CLI Reference

All MeowPass CLI commands. Install with brew install meowrithm/tap/meowpass.

Quickstart (4 commands)

bash

brew install meowrithm/tap/meowpass mp login mp init mp run -- npm start

After init, all commands use your default vault automatically, with no --vault flag needed.

Getting Started

mp login

Usage: mp login

bash

$ mp login Opening your browser to sign in... If it doesn't open, paste this URL manually: https://api.workos.com/user_management/authorize?… ✓ Logged in as you@example.com

mp init

Scan for .env files, create a vault, and push all secrets. Sets as default vault. Use --recursive for monorepos: one vault per subproject.

Usage: mp init [--name vault-name] [--vault existing-id] [--recursive]

--name : Vault name (default: directory name)

--vault : Use existing vault instead of creating one

--recursive : Monorepo mode: init every subdirectory with a .env into its own vault + .meowpass.yaml (skips node_modules, dist, etc.)

bash

$ mp init Found 2 env file(s): • .env • .env.production Create vault "my-project"? [Y/n] y Created vault "my-project" (ID: abc123) Pushed 12 secrets from .env # Monorepo: one vault per project: $ mp init --recursive Found 3 project(s) with .env files: • apps/api • apps/web • packages/worker ✓ apps/api → vault "apps-api" (9 secrets) ✓ apps/web → vault "apps-web" (14 secrets) ✓ packages/worker → vault "packages-worker" (3 secrets)

mp doctor

Check MeowPass configuration, API connectivity, auth status, and vault health.

Usage: mp doctor

bash

$ mp doctor MeowPass Doctor ================ [OK] Config file ~/.meowpass/config.yaml [OK] API reachable 245ms [OK] Authentication you@example.com (pro) [OK] Encryption salt found [OK] Session token cached in keychain [OK] Default vault my-project

Secrets

mp set

Encrypt and store a secret. Creates version 1 or bumps version on update.

Usage: mp set KEY VALUE [--vault id] [--ttl duration]

--vault : Vault ID (optional if default set)

--ttl : Auto-expire after duration (e.g., 24h, 30m, 168h)

bash

$ mp set STRIPE_KEY sk_live_abc123 Secret 'STRIPE_KEY' set (version 1) $ mp set DEPLOY_TOKEN xyz --ttl 24h Secret 'DEPLOY_TOKEN' set (version 1) [expires in 24h]

mp get

Decrypt a secret. Copies to clipboard by default.

Usage: mp get KEY [--vault id] [--no-clipboard]

--no-clipboard : Print to stdout instead of clipboard

bash

$ mp get STRIPE_KEY Secret 'STRIPE_KEY' copied to clipboard $ mp get STRIPE_KEY --no-clipboard sk_live_abc123

mp list

List all secret keys in a vault with versions and last update date.

Usage: mp list [--vault id]

bash

$ mp list KEY VERSION UPDATED DATABASE_URL v3 2026-05-05 STRIPE_KEY v1 2026-05-04 OPENAI_API_KEY v2 2026-05-03

mp delete

Permanently delete a secret from the vault.

Usage: mp delete KEY [--vault id]

bash

$ mp delete OLD_TOKEN Secret 'OLD_TOKEN' deleted.

Sync & Run

mp pull

Decrypt all secrets and write to a .env file.

Usage: mp pull [--vault id] [--env name]

--env : Environment name (writes .env.{name})

bash

$ mp pull Synced 12 secrets to .env $ mp pull --env production Synced 8 secrets to .env.production

mp push

Parse a local .env file, encrypt, and upload all secrets to the vault.

Usage: mp push [--vault id] [--env name]

bash

$ mp push Pushed 12 secrets from .env $ mp push --env staging Pushed 6 secrets from .env.staging

mp run

Decrypt vault secrets and inject into a subprocess as environment variables. Secrets never touch disk.

Usage: mp run [--vault id] [--env name] -- command [args...]

bash

$ mp run -- npm start [server] Listening on :3000 $ mp run -- docker compose up $ mp run -- python manage.py runserver $ mp run -- go run .

mp diff

Compare local .env with vault secrets. Shows added, removed, and changed keys with values.

Usage: mp diff [--vault id] [--env name] [--exit-on-drift]

--exit-on-drift : Exit code 1 if differences found (for CI)

bash

$ mp diff + NEW_LOCAL_KEY (local only) - REMOVED_KEY (vault only) ~ DATABASE_URL (value differs) = STRIPE_KEY (unchanged) Comparing .env ↔ vault: 1 added, 1 removed, 1 changed

Versioning

mp history

Show version history for a secret. Last 10 versions are retained.

Usage: mp history KEY [--vault id]

bash

$ mp history DATABASE_URL History for DATABASE_URL: VERSION DATE v4 2026-05-05 14:22 (current) v3 2026-04-28 09:11 v2 2026-04-15 16:45 v1 2026-04-01 10:30

mp rollback

Restore a secret to a previous version. Creates a new version (non-destructive).

Usage: mp rollback KEY --version N [--vault id]

bash

$ mp rollback DATABASE_URL --version 2 Rolled back 'DATABASE_URL' from v4 to v2 (now at v5)

Vaults & Teams

mp vault create

Create a new encrypted vault.

Usage: mp vault create NAME

bash

$ mp vault create my-api Vault 'my-api' created (ID: a1b2c3d4)

mp vault list

List all vaults you own or have access to.

Usage: mp vault list

bash

$ mp vault list ID NAME CREATED a1b2c3d4 my-api 2026-05-01 e5f6g7h8 my-web 2026-05-04

mp team create

Create a team for vault sharing.

Usage: mp team create NAME

bash

$ mp team create backend Team 'backend' created (ID: t1a2b3c4)

mp team invite

Invite a member to a team by email.

Usage: mp team invite EMAIL --team ID [--role member|admin|owner]

bash

$ mp team invite sarah@acme.dev --team t1a2b3c4 --role admin

Backup

mp export

Export an encrypted backup of a vault's secrets to a local file. Includes every environment. Protected by a separate backup password (AES-256-GCM); the file never leaves your machine.

Usage: mp export [--vault id] [--out file]

--vault : Vault to export (defaults to active vault)

--out : Output file (default: meowpass-backup.mpbackup)

bash

$ mp export --out my-app.mpbackup Backup password: ******** Confirm backup password: ******** Exported 20 secret(s) to my-app.mpbackup (encrypted). Keep the backup password safe: it's the only way to decrypt this file.

mp import

Decrypt an .mpbackup file with its backup password and push the secrets into the target vault, re-encrypting under that vault's key.

Usage: mp import [--file backup.mpbackup] [--vault id]

--file : Backup file to import (or pass as the first argument)

--vault : Target vault (defaults to active vault)

bash

$ mp import my-app.mpbackup Backup password: ******** Imported 20 secret(s) into vault a1b2c3d4.

Deploy Integrations

mp vercel sync

Decrypt vault secrets locally and push them to a Vercel project's environment variables. The MeowPass env auto-maps to a Vercel target (production → production, staging/preview → preview, otherwise development).

Usage: mp vercel sync --project NAME [--env name] [--target t] [--vercel-token tok] [--vercel-team slug] [--dry-run] [--vault id]

--project : Vercel project name or ID (required)

--env : MeowPass environment to sync (default: default)

--target : Override Vercel target: production, preview, development

--vercel-token : Vercel API token (or set VERCEL_TOKEN)

--vercel-team : Vercel team slug for team projects

--dry-run : Show what would sync without pushing

bash

$ mp vercel sync --project my-app --env production Syncing 12 secrets to Vercel project "my-app" (target: production) + DATABASE_URL (created) ↻ STRIPE_KEY (updated) ... Done. 8 created, 4 updated, 0 unchanged.

Prefer a browser flow? Connect Vercel via OAuth and sync from the web. See the Vercel guide. For giving AI agents brokered access to providers, see the Credential Gateway.

Utilities

CI/CD: secrets are decrypted server-side, so CI only needs a scoped API key. Create one with mp apikey create ci-key, set it as MEOWPASS_TOKEN, then run mp pull, or use the GitHub Action.

mp apikey create

Generate an API key for MCP server or CI/CD.

Usage: mp apikey create NAME

bash

$ mp apikey create my-mcp-key API key created: mp_a1b2c3d4e5f6... Save this key: it won't be shown again.

mp git-hook install

Install a pre-commit hook for drift detection.

Usage: mp git-hook install [--vault id] [--strict]

--strict : Block commits when drift detected (default: warn only)

bash

$ mp git-hook install Installed pre-commit hook (warn-only mode) $ mp git-hook install --strict Installed pre-commit hook (strict mode)

mp whoami

Show current authenticated user.

Usage: mp whoami

bash

$ mp whoami Email: you@example.com Name: Your Name Plan: pro