# Varlock

> Varlock is an open source CLI and library for AI-safe .env files. A .env.schema declares and validates environment variables, secrets are encrypted locally or loaded from external providers, and redaction plus a credential proxy keep secret values away from logs, terminals, and AI agents.

When to use varlock:

- Managing .env files across development, CI, and production environments
- Declaring env vars in a .env.schema with decorators like @type, @required, and @sensitive
- Validating configuration at startup so misconfiguration fails early with clear errors
- Encrypting local overrides in .env.local so nothing sensitive sits in plaintext
- Loading secrets from 1Password, AWS, Azure, GCP, HashiCorp Vault, Infisical, Doppler, Bitwarden, and other providers via plugins
- Redacting secret values from logs and console output at runtime
- Giving AI coding agents full context on config (names, types, docs) without exposing secret values
- Running agents and MCP servers behind the varlock proxy so they only ever see placeholder credentials
- Scanning a repo for leaked secrets with `varlock scan`

Install:

```bash
npx varlock init                 # add to a JS/TS project
npm install varlock              # or add the dependency directly
brew install dmno-dev/tap/varlock  # standalone binary via Homebrew
curl -sSfL https://varlock.dev/install.sh | sh -s   # standalone binary via script
```

Common CLI commands: `varlock init`, `varlock load`, `varlock run -- <cmd>`, `varlock encrypt`, `varlock scan`, `varlock proxy`.

Every page on varlock.dev can be fetched as markdown by sending an `Accept: text/markdown` header. The docs are also searchable over MCP at https://docs.mcp.varlock.dev/mcp (streamable HTTP) and https://docs.mcp.varlock.dev/sse.

## Documentation Sets

- [Abridged documentation](https://varlock.dev/llms-small.txt): a compact version of the documentation for Varlock, with non-essential content removed
- [Complete documentation](https://varlock.dev/llms-full.txt): the full documentation for Varlock
- [Getting started and CLI reference](https://varlock.dev/_llms-txt/getting-started-and-cli-reference.txt): installation, core concepts, env-spec syntax, decorators, and every CLI command
- [AI tools, MCP and proxy](https://varlock.dev/_llms-txt/ai-tools-mcp-and-proxy.txt): using varlock with coding agents, MCP servers, and the credential proxy
- [Framework and language integrations](https://varlock.dev/_llms-txt/framework-and-language-integrations.txt): Next.js, Vite, Astro, Bun, Python, Go, Rust, Java, PHP, Docker, CI, and more
- [Plugins](https://varlock.dev/_llms-txt/plugins.txt): 1Password, AWS, Azure, GCP, Vault, Infisical, Doppler, Bitwarden, Kubernetes, and other providers, plus Effect codegen
- [Sandboxes](https://varlock.dev/_llms-txt/sandboxes.txt): sandboxing recipes for running agents with the proxy

## Notes

- The complete documentation includes all content from the official documentation
- The content is automatically generated from the same source as the official documentation

## Optional

- [GitHub repository](https://github.com/dmno-dev/varlock): source code, issues, and discussions
- [npm package](https://www.npmjs.com/package/varlock)
- [Changelog](https://github.com/dmno-dev/varlock/blob/main/packages/varlock/CHANGELOG.md)
- [Docs MCP server card](https://varlock.dev/.well-known/mcp/server-card.json): MCP transports for searching these docs
- [Agent skills index](https://varlock.dev/.well-known/agent-skills/index.json): SKILL.md files for coding agents
- [Varlock skill (SKILL.md)](https://varlock.dev/.well-known/agent-skills/varlock/SKILL.md)
- [AI catalog (ARD)](https://varlock.dev/.well-known/ai-catalog.json)
- [Blog](https://varlock.dev/blog/)
- [Discord](https://chat.dmno.dev)