.
Each machine unwraps the data key with its own private key — generated at mkenv login, never uploaded.
The backend cannot read your secrets. Not by policy — by construction.
The CLI and the crypto/document core are open source under Apache-2.0 — the code that touches your plaintext is the code you can read. The hosted backend runs on Cloudflare; a self-host build is on the roadmap.