Because sharing API keys over chat is not a security strategy.
Engineering teams often drift into fragile security habits: tokens pasted in temporary chats, unencrypted .env files scattered across disks, or paid cloud vaults with recurring bills. CryptEnv was built as a 100% local vault where your keys never leave your machine.
With CLI tools like Claude Code and Claude Desktop, the challenge was allowing an AI model to run build steps and tests without leaking API keys into the prompt context. I built an MCP server (JSON-RPC 2.0 over stdio) in Rust: the model requests command execution inside a workspace, and CryptEnv injects the environment variables directly into the child process without exposing raw values to the LLM.
↳ Workspace credential management with local-first encrypted storage.
All records are secured inside a local SQLite database with AES-256-GCM, deriving the master key through Argon2id. Whenever the vault locks or the app is idle, encryption keys in memory are overwritten with zeros to guard against memory dumps.
Security tools only succeed when they are frictionless. With a global Ctrl+Alt+Z shortcut and Windows Hello biometrics, the vault opens and unlocks in under a second from any terminal or editor.
↳ Workspace export controls and environment variable generation.
Because no student should build their semester schedule by hand.