Your secrets,
available where
your code runs.
MeowPass is a CLI-first, open-source secret manager. Store credentials once and use them from your terminal, CI/CD, deploy targets, and AI agents.
Love MeowPass?
We’re officially live on Product Hunt. If MeowPass has helped you, we’d really appreciate your support — and there’s 3 months of Pro on us to say thanks.
One vault, wherever you work
Store a secret once and reach it from your editor, your pipelines, and your deploy targets.
Agents get brokered access. The real keys stay on the server and are injected at call time.
Your secrets sync with your code. New teammate? mp pull, done in seconds.
One file connects a repo to its secrets
mp init writes a .meowpass.yaml in your project root. Commit it. It holds no secrets, just a pointer to the vault and the environments you use. A teammate clones the repo, runs mp pull, and has what they need.
- Safe to commit, no secrets or keys
- CLI auto-detects vault per repo
- Teammates clone →
mp pull→ done - Supports multiple environments
How agents get access
Agents get access to a tool, not a copy of your credentials.
Request
requestAn agent asks the broker to use a tool. MeowPass checks the agent's policy and scopes, and for sensitive tools it waits for you to approve.
Inject
injectMeowPass makes the call with the real credential added on the server, or mints a short-lived token like a GitHub App token. The agent never sees the key.
Record
recordEvery call is logged with the tool, duration, result, and prompt, attributed to the agent. You can revoke a session at any time.
How MeowPass compares
Pick what fits how you work.
| MeowPass | dotenvx | AWS Secrets Manager | |
|---|---|---|---|
| Setup time | 2 min (install + init) | 1 min (encrypt) | 30+ min (IAM + SDK) |
| Architecture | Encrypted vault + API | Encrypted .env files in git | Cloud KMS service |
| Encryption | AES-256-GCM (envelope, at rest) | ECIES + secp256k1 + AES-256 | AWS KMS (AES-256) |
| Access model | SSO + least-privilege + audited | Share raw private key | IAM policies |
| Team sharing | Grant scoped access per member | Share raw DOTENV_PRIVATE_KEY | IAM policies |
| Secret versioning | Per-secret history + rollback | Git history (encrypted diffs) | Per-secret versions |
| Key rotation | Server-side KEK rotation | Per-file keypair rotation | Automatic rotation |
| AI integration | MCP server + credential broker | Basic MCP (blog post) | None |
| Runtime injection | mp run (in-memory) | dotenvx run (in-memory) | SDK required in code |
| Drift detection | mp diff + git hooks | git diff on encrypted files | None |
| Offline support | Encrypted local cache | Fully offline (file-based) | Requires network |
| Web dashboard | app.meowpass.dev (agents, sessions, audit) | None (file-based) | AWS Console |
| CI/CD | GitHub Action (token / keyless OIDC) | Commit .env + CI secret | AWS SDK in pipeline |
| Node.js SDK | @meowlabs/meowpass | @dotenvx/dotenvx (drop-in) | aws-sdk |
| Secret TTL | Auto-expire (--ttl 24h) | None | None |
| Audit trail | Built-in per action | Git log only (free tier) | CloudTrail |
| Open source | Fully open source | Core open, Ops closed | Closed source |
| Account required | Yes (free) | No (free tier) | Yes (AWS account) |
| Pricing | Free / $5/mo Pro / $8/user Team | Free + $2.99-90/mo | $0.40/secret/mo |
TL;DR: dotenvx encrypts a .env file inside one repo. MeowPass keeps your secrets in a vault you can reach from any machine, deploy, or agent, with versioning, audit, and per-person access when your team grows.
Use MeowPass when:
- You lost your .env switching laptops (again)
- You paste keys into Vercel/Railway by hand
- You give Cursor or Claude Code your API keys
- Your .env files drift between machines
- You juggle .env, .env.local, .env.production
- Later: you share secrets with a teammate
dotenvx is enough when:
- You only ever work on one machine
- One project, one environment, forever
- You want an encrypted .env committed to git
- Your secrets never leave that one repo
Both are fine. The day your secrets need to leave that repo, that is where MeowPass helps.
One vault for your entire workflow
CLI, web dashboard, AI agents, and CI/CD, encrypted at rest and brokered for agents.
Secret Vault
Store API keys, tokens, certificates, and connection strings. Organized by project, environment, and team.
.env Sync
Pull secrets directly into your .env files. One command syncs staging, production, or any custom environment.
Team Sharing
Share vaults with your team. Role-based access, audit logs, and automatic key rotation for enterprise security.
Encrypted at rest, access you can audit
Every secret is encrypted at rest with AES-256-GCM. Each secret has its own data encryption key, protected by a key encryption key managed on the server. Access requires SSO, is scoped per request, and is written to an audit log. For agents, provider keys are added server-side and never reach the agent.
- AES-256-GCM envelope encryption at rest.
- SSO through WorkOS with MFA and passkeys.
- Scoped access with a full audit trail.
- Brokered access for agents.
- Secret expiration with TTL.
Everything you need to ship securely
CLI, SDK, MCP, and a GitHub Action, so secrets are managed everywhere you code.
One-command setup
mp init detects your .env files and sets up the vault.
Sync across machines
mp pull writes the right secrets into any environment.
Multiple environments
Keep default, local, and production separate.
Drift detection
mp diff shows what changed. Use it in CI to block a bad deploy.
Runtime injection
mp run loads secrets into the process. Nothing is written to disk.
Version history
mp history shows every change. mp rollback restores a prior version.
AI access
A 14-tool MCP server lets an agent use secrets without reading their values.
Audit trail
Who accessed what, when, and from where.
This is your codebase.
We both know it.
You have 47 API keys scattered across Slack DMs, sticky notes, and .env files you're terrified to touch. Your last "rotation" was copying a key from a coworker who left 6 months ago.
MeowPass replaces the chaos with a single encrypted vault that holds every secret, project, and teammate in one place.
Fix this in 2 minutesOpen source, and easy to check
The encryption, authorization, and broker code is open source. You can read exactly how a secret is stored and how access is granted.
Encrypted at rest
AES-256-GCM envelope encryption. Access is scoped and audited.
No lock-in
mp pull writes a plain .env file, so you can leave with one command.
Pricing that scales with you
Start free. Upgrade when you outgrow it.
Product Hunt Launch Special
Get 3 months of MeowPass Pro free using code PRODUCTHUNT.
Developer
For getting started. No card required.
- 10 vaults
- 50 secrets
- CLI access
- Web app + Chrome extension
- MCP server access
- .env sync
- Community support
Pro
For a working developer. Unlimited vaults and secrets.
- Unlimited vaults
- Unlimited secrets
- .env sync
- MCP server access
- API keys
- Priority support
Team
For a team. Shared vaults, per-person roles, and audit logs.
- Everything in Pro
- Shared team vaults
- Role-based access
- 90-day audit logs
- SSO / SAML
- Secret rotation
- Admin console
Running in about two minutes
Four commands.
Put your secrets
in one place.
Encrypted vaults, brokered access for agents, and one CLI for your whole team. Install takes about a minute.