EnvBook

Free for the first year

Never paste an API key into your agent again.

EnvBook keeps your keys encrypted in your browser, then writes the .env files, MCP configs, and agent instructions every project needs. Values land on your disk — not in a prompt, not in a chat log, and not on our server.

Start freeNo card. Free for a year.

Your stack

# acme-app — local
# Generated by EnvBook. Contains secrets — never commit this file.

# --- Neon ---
DATABASE_URL=••••••••••••••••

# --- Anthropic ---
ANTHROPIC_API_KEY=••••••••••••••••

# --- Stripe ---
STRIPE_SECRET_KEY=••••••••••••••••
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_xxxxxxxxxxxx
3 secret values decrypt in your browser — the server only ever stores ciphertext.

Live demo — every file above is produced by the same generators the app runs. Toggle a service and watch it rewrite.

Three steps, then your agent takes it from there.

  1. Add your keys once

    They encrypt in your browser before they leave it. Add a key once and switch it on in whichever projects need it.

  2. Pick your services

    184 services with the variable names, docs links, and setup notes already filled in. Import an existing .env and it matches them for you.

  3. Write the files

    Link a folder and EnvBook writes .env.local, .env.example, .mcp.json and AGENTS.md straight into it — merging, never overwriting.

The server never sees a secret value.

Values are encrypted in your browser with a vault password only you know. What crosses the network is ciphertext. We designed it so that a breach of our database would not hand anyone your keys — and so that we could not read them if we wanted to.

The trade-off is real and worth stating plainly: the vault password cannot be reset. If you lose it, the values are gone, and you re-add them.

Prompts carry names, not values
Agent instructions and prompt packs interpolate variable names only. The generator throws if a real secret reaches them.
Every export is checked before you can copy it
Generated output runs through a leak check — known key patterns, your own stored fingerprints, and high-entropy strings. Copy stays disabled unless it comes back clean.
Your agent reads names, writes values
The local MCP server hands your agent variable names and writes the real .env to disk itself, so values never enter its context.
Freefor your first year

EnvBook is early, and the fastest way to make it good is to have real projects in it. Everything below is included, with no card and no trial timer. We will give existing users plenty of notice before anything changes.

  • Unlimited projects, services and environments
  • Account-wide keys, switched on per project
  • Env, MCP config and agent-instruction generation
  • One-click writes into a linked local folder
  • Local MCP server and CLI for your coding agent
  • Docs monitoring for the services you use
Create your first project