llm-env-vault: keep .env secrets out of your AI agent

Telling your AI agent "don't read .env" is a suggestion, not a control.

llm-env-vault is an MCP server that replaces the secret values in your .env files with harmless numbered placeholders, stores the real values in a password-encrypted local vault, and lets you run real commands with real secrets injected. Every time, a native password dialog that only you can answer is the gate.

What it does

• Placeholders, not secrets. /llm-env-vault:protect finds every .env in your project and moves the real values into the vault. The agent keeps working with the variable names.
• Run with real secrets. run_with_env injects the real values into one command you approve, scoped to only the variables it needs. Output is redacted before it reaches the agent.
• Typed placeholders (new in 2.0). SMTP_PORT=17, SMTP_USE_SSL=false, DATABASE_URL=postgres://placeholder-3.invalid: config loaders like pydantic-settings, django-environ and Spring still parse the file, and it still holds no real value.
• Whole-file encryption. Encrypt a secrets file into a .levault that is safe to commit.
• Nothing happens silently. Every operation that touches a real value shows a dialog with exactly what will change, and nothing is written until you click Allow.

Security

scrypt key derivation, AES-256-GCM with the header authenticated, envelope encryption with an optional paper recovery key, and atomic writes. The master password never touches disk and is never a CLI argument or environment variable. Adversarial review passes closed a leak into the agent's context, a git-config code-execution vector and TOCTOU windows.

Known limitations

Windows is the tested and supported platform; macOS and Linux need python on the PATH and are untested. The first run installs the Python dependencies with pip. Restart Claude Code after installing.

Backed by 640+ tests.