Keys your agents can use, never read.
A Mac vault that runs your projects without a single .env file.
Free and open source under MIT. For macOS 14 or later on Apple silicon. In development now.
From .env to nothing on disk.
Values live encrypted on your Mac. Your commands get them at run time, and only for as long as they run.
-
Drop the folder in
Redact reads every env file in the project, shows you what it found, and saves it to the vault.
-
Run with your variables
Prefix the command you already use. Pick the environment when it matters.
redact run --env production -- npx wrangler deploy -
Delete the plaintext
Once
redact runworks for you, the.envfiles can go. Nothing replaces them on disk.
Approve on your Mac, not in the chat.
When an AI agent runs a command through Redact, a panel asks you first. The agent never sees a value.
- Touch ID for every run
- Deny, allow once, or allow for 15 minutes.
- Output stays masked
- A value that prints comes out as
[redact:NAME]. - Names only over MCP
- Agents can list variables and run approved commands. No tool returns a value.
- Model keys behind a proxy
- OpenAI and Anthropic calls go through a local proxy, so the key never enters the command.
Recognizes Claude Code, Cursor, Codex, Gemini CLI, Windsurf and Zed.
Every folder knows its account.
Bind a folder once. From then on, plain wrangler deploy goes to that folder’s Cloudflare account.
| Account | What bound folders get |
|---|---|
| Cloudflare | Its Wrangler profileor CLOUDFLARE_API_TOKEN and the account ID |
| GitHub | GH_TOKEN |
| Vercel | VERCEL_TOKEN |
| Supabase | SUPABASE_ACCESS_TOKEN |
| AWS | AWS_PROFILENo secret stored |
The rest of the vault.
Every project folder, its environments, and the accounts it runs as.
Standalone API keys, linked into as many projects as use them. Rotate once, every copy follows.
Finds values that escaped into folders, git history, shell history and agent transcripts. A pre-commit hook blocks new ones.
Which agent ran what, and with which variable names.
An encrypted .redact file that opens with your Recovery Key, on this Mac or a new one.
What keeps the vault shut.
- Every record sealed
- Each value is encrypted on its own with ChaCha20-Poly1305 under a 256-bit vault key.
- Key in the Secure Enclave
- The vault key is wrapped by a Secure Enclave key that needs Touch ID, and by a Recovery Key you keep.
- Values only where they run
- They reach the command’s environment and nothing else: no file, no log, no agent context.
- No account, no server
- Everything works offline. The model proxy listens on 127.0.0.1 and forwards only to OpenAI and Anthropic.
Questions before you switch.
When can I use it?
Redact is in development. The public repository and a Homebrew cask come with version 1.0. Ask to be notified and we will write when it ships.
Does an approved command see my values?
Yes. Approving gives that command the values. Output is masked, but the command itself can use them however it likes, so approve what you would run yourself.
What if Redact is locked when I commit?
The pre-commit hook never asks for Touch ID or starts the app. It checks well-known key formats only, and says so.
Can it push secrets to my hosts?
Yes: Cloudflare, GitHub Actions, Supabase, Vercel and AWS, each through its own CLI with values over stdin. Vercel and AWS have not been tested on real accounts yet.
Does it run on Intel Macs?
No. Redact needs Apple silicon and macOS 14 Sonoma or later.