| Variable Key | Detected Provider / Pattern | Severity | Entropy | Masked Value Preview | Action Recommendation |
|---|---|---|---|---|---|
| No environment variables parsed yet. Paste or load a preset above to begin audit. | |||||
Unlock unlimited YAML, TOML, JSON, and Kubernetes secret exports with zero cloud telemetry.
~/Library/Application Support/Claude/claude_desktop_config.json
run_with_vault, the decrypted environment is passed directly to the ephemeral child process via pipe/IPC. The agent never sees raw credentials in chat contexts or tool call arguments.
scan_env — Scan .env file for secrets & entropy
Read-Only
Scans a local environment file, calculates Shannon entropy for each variable, runs 50+ provider regex detectors, and returns a structured vulnerability report.
{ "file_path": ".env.production", "entropy_threshold": 4.2 }
audit_secrets — Deep repository & git diff auditor
Read-Only
Audits tracked files, untracked candidates, and staged git diffs to detect accidental secrets before commits.
{ "target_dir": "./src", "check_git_history": false }
sanitize_env — Generate clean .env.example templates
Generative
Parses an existing production environment file, preserves comments and keys, and replaces sensitive tokens with standardized descriptive placeholders.
{ "source_file": ".env.production", "output_file": ".env.example" }
encrypt_vault — Create AES-256-GCM encrypted vault
Security
Derives an encryption key via PBKDF2-HMAC-SHA256 and encrypts environment variables into a portable tamper-evident JSON payload.
{ "env_file": ".env.production", "vault_file": "secrets.vault" }
decrypt_vault — Ephemeral in-memory decryption
Security
Decrypts an EnvGuard vault file into an in-memory dictionary. Fails securely if the authentication tag or ciphertext is modified.
{ "vault_file": "secrets.vault", "verify_only": true }
run_with_vault — Zero-disk process execution
Execution
Decrypts vault variables directly into an isolated child process execution environment. No secrets touch disk or shell history.
{ "vault_file": "secrets.vault", "command": ["npm", "run", "build"] }