Envpilot

The open-source environment variable & secrets manager for teams — built for the AI-agent era.

Website · Docs · Blog · Changelog · Roadmap · Report a bug

Most teams still paste .env files into Slack and hope for the best. Envpilot replaces that with one encrypted source of truth that your whole team — and your AI tooling — pulls from. Secret values are encrypted in WorkOS Vault (AES-256-GCM); the database stores only opaque reference IDs, so a database breach yields zero plaintext secrets.

Features

Secrets management

• Per-environment variables — DATABASE_URL for development and production are independent values with one deterministic resolution rule per (key, environment) pair
• Version history, trash & restore, bulk import/export
• Secret rotation reminders with email notifications
• Variable requests — members propose, admins approve

Access control & audit

• Role-based access control — admin / team lead / member, down to per-variable permissions
• Full audit log of every read, write, share, and denial
• Org-scoped API keys stored as SHA-256 hashes with dynamic scopes and optional expiry

Every surface you work in

Surface	Install
Web dashboard	envpilot.dev
CLI	npm i -g @envpilot/cli
VS Code extension	Marketplace · Open VSX
GitHub Action	rafay99-epic/envpilot-action@v1
REST API	API docs
MCP server	MCP docs

Built for AI agents

Agents (Claude Code, Cursor, anything MCP-capable) get scoped, audited, revocable access to exactly the secrets you grant — via the MCP server and scoped API keys. Your raw .env never enters a prompt.

Getting started

Envpilot Cloud	Self-host
The fastest way in — sign up free: 3 projects, 3 teammates, no credit card.	Run your own instance on your own infrastructure — follow the self-hosting guide.

Then connect from your terminal:

npm install -g @envpilot/cli

envpilot login          # device-flow authentication
envpilot init           # link this repo to a project
envpilot pull           # fetch variables for your environment

# or inject variables at runtime — no .env file on disk at all
envpilot run -- npm run dev

Security

Envpilot is a secrets manager, so the boring details matter:

• Secret values live encrypted in WorkOS Vault; the database holds only vault reference IDs — never plaintext.
• API keys and service tokens are hashed (SHA-256) at rest, org-scoped, with optional expiry.
• Reads fail loudly — never partial data, never sentinel values.
• Every access is audit-logged, including denials.

Found a vulnerability? Please report it privately — see SECURITY.md.

Open source vs paid

The code in this repo is MIT-licensed — read it, audit it, run it yourself. Envpilot Cloud is the hosted version: the free tier covers small teams, and the pro tier funds development with higher limits and team features (see pricing). Self-hosted instances are yours to run however you like.

Contributing

Issues and PRs welcome — see CONTRIBUTING.md for the workflow and good first issues for a place to start.

Development setup & repo layout

Envpilot is a Bun + Turborepo monorepo: Next.js web app, Convex backend, CLI, VS Code extension, and shared packages.

bun install
bun run setup
# edit .env.local with your credentials
bun run dev

apps/
  web/                # Next.js web dashboard (@envpilot/web)
  blog/               # Blog — blog.envpilot.dev (@envpilot/blog)
  docs/               # Docs site — docs.envpilot.dev (@envpilot/docs)
  cli/                # CLI npm package (@envpilot/cli)
  admin/              # Admin dashboard (@envpilot/admin)
  vscode-extension/   # VS Code extension (envpilot)
convex/               # Shared Convex backend
packages/
  ui/                 # Shared React UI components (@envpilot/ui)
  tsconfig/           # Shared TypeScript configs
  eslint-config/      # Shared ESLint config
  prettier-config/    # Shared Prettier config

Contributor docs:

• Setup — prerequisites, env vars, install
• Commands — dev, build, test, deploy
• Architecture — data flow, auth, RBAC
• Project Structure — folder layout
• CI / CD — GitHub Actions
• Development Guide — conventions, Convex, TypeScript
• Deployment Guide — Vercel, Convex, npm, Open VSX
• Features — full feature inventory
• Self-Hosting — run your own instance

License

MIT © Syntax Lab Technology and Rafay.

---

Built in the open · envpilot.dev
_{Developed at Syntax Lab Technology · Lead dev rafay99.com}