brew install keywaysh/tap/keyway
keyway init                  # Create vault, push secrets
keyway run -- npm start      # Run with secrets injected, nothing on disk

A teammate clones the repo and runs keyway run -- npm start. Done in 30 seconds. No .env on disk.

• GitHub-native — If you have repo access, you have secret access. No new accounts, no invites.
• Zero-trust mode — keyway run -- npm start injects secrets at runtime. Nothing on disk.
• AI-safe — Secrets never in .env files, never in AI context. MCP server for assistants that need to manage secrets without seeing them.
• Deploy sync — Push to Vercel, Netlify, Railway with keyway sync.
• Fully open-source — MIT licensed, self-hostable, auditable.

AI coding agents can read your .env files. Keyway keeps secrets out of AI context.

keyway run -- npm start                        # Secrets in RAM only
claude mcp add keyway -- npx @keywaysh/mcp     # MCP server for AI assistants

Learn more →