Metadata + Sealed Secrets
envpkt stores metadata about secrets — what service each credential authenticates to, when it expires, how to rotate it — and can optionally store age-encrypted values as sealed packets, safe to commit.
envpacket
One file answers five questions per credential — What / Where / Why / When / How
Environment Scanning
Auto-discover credentials from your shell with envpkt env scan. Matches ~45 known services, ~13 suffix patterns,
and ~29 value shapes with confidence scoring.
Fleet Health
Scan an entire directory tree of agents with envpkt fleet. Get aggregated health status, expiration warnings, and
stale credential detection across your fleet.
Shared Catalog
Define secret metadata once in a central catalog, then have each agent reference it. Resolve to flat configs for
deployment with envpkt resolve.
MCP Integration
Built-in MCP server exposes credential metadata to AI agents. Four tools and two resources for health monitoring and capability discovery.
Functional API
TypeScript library built on functype. All functions return Either or Option — no thrown exceptions. Use
programmatically for boot, audit, fleet scan, and more.