Skip to content

CLI · Dashboard · MCP · CI

The secrets manager for teams that ship with agents.

Coding agents now write the code, run the tests and deploy, right beside your team. Their secrets still move by copy and paste: through chat, into CI, onto every laptop, until nobody can say who holds what. varsafe keeps your secrets and environment variables in one place, gives every developer, pipeline and agent the access its work needs, and records every read and change.

Start freeConnect an agent

Free for up to 3 people. No card. Hosted in the EU.

agent session · ~/apivia the CLI

You

Is our Stripe webhook endpoint still enabled?

Agent

  • Listed the STRIPE_* keys in production, names only varsafe list

  • Ran the Stripe CLI with STRIPE_API_KEY injected varsafe run

Yes, it's enabled. I injected only STRIPE_API_KEY into the Stripe CLI, so its value never entered my context, the command line or the disk.

0 values in the agent’s context

2 commands · 1 secret injected

Fig. 1One key injected, no value in the agent's context. Real CLI output; names are examples.

The .env problem

Agents read files. Your .env is a file.

A coding agent that can run commands can print your secrets into its own context. varsafe hands the values to the command, not to the agent.

Without varsafe

agent › $ cat .env
STRIPE_API_KEY=sk_live_••••••••
DB_PASSWORD=••••••••••••

Every value is now in the agent’s context, and its transcript.

  • A .env gets shared over Slack and can end up in git history.
  • Offboarding means rotating every key someone saw.
  • Nobody can say who read which secret.

With varsafe

agent › $ varsafe run -- npm test
Injecting 48 secrets from api/production

The values go to the process. The agent sees only what the command prints.

  • No .env file on disk to share, commit or leak.
  • One removal revokes their CLI logins, agent grants and the API tokens they created.
  • Every value read is recorded: who, which client, from where.

From laptop to production

One place, every step of the way.

Developers, agents and pipelines each get the access their work needs, and every step lands in the same audit log.

  1. 01Developer

    A new teammate runs the project on day one.

    Invite them with a role. They sign in from the browser and start the project with the values it needs. Nothing is pasted in chat, and nothing is left on their disk.

    secret.accessed · dev@acme.io · cli
  2. 02Agent

    An agent adds the key its task needs.

    Ask your coding agent to wire up a webhook. It generates the signing key in varsafe, within the projects and permissions you granted, and the code reads it like any other variable.

    secret.created · Claude Code · mcp
  3. 03Pipeline

    CI deploys with a token of its own.

    Each pipeline gets a token scoped to one environment. The deploy step receives production's values as it runs, so there is no file to write or clean up afterwards.

    secret.accessed · ci-deploy token

Runs in

And any shell or pipeline that runs a command.

Where it all lands.

The same environment in the dashboard, with the agent's new key and every version kept. Reveal a value: that read is recorded as secret.accessed, with who, which client and where.

acme / api
production
  • DATABASE_URL${DB_USER}:${DB_PASSWORD}@${DB_HOST}v14
  • DB_PASSWORD••••••••••v6
  • STRIPE_API_KEY••••••••••v3
  • WEBHOOK_SIGNING_KEYby agent••••••••••v1

4 of 48 shown

Fig. 2Your environment in the dashboard, values masked.

For agents

Your agent does the secrets work, without needing the values.

Ask in plain language: set up a service, rotate a key, check what production is missing. Your agent works through the CLI, the API or MCP, with only the access you give it.

Works with

  • Claude Code
  • Codex
  • Cursor
  • VS Code

And any agent that runs commands, via the CLI.

Connect your agent

Authorize agent

Claude Code wants access to acme

Fig. 3The consent screen, simplified. You choose what an agent may do; value reveal stays off unless you allow it.

For your security review

The answers your security team will ask for.

Every line here is something the code does today.

Read the full security model
Storage

Values are encrypted at rest and versioned.

How +

A dedicated secrets vault hosted in the EU. Each environment keeps its last 10 saved versions for rollback.

Sealed files

An exported .env is encrypted to its environment.

How +

X25519, HKDF-SHA256 and AES-256-GCM, with a fresh ephemeral key per value. Each value is bound to its name and environment, so it cannot be moved. Environment keys are protected by a managed key service.

Tenant isolation

One team's data is invisible to another, in the database itself.

How +

PostgreSQL row-level security on secrets, tokens, agent grants, invites, SSO settings and the audit log. The API won't report ready if its database role could bypass those policies.

Audit log

The application cannot rewrite history.

How +

Append-only: events cannot be updated or deleted by the application, and writes go through a single database function. Kept 7 days on Developer, 90 days on Team.

Removal

Removing a member revokes their access in one step.

How +

Their CLI logins, agent grants and the API tokens they created are revoked immediately, and the environment keys they could export are rotated automatically. Values they already revealed stay revealed; rotate those at the source.

Sign-in

Sign in the way your company already does.

How +

GitHub, GitLab, Google and Bitbucket, passkeys, and TOTP two-factor. SAML 2.0 and OIDC single sign-on with domain verification on Team.

Roles

Production changes need an owner or an admin.

How +

Owner, admin, developer, operator, viewer and billing. Protected environments accept writes from owners and admins only.

Questions

Before you try it.

Do I have to change my code?
No. varsafe run starts your command with the values as ordinary environment variables, so code that already reads its environment works as it is, in any language.
What about a tool that insists on a .env file?
varsafe export writes one, encrypted to its environment by default, and varsafe run decrypts it as the command starts. Pass --plain only when something downstream truly needs plaintext.
Can I take my secrets with me?
Yes. varsafe export --plain writes any environment as a regular .env file, whenever you want it.
What can an agent do by default?
Only what you approve on the consent screen, for the projects and environments you choose. Revealing values is a scope of its own, and it starts switched off.

Pricing

Free for small teams. One price when you grow.

Developer

$0

up to 3 people

Unlimited projects and environments, CLI, API and MCP, 7-day audit history.

Team

$15

per person, per month · $12 if billed yearly

SSO, 90-day audit history with export, and access reviews.

Compare plans

Try it on the repo you have open. Install the CLI, sign in from the browser, then put varsafe run -- in front of your dev command.

Start free