Correct, for the path enveigh is built around. run_with_env injects secrets into a child process as environment variables and redacts those values from everything the agent reads back: the model receives a working command result, not a key. The plaintext-returning tools are off by default; when you opt in, they're Touch-ID gated and audited.

Values live in the macOS Keychain (kSecAttrAccessibleWhenUnlockedThisDeviceOnly: device-only, available only while your Mac is unlocked). Only non-secret metadata (names, tags, rotation dates) is written to app-data on disk. There is no enveigh cloud.

Through a local, token-gated UNIX-domain-socket broker that only runs while the vault is unlocked. Each connected client gets its own scoped token, and a client can be restricted to a single environment, enforced by the broker, not the client.

Anything that speaks MCP via the bundled enveigh-mcp server. The app detects and connects Claude Code, Claude Desktop, Codex, Cursor, Windsurf, Gemini CLI, and Antigravity; any other MCP client takes the same one-line config. There's also an enveigh CLI for scripts and terminals.

No. Claude Code's auto mode runs its own safety classifier over every tool call, and it sometimes blocks enveigh's write tools (adding a secret to an environment, for example) because they sound like credential changes. enveigh already confirms those with Touch ID, so the second gate is redundant. Open Settings → Agents → Manage… for Claude Code and turn on Pre-approve enveigh tools: enveigh adds the mcp__enveigh allow rule to your Claude settings, which resolves before the classifier runs. The same toggle sets Codex's approval mode and Gemini CLI's trust flag. Raw-value tools still prompt in the client no matter what. See the MCP docs.

Yes. The terminal edition runs on Ubuntu 24.04+, Arch and Omarchy, on x86_64 and ARM64. Values are stored with pass and your GPG key, approvals happen in a keyboard-first TUI, and agents connect through the same scoped MCP tokens. Install a package (Arch and Omarchy get a signed pacman repository), then run enveigh: it sets up, starts the service and unlocks. See the Linux page and Linux docs. Windows is not supported.

No. The sandbox would break the Keychain and broker model enveigh depends on. It's a Developer ID–signed, notarized direct download instead, so it opens cleanly with no Gatekeeper warning.

The app is in private beta. Reach out at hello@khuur.dev if you'd like to follow development or get early access.

It's free during the private beta. Pricing, if any, will be announced before it changes; early-access users will hear first.

Touch ID gates revealing and copying values by default, and you can require it before any command runs with injected secrets. You can relax the gate in Settings if you prefer.

Rotating creates a new version and retires the previous one. The old version stays in the Keychain through a grace window so you can roll back, then a purge pass deletes it. Bindings follow the current version unless you pin one.

Quit the app and drag it to the Trash. Your Keychain entries can be removed from Keychain Access (service enveigh), and the metadata lives under ~/Library/Application Support/enveigh.