Multi-Environment Support, mp Shorthand, and a New Web Dashboard

Three updates shipped today across the CLI, MCP server, and web dashboard. Here is what changed and why.

Multi-Environment Secrets

You can now store secrets per environment within a single vault. No more separate vaults for dev, staging, and production:

mp set STRIPE_KEY sk_test_... --env local
mp set STRIPE_KEY sk_live_... --env production
mp pull --env production

Each secret is tagged with an env label. The CLI, MCP server, SDK, and web dashboard all support the --env flag. If you don't specify one, it defaults to default.

This means mp init now creates per-file environments automatically: .env becomes default, .env.local becomes local, .env.production becomes production.

mp Shorthand

Every meowpass command now works with mp. Shorter to type, easier to remember:

# before
meowpass vault list
meowpass set API_KEY value
meowpass run -- npm start

# after
mp vault list
mp set API_KEY value
mp run -- npm start

Both meowpass and mp work. The shorthand is an alias, not a replacement. All docs and UI now use mp by default.

Web Dashboard Updates

The web dashboard at app.meowpass.dev now supports:

• Reveal and copy secrets. After you sign in via SSO (WorkOS), the server decrypts on your behalf for authorized, audited access.
• Environment column. See which env each secret belongs to.
• Delete per environment. Remove a secret from a specific env without affecting others.

Secrets are encrypted at rest with AES-256-GCM envelope encryption (a per-secret data key wrapped by a server-managed key). On an authenticated, scoped, audited request, the server decrypts on your behalf. MeowPass is not zero-knowledge.

MCP Server v0.3

The MCP server (@meowlabs/meowpass-mcp) now passes env to all 14 tools. AI agents can target specific environments:

"Use the production Stripe key for deployment"
→ meowpass_get_secret(vault: "my-app", key: "STRIPE_KEY", env: "production")

Upgrade

brew upgrade meowpass
npm update -g @meowlabs/meowpass-mcp

All changes are backwards-compatible. Existing secrets without an env tag are treated as default.