Cloak encrypts your .env secrets and replaces them with fakes on disk. Agents see sandbox values. You see the real ones.
Works with VS Code, Cursor, Windsurf, and any VS Code fork
macOS / Linux: curl -fsSL https://getcloak.dev/install.sh | sh
Windows: irm https://getcloak.dev/install.ps1 | iex
Every coding agent scans your working directory for context. Your .env is just another file.
.gitignore only protects git. It does nothing for local file reads.
Claude Code, Cursor, Copilot, and Codex index your project to build context. That includes every .env file with your Stripe live keys, database URLs, JWT secrets, private keys, and wallet mnemonics. No exploit required — it's how they work.
File contents are sent to AI providers as part of API requests. Your production database password is now in a context window on someone else's infrastructure. It's in logs, in caches, potentially in fine-tuning pipelines.
A leaked sk_live_ key can drain Stripe accounts. A leaked database URL exposes user data. A leaked private key or wallet mnemonic in your .env means irreversible loss of funds. By the time you rotate, the window is open.
.gitignore protects git, not disk. Vault/Infisical are for teams and production. Environment managers don't encrypt at rest. Nothing prevents a local process from reading cat .env and getting your real credentials. Until Cloak.
Real credentials go into an AES-256-GCM encrypted vault. Structurally valid fakes go to disk. Everything is local. No servers, no accounts, no network calls.
Run cloak init. Cloak scans for secrets using pattern matching and entropy analysis. Real values are encrypted to a local vault. Sandbox replacements are written to disk. A recovery key and CLI access password are set.
The VS Code / Cursor extension intercepts file opens and saves. You see and edit real credentials in your buffer. On save, the extension encrypts to the vault and writes sandbox values to disk. Zero workflow change.
cloak run decrypts the vault and injects real environment variables into any child process. Touch ID or password required — AI agents can't authenticate. No files touched.
Lost your keychain? Switched machines? cloak recover restores vault access from your recovery key. PBKDF2-SHA256 with 100k iterations protects the recovery file. No data is ever lost.
Drop a SKILL.md skill file into your project. Your AI agent will actively protect secrets — checking for Cloak, suggesting protection, and using cloak run instead of reading .env directly. With your consent, always.
Add it to any project in seconds. Copy SKILL.md to your project root, or append the rules to your CLAUDE.md, .cursorrules, or .windsurfrules. The agent becomes security-aware — it will never read real secrets, always use Cloak commands, and ask before making changes.
Your .env on disk contains structurally valid fakes. Real secrets live in an encrypted vault in ~/.config/cloak/ that agents never touch. Your editor decrypts and shows the real values in memory only.
Single binary. Zero runtime dependencies. No cloud accounts. No config files. Install once, protect every project.
Secrets encrypted with AES-256-GCM. Keys stored in your OS keychain. Binary vault format with magic bytes, versioning, and integrity verification.
aes-gcmIdentifies API keys, database URLs, tokens, passwords, and private keys by name patterns and value analysis. Shannon entropy catches unknown secret formats.
entropy > 4.5Sandbox values are structurally valid. sk_test_* for Stripe, postgres://dev:dev@localhost for databases. Your linters and parsers still work.
Touch ID on macOS, CLI password on all platforms. Even if an agent runs cloak peek, it can't authenticate. No TTY means no access.
VS Code, Cursor, and Windsurf extension intercepts open/save. Real values in buffer, sandbox on disk. Cloak Terminal provides a shell with real env vars (modal-gated).
typescriptTerminal workflows: init, edit, peek, run, set, reveal, recover. Works standalone without any editor extension.
Human-readable recovery key shown once during init. PBKDF2-SHA256 with 100k iterations. Recover from lost keychain on any machine. Secrets are never lost.
pbkdf2cloak run npm start injects real env vars into child processes. Touch ID or password required. No files modified. No disk writes.
macOS (Intel + Apple Silicon), Linux (x86_64 + ARM64), Windows (10/11). Touch ID on Mac, password everywhere else. Same vault format across all platforms.
3 platforms
Any process that reads files from disk gets sandbox values. No per-agent configuration.
If it can cat .env, Cloak handles it.
While building WAM — an agentic gaming company with crypto payment rails — I quickly saw how fragile local .env files become when AI agents take over your workflow. Wallet keys, payment secrets, API tokens for real money infrastructure, all sitting in plaintext on disk, fully readable by every agent in the project.
I looked for a solution. Nothing existed. Secret managers protect servers, not laptops. .gitignore protects git, not disk. So I built Cloak — and open-sourced it because every developer running AI agents has this exact same problem.
— Daniel Tamas
Encryption protects the vault. Biometric auth blocks the CLI. Modal gates block the extension. Every failure mode favors visibility over lockout.
Encryption keys in macOS Keychain, libsecret, or Windows Credential Manager. Protected by your OS login. Never on disk as plaintext.
Touch ID on macOS, PBKDF2-hashed password on all platforms. CLI commands that reveal secrets require authentication. AI agents can't bypass.
No TTY means no access. Piped input, scripted access, and CI runners are blocked. Only interactive terminals can authenticate.
Cloak Terminal with real env vars requires clicking a modal dialog. AI agents can't interact with VS Code modals.
No backup files, no temp files that persist, no recovery dumps. Plaintext only exists in editor memory buffers.
No telemetry, no analytics, no cloud sync. Only cloak update optionally checks GitHub releases. Everything else is offline.
Write-to-temp-then-rename. Interrupted saves can't corrupt vaults or leave half-written .env files.
Decrypt failure on open shows sandbox with a warning. Encrypt failure on save writes real values to disk. Temporary leak beats permanent data loss.
MIT licensed. Rust CLI and TypeScript extension. Read every line. Build from source. No obfuscation, no binaries you can't inspect.
Secret managers protect production infrastructure. None of them protect the .env file
on your laptop from being read by AI agents. That's a different threat model. That's what Cloak does.
| Cloak | HashiCorp Vault | Infisical | Doppler | 1Password CLI | .gitignore | |
|---|---|---|---|---|---|---|
| Hides secrets from AI agents on disk | ||||||
| Replaces secrets with valid sandbox values | ||||||
| Encrypts .env at rest on your machine | partial | |||||
| Biometric / password auth gate | biometric | |||||
| Works without cloud accounts or servers | ||||||
| Zero network calls | ||||||
| Editor integration (VS Code / Cursor) | partial | partial | ||||
| Runtime env injection (no file writes) | ||||||
| Automatic secret detection | partial | |||||
| Offline recovery system | partial | partial | ||||
| Single binary, zero dependencies | ||||||
| Open source (MIT) | BSL | |||||
| Setup time | 10 sec | hours | 30 min | 15 min | 15 min | 10 sec |
| Price | Free | self-hosted or HCP $$ | $18/user/mo | $21/user/mo | $7.99/user/mo | Free |
.env file — sitting right there in your project directory — is fully readable by every AI agent you run. You're paying $21/month per seat for secret management while your Stripe live key is in plain text on disk, one cat .env away from landing in an AI provider's context window. Cloak is the only tool that solves this. And it's free.
.gitignore prevents files from being committed to git. It does nothing for local file access. AI agents read from your working directory, not from git. If an agent can run cat .env, it sees your real secrets. Cloak ensures cat .env returns sandbox values.
Those are team secret managers for production infrastructure. Cloak is workstation-level protection for individual developers. No servers, no accounts, no team management. Use both: Vault for production, Cloak for your laptop.
If you lose both keychain access and recovery key, you can't decrypt the vault. But nothing is destroyed — your project structure is intact with sandbox values. Re-enter your real credentials and run cloak init again. Save the recovery key in a password manager.
Sandbox values are structurally valid but won't authenticate. Use cloak run npm start to inject real environment variables (Touch ID or password required), or use the Cloak Terminal in VS Code which has real values pre-loaded.
No. Zero network calls. Everything runs locally. The only optional network request is cloak update checking GitHub releases. No telemetry, no analytics, no cloud sync. Ever.
No. Touch ID requires biometric proof. The CLI password requires a TTY (interactive terminal) — piped input and scripted access are rejected. The VS Code Cloak Terminal requires clicking a modal dialog that AI agents can't interact with. Three layers, all human-only.
Delete the auth file (~/.config/cloak/vaults/<hash>.auth) and run cloak init again in the project to set a new password. Your vault and recovery key are unaffected.
Yes. The Rust CLI works standalone. Use cloak init to protect, cloak edit for your terminal editor, cloak peek to compare values, and cloak run for real env vars. Claude Code reads the sandbox .env from disk and never sees real credentials.
v0.1 protects .env, .env.local, .env.development, .env.production, .env.staging, and .env.test. Support for ~/.ssh, ~/.aws, and other sensitive files is planned for v0.3.
Yes. MIT licensed. Rust CLI + TypeScript extension. Same vault format, fully cross-compatible. Audit it, build from source, or contribute on GitHub.
Install the extension. Your .env is cloaked. Your workflow doesn't change.
VS Code, Cursor, Windsurf & any VS Code fork — same extension