LocalVault

Encrypted local secrets vault with MCP server for AI agents. Zero infrastructure, zero cloud dependency.

Try the interactive demo — explore every command in your browser.

Part of InventList Tools — free, open-source developer utilities for indie builders.

---

Install

Homebrew (macOS / Linux)

brew install inventlist/tap/localvault

RubyGems

gem install localvault

Requires libsodium:

# macOS
brew install libsodium

# Ubuntu/Debian
sudo apt-get install libsodium-dev

# Fedora
sudo dnf install libsodium-devel

Quick Start

# Create a vault (prompts for passphrase)
localvault init

# Store secrets
localvault set OPENAI_API_KEY "sk-proj-..."
localvault set STRIPE_SECRET_KEY "sk_live_..."
localvault set DATABASE_URL "postgres://localhost/myapp"

# Retrieve a secret (raw, pipeable)
localvault get OPENAI_API_KEY

# View all secrets (masked by default)
localvault show

# Reveal values
localvault show --reveal

# Export as shell variables
eval $(localvault env)

# Run a command with secrets injected
localvault exec -- rails server

Commands

Secrets

Command	Description
init [NAME]	Create a vault (Argon2id key derivation)
set KEY VALUE	Store a secret (supports dot-notation: project.KEY)
get KEY	Retrieve a secret (raw, pipeable)
show	Display all secrets in a table (masked by default)
show --reveal	Display with values visible
show --group	Group by dot-notation prefix (one table per project)
list	List key names only
delete KEY	Remove a secret
rename OLD NEW	Rename a secret key
copy KEY --to VAULT	Copy a secret to another vault
import FILE	Bulk-import from .env / .json / .yml
env	Export as export KEY="value" lines
exec -- CMD	Run a command with secrets injected as env vars

Vault Management

Command	Description
vaults	List all vaults with secret counts
switch [VAULT]	Switch default vault
unlock	Cache passphrase for the session
lock [NAME]	Clear cached passphrase
rekey [NAME]	Change vault passphrase (re-encrypts all secrets)
reset [NAME]	Destroy and reinitialize a vault

Sync & Login

Command	Description
login [TOKEN]	Log in to InventList — auto-generates X25519 keypair + publishes public key
login --status	Show current login status
logout	Clear stored credentials
sync	Sync all vaults bidirectionally (push local, pull remote, detect conflicts)
sync --dry-run	Preview what sync would do without making changes
sync push [NAME]	Push one vault to cloud
sync pull [NAME]	Pull one vault from cloud (auto-unlocks if you have a key slot)
sync status	Show sync state for all vaults
config set server URL	Point at a custom server (default: inventlist.com)

Team Sharing (v1.3.0)

Vault-level operations live under team. Person operations (the @handle already signals a person) are top-level.

Command	Description
team init	Convert vault to team vault (sets you as owner, SyncBundle v3)
team list	List vault members
team rotate	Re-key vault with new passphrase, keep all members
verify @handle	Check if a user has a published public key (dry-run)
add @handle	Add teammate with full vault access
add @handle --scope KEY...	Add teammate with access to specific keys only
remove @handle	Remove teammate's access
remove @handle --scope KEY	Remove one scoped key (keeps other scopes)
remove @handle --rotate	Full revocation + re-encrypt with new passphrase

The team add, team remove, and team verify aliases still work for backward compatibility bu

... View full README on GitHub