Envy

Your agent gets the .env.
Never the key.

A tiny Mac app that keeps the keys you reuse in your Keychain and drops them into any project as a ready .env. Even when your coding agent is the one asking.

For macOS. Lives in your menu bar. One email when it ships.

XcodeFileEditViewWindowHelp
Fri 9:41
Type a key… (an, op, hf)
RECENT
ANTHROPIC_API_KEY · OPENAI_API_KEY
KEYS
ANTHROPIC_API_KEYsk-ant-•••4f2a
OPENAI_API_KEYsk-proj-•••a91c
OPENROUTER_API_KEYsk-or-•••02bd
GEMINI_API_KEYAIza•••x7Qe
GROQ_API_KEYgsk_•••Lw4
HF_TOKENhf_•••Kd2m
REPLICATE_API_TOKENr8_•••9fLq
⇥select↩copy as .env⌘Nnew key⌘Kactions0 selected

Your agent asks.
You approve.
It never sees a value.

Envy ships a small command line tool. Coding agents run it like any shell command, and they only ever learn which names were written.

rag-demo — zsh
~/code/rag-demo $ envy list
ANTHROPIC_API_KEY  OPENAI_API_KEY  GEMINI_API_KEY  HF_TOKEN
# names only, never values

~/code/rag-demo $ envy fill --from .env.example --to .env
waiting for approval in the menu bar…
✓ ANTHROPIC_API_KEY   written
✓ CLAUDE_API_KEY      written
· OPENAI_API_KEY      already set
· PINECONE_API_KEY    not in Envy

Works with the agent you use.

Anything that can run a shell command. The approval names who is asking, and that label grants nothing on its own.

  • Claude Code
  • Codex
  • Cursor
  • Gemini CLI
  • GitHub Copilot
  • Any terminal

Setup is one paste into CLAUDE.md or AGENTS.md.

Everything you need. Nothing on your Dock.

Envy is an eye in your menu bar and one shortcut. That's the whole app.

Click the eye.

Every key you've saved, with a masked hint so you know which one it is. Click a row to copy it. The clipboard clears itself after 30 seconds. Paste NAME=value to add a new one.

Or press ⌥ ⌘ E from anywhere.

Type two letters. an finds ANTHROPIC_API_KEY, hf finds HF_TOKEN. Tab picks a few keys, Return copies them as ready .env lines. ⌘K has the rest: export lines, JSON, or straight into a folder.

Fill a project in one drop.

Drop a .env.example on the eye. Envy shows the names it will write and the target, never the values. CLAUDE_API_KEY gets your ANTHROPIC_API_KEY. Real values you already set are left alone, and the file goes into .gitignore.

FinderFileEditViewGoWindow
Fri 9:41
Search keys…
AANTHROPIC_API_KEYsk-ant-•••4f2a
OOPENAI_API_KEYsk-proj-•••a91c
GGEMINI_API_KEYAIza•••x7Qe
HHF_TOKENhf_•••Kd2m
RREPLICATE_API_TOKENr8_•••9fLq
Copied OPENAI_API_KEY — clears in 28s
ANTHROPIC_API_KEYop
OPENAI_API_KEYsk-proj-•••a91c⇥ to select
OPENROUTER_API_KEYsk-or-•••02bd
⇥select↩copy as .env⌘Nnew key⌘Kactions1 selected
ENV
.env.example
Fill keys for rag-demo~/code/rag-demo/.env
  • ANTHROPIC_API_KEY
  • CLAUDE_API_KEY← ANTHROPIC_API_KEY
  • OPENAI_API_KEYalready set
  • PINECONE_API_KEYnot in Envy · Add…

Envy never gives a key's value to any command or agent. It writes the file itself, after you approve.

Denies in 1:58DenyApprove ↩

Private by design.

No account. No sync. No network calls. Your keys stay on your Mac.

No command returns a value.

No flag, output format, URL scheme or AppleScript either. The envy tool contains no Keychain code at all. It gets back names, paths and statuses.

In your Keychain.

Encrypted and locked with your Mac login. Other apps get a macOS prompt.

Every write needs you.

The prompt shows names and the full path. Unanswered, it denies itself after 2 minutes.

Copies clean up.

The clipboard clears after 30 seconds and clipboard managers are asked to skip it.

Files stay where you ran it.

Targets must be plain files inside the project folder. Symlinks, hard links, pipes and devices are refused before any prompt appears.

What Envy doesn't control: once a .env is written it's an ordinary file, and what a tool does with it is up to that tool. Any app can read a copy you make during its 30 seconds. UI scripting could in theory click Approve until Touch ID on Approve ships.

Questions.

Do I need a coding agent?

No. The menu-bar list, the ⌥⌘E palette and drag-and-drop work on their own. The command line is there when you want it.

Do I have to re-enter my keys?

No. Envy reads the secrets you export in your shell config and any .env you drop in. It only lists what looks like a secret and asks before replacing anything.

Can scripts tell what happened?

Yes. envy exits 0 when done, 2 when denied, 3 with no answer in 2 minutes and 4 when the target is outside the project. If Envy isn't running, envy starts it and waits.

Can I change the shortcuts?

Every one of them, in Settings › Shortcuts. Envy refuses combinations that would break typing or clash with another app, and tells you why.

Does anything leave my Mac?

No. There's no account, no sync and no network call. Values live in your login Keychain.

When does it ship? What does it cost?

Not decided yet. That's what the waitlist is for. You'll get one email when it's ready.

Stop hunting for keys.

Join the waitlist and get Envy when it ships.