envault-run

Inject SQLite-stored secrets into processes at runtime.

Updated May 14, 2026
One-click install
npx skills add https://github.com/savinomarketing/claude-skills --skill envault-run
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: envault-run
Source: https://github.com/savinomarketing/claude-skills/tree/main/envault-run
Command: npx skills add https://github.com/savinomarketing/claude-skills --skill envault-run

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Brings secure local secret management to projects by storing credentials in a private SQLite database and injecting them at runtime, avoiding plaintext files and insecure writes.

Core Features & Use Cases

  • Core concept: secrets live in ~/.envault/envault.db and are scoped per project + environment to support multiple deployments.
  • Env vault wrapper: envault-run injects secrets into processes at runtime without writing to disk.
  • Management patterns: CLI commands for listing, getting, setting, unsetting, and migrating secrets.
  • Auditing and hardening: provides audit checklists and deployment patterns for MCP servers and LaunchAgents.

Quick Start

Install envault-manager and envault-run, configure a project, and verify that secrets are injected into the process environment at runtime without creating plaintext files.

Frequently Asked Questions about envault-run

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage local secrets without storing them in plaintext files?

Local secrets can be managed securely by storing credentials in a private SQLite database and injecting them into processes at runtime, avoiding plaintext files and insecure disk writes entirely.

What is runtime secret injection for local development environments?

Runtime secret injection is a mechanism where a wrapper exports secrets directly into the process environment just before executing a given command, ensuring sensitive data never touches the disk.

How do I configure LaunchAgents to securely receive credentials at runtime?

You can configure LaunchAgents by applying provided audit checklists and deployment patterns that inject secrets into the process environment at runtime, ensuring credentials are passed securely during operation.

Can I scope local secrets per project and per environment for multiple deployments?

Yes, secrets are scoped per project and per environment within the local SQLite database, allowing you to maintain distinct credential sets to support multiple deployments simultaneously.

What CLI commands are needed to set up and migrate local secrets?

Management patterns include CLI commands for listing, getting, setting, unsetting, and migrating secrets, providing full lifecycle control over credentials stored in the private database.

Does this secret management approach work for setting up MCP servers?

Yes, this approach applies directly to setting up and auditing MCP servers, providing deployment patterns that inject required secrets into the server process environment securely at runtime.