You point an AI coding agent at your repo to move faster — and now it can read
every secret in it: the .env files, the keys pasted into terminals, the
tokens in your shell history. kovra closes that gap. It custodies your secrets in
an encrypted local vault and lets agents and tools use them without ever
seeing them — not in a log, not on disk, not in argv, and never in an AI
agent’s context. Every sensitive action waits for you to
bioProve it — kovra’s word for a one-gesture
biometric check (Touch ID, Windows Hello): kovra does the work, you authorize
it.
Built for AI Agents
kovra’s reason for being. Point Claude Code — or any MCP client — at your
project and it runs under a scope: it sees that a secret exists, its
coordinate and sensitivity, and can run commands through the wrapper — but
the plaintext of your high / prod / inject-only secrets never enters
the model’s context.
Process injection
kovra run resolves an .env.refs file (env-var names → coordinates,
never values) and injects the resolved values straight into a child
process. Nothing touches disk, argv, or shell history.
Encrypted local vault
Per-project or global. A per-vault master key lives in the OS keychain and encrypts every entry at rest (ChaCha20-Poly1305); secret-bearing memory is zeroized after use.
You bioProve, kovra acts
Revealing or injecting a sensitive secret — or lowering its protection — asks you to bioProve it (or fall back to your device password). No checklist of commands to run by hand.
.env.refs contract.