EnvForge

https://envforge.tech/docs
Admin
EnvForge is an environment variable manager and AI safety tool that prevents secret leaks to AI...
Tokens:38,387
Snippets:257
Trust Score:2.7
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Install EnvForge with Homebrew

Source: https://envforge.tech

Install EnvForge via Homebrew on macOS or Linux. Requires Rust 1.75+ and builds from source.

```bash
brew install emreerinc/tap/envforge
```

--------------------------------

### Install shell completions and view man pages

Source: https://envforge.tech

Install shell completions for zsh or carapace, and access built-in man pages for the full command index or a specific command.

```shell
$ envforge completions zsh --install
```

```shell
$ envforge completions carapace --install
```

```shell
$ envforge man            # full command index
$ envforge man fence      # a specific command
```

--------------------------------

### Guard: envforge ai-hook, scan, and mcp harden

Source: https://envforge.tech

Install AI tool hooks for Claude Code, install a pre-commit hook for scanning, and harden MCP configurations by replacing found credentials with ${VAR} references. The output confirms each installation and the credential replacement.

```bash
# PreToolUse + PostToolUse hooks in the agent
$ envforge ai-hook install claude-code
  hooks installed: PreToolUse + PostToolUse

$ envforge scan --install-hook
  pre-commit hook installed

$ envforge mcp harden
  2 credentials found → replaced with ${VAR}
```

--------------------------------

### Install EnvForge with Cargo

Source: https://envforge.tech

Install EnvForge via Cargo. The binary name is envforge. Default binaries do not include envforge mcp serve; build with --features mcp-server for that.

```bash
cargo install env-forge-tui
```

--------------------------------

### Install EnvForge with mcp-server feature

Source: https://envforge.tech/docs.html?doc=mcp-server

Install or build EnvForge with the mcp-server Cargo feature enabled. Without this feature, the `envforge mcp serve` command is not present; core fence commands remain unaffected.

```bash
cargo install --path . --features mcp-server     # or
cargo build --release --features mcp-server
```

--------------------------------

### Config lifecycle functions

Source: https://envforge.tech/docs.html?doc=api-reference

Functions for managing the configuration file: get the default path, load or create a default config, and save a config to a given path.

```rust
pub fn config_file_path() -> Result<PathBuf, ConfigError>
pub fn load_or_create_default() -> Result<AppConfig, ConfigError>
pub fn save_config(config: &AppConfig, path: &Path) -> Result<(), ConfigError>
```

--------------------------------

### Custom scanner minimal example and configuration

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Creates a simple bash scanner that reads stdin and exits 1 if the content contains 'secret'. Then configures it in EnvForge. This demonstrates the minimal requirements for a custom scanner.

```bash
cat > /usr/local/bin/my-scanner << 'SCRIPT'
#!/bin/bash
CONTENT=$(cat)
if echo "$CONTENT" | grep -qi "secret"; then
    echo "MY-SCANNER: Suspicious content detected"
    exit 1
fi
exit 0
SCRIPT
chmod +x /usr/local/bin/my-scanner
```

```toml
[scanners.my-scanner]
command = "my-scanner"
timeout_ms = 2000
```

--------------------------------

### ggshield expected output when finding

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Example output when ggshield finds a secret. It reports the number of secrets and details of each incident.

```bash
>>> GitGuardian has found 1 secret(s) in the scanned content.

> Incident N. 1
Secret detected: Generic High Entropy Secret
Validity: valid
| @@ -0,0 +1 @@
+ export API_KEY="sk-abc123..."
```

--------------------------------

### Emacs: Configure EnvForge with eglot

Source: https://envforge.tech/docs.html?doc=lsp-clients

Registers EnvForge as an eglot server for dotenv-mode, adds auto-mode-alist for .env files, and ensures eglot starts in dotenv-mode.

```emacs-lisp
(require 'eglot)
(add-to-list 'eglot-server-programs
             '((dotenv-mode) . ("envforge" "lsp")))
(add-to-list 'auto-mode-alist
             '("\\.env\\(\\..*\\)?\\'" . dotenv-mode))
(add-hook 'dotenv-mode-hook 'eglot-ensure)
```

--------------------------------

### GitHub Actions workflow for EnvForge CI gating

Source: https://envforge.tech/docs.html?doc=ci-gating

Workflow that runs on push and pull_request. Installs EnvForge via cargo, then runs 'envforge fence --status' and 'envforge mcp status' as gates; exit 2 fails the job. Pin the EnvForge version for reproducibility.

```yaml
name: envforge-guard
on: [push, pull_request]

jobs:
  ai-secret-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install EnvForge
        run: cargo install --git https://github.com/envforge/envforge   # or pin a release

      - name: Fence coverage gate
        run: envforge fence --status        # exit 2 → fails the job if any detected tool is unfenced

      - name: MCP/agent config credential scan
        run: envforge mcp status            # exit 2 → fails the job on a hardcoded credential
```

--------------------------------

### run_lsp()

Source: https://envforge.tech/docs.html?doc=api-reference

Boots the tokio runtime and serves the language-server backend over stdin/stdout via `tower-lsp`. Single entry point — same call used by `envforge lsp` CLI subcommand.

```APIDOC
## `run_lsp()`

### Description
Boots the tokio runtime and serves the language-server backend over stdin/stdout via `tower-lsp`. Single entry point — same call used by `envforge lsp` CLI subcommand.

### Method
Function call

### Endpoint
`envforge::lsp::run_lsp`

### Parameters
None

### Request Example
```rust
run_lsp();
```

### Response
No return value.
```

--------------------------------

### run_lsp() function signature

Source: https://envforge.tech/docs.html?doc=api-reference

Boots the tokio runtime and serves the language-server backend over stdin/stdout via tower-lsp. Single entry point — same call used by `envforge lsp` CLI subcommand.

```rust
pub fn run_lsp()
```

--------------------------------

### envforge run --volatile --redact and lease management

Source: https://envforge.tech

Runs a command with volatile (never on disk) and redact (masked output) flags, then creates a lease with a 1-hour TTL for specific keys and revokes all leases, showing the kill-switch output.

```bash
$ envforge run --volatile --redact -- npm start
  connecting to [REDACTED:DB_PASSWORD]@host…
  server running on :3000

$ envforge lease create --ttl 1h --keys DB_URL,API_KEY
$ envforge revoke --all
  KILLSWITCH: 3 leases revoked
```

--------------------------------

### ProfilesConfig convenience methods

Source: https://envforge.tech/docs.html?doc=api-reference

Convenience methods for ProfilesConfig to retrieve the active profile entry, the active file path, and the list of profile names.

```rust
impl ProfilesConfig {
    pub fn active_entry(&self) -> Option<&ProfileEntry>
    pub fn active_file(&self) -> Option<String>
    pub fn profile_names(&self) -> Vec<String>
}
```

--------------------------------

### Gitleaks expected output when finding

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Example output when Gitleaks finds a leak. It prints a warning and a JSON array with details about the finding.

```bash
WRN leaks found: 1
[{
  "Description": "AWS Access Key",
  "Match": "AKIAIOSFODNN7EXAMPLE",
  ...
}]
```

--------------------------------

### Lakera Guard wrapper script and configuration

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Creates a bash wrapper that reads content from stdin, sends it to the Lakera Guard API, and exits 1 if flagged. Requires LAKERA_API_KEY environment variable; if not set, exits 0 without blocking. Configure the scanner with the command 'lakera-guard' and a timeout of 3000 ms.

```bash
cat > /usr/local/bin/lakera-guard << 'SCRIPT'
#!/bin/bash
# Lakera Guard API scanner
# Reads content from stdin, sends to Lakera API
# Exit 0 = safe, Exit 1 = flagged

LAKERA_API_KEY="${LAKERA_API_KEY:-}"
if [ -z "$LAKERA_API_KEY" ]; then
    echo "LAKERA_API_KEY not set" >&2
    exit 0  # Don't block if not configured
fi

CONTENT=$(cat)
RESPONSE=$(curl -s -X POST https://api.lakera.ai/v1/prompt_injection \
    -H "Authorization: Bearer $LAKERA_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"input\": $(echo "$CONTENT" | jq -Rs .)}")

FLAGGED=$(echo "$RESPONSE" | jq -r '.results[0].flagged // false')
if [ "$FLAGGED" = "true" ]; then
    echo "LAKERA: Prompt injection detected"
    echo "$RESPONSE" | jq '.'
    exit 1
fi
exit 0
SCRIPT
chmod +x /usr/local/bin/lakera-guard
```

```toml
[scanners.lakera]
command = "lakera-guard"
timeout_ms = 3000
```

--------------------------------

### Parse shell content with parse_shell_content

Source: https://envforge.tech/docs.html?doc=api-reference

Example of parsing shell content from memory using parse_shell_content. The path argument is used only for error context and metadata; no disk I/O is performed.

```rust
use envforge::parser::parse_shell_content;
use std::path::Path;

let sf = parse_shell_content("export FOO=\"bar\"\n", Path::new("/test/.zshrc"))?;
```

--------------------------------

### textDocument/codeLens

Source: https://envforge.tech/docs.html?doc=api-reference

Actionable `Plant canary` + `Activate fence` on sensitive lines.

```APIDOC
## `textDocument/codeLens`

### Description
Actionable `Plant canary` + `Activate fence` on sensitive lines.

### Method
Request

### Endpoint
`textDocument/codeLens`

### Parameters
#### Request Body
- `textDocument` (object) - Required - The document identifier.

### Response
#### Success Response (200)
- `lenses` (array) - Required - List of code lenses.
```

--------------------------------

### Lakera Guard expected output when flagged

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Example output when the Lakera Guard scanner detects a prompt injection. The wrapper prints a message and the JSON response, then exits 1.

```bash
LAKERA: Prompt injection detected
{
  "results": [{"flagged": true, "category": "prompt_injection", ...}]
}
```

--------------------------------

### envforge::parser public API signatures

Source: https://envforge.tech/docs.html?doc=api-reference

Public API signatures for the envforge::parser module. Use these functions to parse shell files or content, detect the current shell, scan for config files, and get the default primary file path.

```rust
// Public API
pub fn parse_shell_file(path: &Path) -> Result<ShellFile, ParseError>
pub fn parse_shell_content(content: &str, path: &Path) -> Result<ShellFile, ParseError>
pub fn detect_shell() -> Result<Shell, ParseError>
pub fn scan_config_files(shell: &Shell) -> Result<Vec<PathBuf>, ParseError>
pub fn default_primary_file(shell: &Shell) -> Result<PathBuf, ParseError>
```

--------------------------------

### Backup functions

Source: https://envforge.tech/docs.html?doc=api-reference

Backup management functions. create_backup copies the file to ~/.config/envforge/backups/{filename}.{timestamp}.bak. prune_old_backups retains only the most recent 'keep' backups.

```rust
pub fn create_backup(file_path: &Path) -> Result<PathBuf, ConfigError>
pub fn list_backups(file_path: &Path) -> Result<Vec<PathBuf>, ConfigError>
pub fn restore_backup(backup_path: &Path, target_path: &Path) -> Result<(), ConfigError>
pub fn prune_old_backups(file_path: &Path, keep: usize) -> Result<(), ConfigError>
```

--------------------------------

### Fence: envforge fence and schema emit-ai

Source: https://envforge.tech

Run the fence command to create ignore files and rules for configured AI tools, then emit an AI context schema with variable names and types but no values. The output shows the created files and the schema file with a count of variables.

```bash
# write ignore/rules for configured AI tools
$ envforge fence
  created .envforgeignore · .cursorignore · .claude/settings.json

# give the agent context — names & types, no values
$ envforge schema emit-ai --infer --output .env.ai.md
  wrote .env.ai.md (42 variables, 0 values)
```

--------------------------------

### EnvForge scanner management commands

Source: https://envforge.tech/docs.html?doc=scanner-recipes

CLI commands to list, test, run, enable, and disable scanners. Use these to manage scanners from the command line.

```bash
envforge scanner list                 # Show all scanners
envforge scanner test <name>          # Test with sample content
envforge scanner run <name> <content> # Run against arbitrary content
envforge scanner enable <name>        # Enable scanner
envforge scanner disable <name>       # Disable scanner
```

--------------------------------

### Neovim: Register EnvForge as custom LSP server

Source: https://envforge.tech/docs.html?doc=lsp-clients

Register EnvForge as a custom LSP server in Neovim using nvim-lspconfig 0.1.7+. Place in ~/.config/nvim/lua/lsp/envforge.lua. Sets filetypes for dotenv, shell, TypeScript, JavaScript, Python, Rust, Go, Java, Kotlin, and root patterns for .env.schema.toml, .env.schema, .env, .git.

```lua
-- ~/.config/nvim/lua/lsp/envforge.lua
local lspconfig = require('lspconfig')
local configs = require('lspconfig.configs')

if not configs.envforge then
  configs.envforge = {
    default_config = {
      cmd = { 'envforge', 'lsp' },
      filetypes = { 'dotenv', 'sh', 'typescript', 'javascript',
                    'python', 'rust', 'go', 'java', 'kotlin' },
      root_dir = lspconfig.util.root_pattern(
        '.env.schema.toml', '.env.schema', '.env', '.git'
      ),
      settings = {},
    },
  }
end
lspconfig.envforge.setup({})
```

--------------------------------

### EnvForge scanner configuration format

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Defines the TOML structure for configuring a scanner under the [scanners] section. The command is the binary or script to run, args are optional arguments, timeout_ms defaults to 5000, and enabled defaults to true.

```toml
[scanners.<name>]
command = "<binary-or-script>"
args = ["<arg1>", "<arg2>"]
timeout_ms = 5000   # optional, default 5000
enabled = true      # optional, default true
```

--------------------------------

### Gitleaks stdin wrapper script and configuration

Source: https://envforge.tech/docs.html?doc=scanner-recipes

Creates a wrapper script that writes stdin to a temporary file and runs Gitleaks on it, preserving exit code. Then configures the scanner to use the wrapper. This is needed for stable stdin behavior.

```bash
cat > /usr/local/bin/gitleaks-stdin << 'SCRIPT'
#!/bin/bash
# Gitleaks stdin wrapper
tmp=$(mktemp)
cat > "$tmp"
gitleaks detect --no-git --source="$tmp" --verbose 2>&1
EXIT=$?
rm -f "$tmp"
exit $EXIT
SCRIPT
chmod +x /usr/local/bin/gitleaks-stdin
```

```toml
[scanners.gitleaks]
command = "gitleaks-stdin"
timeout_ms = 5000
```

--------------------------------

### textDocument/definition

Source: https://envforge.tech/docs.html?doc=api-reference

Go-to-definition: `.env` key → schema + the key's definitions across every recognized env file.

```APIDOC
## `textDocument/definition`

### Description
Go-to-definition: `.env` key → schema + the key's definitions across every recognized env file. (Source-language identifier → schema still implemented server-side; not attached by first-party clients.)

### Method
Request

### Endpoint
`textDocument/definition`

### Parameters
#### Request Body
- `textDocument` (object) - Required - The document identifier.
- `position` (object) - Required - The position.

### Response
#### Success Response (200)
- `uri` (string) - Required - The target document URI.
- `range` (object) - Required - The target range.
```

--------------------------------

### AppConfig struct definition

Source: https://envforge.tech/docs.html?doc=api-reference

The main configuration struct, serializable to ~/.config/envforge/config.toml. Contains all sub-configurations for general, files, offsets, protected blocks, groups, profiles, validation, clipboard, lifecycle, and analytics.

```rust
pub struct AppConfig {
    pub general: GeneralConfig,
    pub files: FilesConfig,
    pub offsets: OffsetsConfig,
    pub protected_blocks: ProtectedBlocksConfig,
    pub groups: HashMap<String, Vec<String>>,
    pub profiles: ProfilesConfig,
    pub validation: HashMap<String, String>,
    pub clipboard: ClipboardConfig,
    pub lifecycle: LifecycleConfig,
    pub analytics: AnalyticsConfig,
}
```

--------------------------------

### Sublime Text: LSP package settings for EnvForge

Source: https://envforge.tech/docs.html?doc=lsp-clients

Adds EnvForge client configuration to Sublime Text's LSP package settings. Enables the client, sets command to ['envforge', 'lsp'], and selector for source.env and source.dotenv.

```json
{
  "clients": {
    "envforge": {
      "enabled": true,
      "command": ["envforge", "lsp"],
      "selector": "source.env, source.dotenv"
    }
  }
}
```

--------------------------------

### textDocument/inlayHint

Source: https://envforge.tech/docs.html?doc=api-reference

Inlay hints: `(default)`, `→ `, `()` for unset keys.

```APIDOC
## `textDocument/inlayHint`

### Description
Inlay hints: `(default)`, `→ `, `()` for unset keys.

### Method
Request

### Endpoint
`textDocument/inlayHint`

### Parameters
#### Request Body
- `textDocument` (object) - Required - The document identifier.
- `range` (object) - Required - The range.

### Response
#### Success Response (200)
- `hints` (array) - Required - List of inlay hints.
```

--------------------------------

### workspace/symbol

Source: https://envforge.tech/docs.html?doc=api-reference

Project-wide env var search.

```APIDOC
## `workspace/symbol`

### Description
Project-wide env var search.

### Method
Request

### Endpoint
`workspace/symbol`

### Parameters
#### Request Body
- `query` (string) - Required - The search query.

### Response
#### Success Response (200)
- `symbols` (array) - Required - List of workspace symbols.
```

--------------------------------

### Kakoune kak-lsp configuration

Source: https://envforge.tech/docs.html?doc=lsp-clients

Configures kak-lsp for Kakoune to use EnvForge as the language server for dotenv files.

```toml
# ~/.config/kak-lsp/kak-lsp.toml
[language.dotenv]
filetypes = ["dotenv"]
roots = [".env.schema.toml", ".env.schema", ".git"]
command = "envforge"
args = ["lsp"]

```

--------------------------------

### Zed extension.rs registration

Source: https://envforge.tech/docs.html?doc=lsp-clients

Registers the EnvForge language server in Zed's extension.rs, specifying the command and arguments.

```rust
zed::register_language_server(zed::LanguageServerConfig {
    command: "envforge".into(),
    args: vec!["lsp".into()],
    ..Default::default()
});

```

--------------------------------

### Helix: Configure EnvForge LSP in languages.toml

Source: https://envforge.tech/docs.html?doc=lsp-clients

Adds a 'dotenv' language definition and EnvForge language server to Helix's languages.toml. Sets file globs for .env, .env.*, *.env, roots, and server command.

```toml
# ~/.config/helix/languages.toml
[[language]]
name = "dotenv"
scope = "source.dotenv"
file-types = [{ glob = ".env" }, { glob = ".env.*" }, { glob = "*.env" }]
roots = [".env.schema.toml", ".env.schema", ".git"]
language-servers = ["envforge"]

[language-server.envforge]
command = "envforge"
args = ["lsp"]
```

--------------------------------

### Parse shell file and list env vars

Source: https://envforge.tech/docs.html?doc=api-reference

Parses a shell configuration file and prints each environment variable's key and value. Requires the envforge crate and a valid shell file path.

```rust
use envforge::parser::parse_shell_file;
use envforge::model::LineNode;
use std::path::Path;

fn list_env_vars(shell_config: &Path) -> Result<(), Box<dyn std::error::Error>> {
    let sf = parse_shell_file(shell_config)?;

    for node in &sf.lines {
        if let LineNode::EnvExport { key, value, .. } = node {
            println!("{} = {}", key, value);
        }
    }

    Ok(())
}
```

--------------------------------

### Neovim: Filetype detection for .env* files

Source: https://envforge.tech/docs.html?doc=lsp-clients

Autocmd to set filetype to 'dotenv' for .env files and patterns. Use in Neovim configuration.

```vim
autocmd BufRead,BufNewFile .env,.env.*,*.env set filetype=dotenv
```

--------------------------------

### envforge canary create, audit --ai-leaks, and deps

Source: https://envforge.tech

Creates a canary honeypot credential, audits git history for AI-assisted leaks, and lists services depending on a secret.

```bash
# honeypot credential — tripwire when the fake value is read or used
$ envforge canary create STRIPE_KEY
  canary planted · monitoring enabled

$ envforge audit --ai-leaks
  scanned 1,204 commits · 0 AI-assisted leaks

$ envforge deps DB_URL
  3 services depend on this secret
```

--------------------------------

### Lapce custom LSP configuration

Source: https://envforge.tech/docs.html?doc=lsp-clients

Configures Lapce to use EnvForge as a custom LSP server for env and dotenv file types.

```toml
[server]
binary = "envforge"
args = ["lsp"]
file-types = ["env", "dotenv"]

```

--------------------------------

### AppConfig

Source: https://envforge.tech/docs.html?doc=api-reference

Configuration structure for the envforge application, including sub-configurations and convenience methods.

```APIDOC
## [CONFIG] AppConfig

### Description
Represents the full application configuration, serializable to `~/.config/envforge/config.toml`. Contains sub-configurations for general settings, files, offsets, protected blocks, groups, profiles, validation, clipboard, lifecycle, and analytics.

### Fields
- `general` (GeneralConfig) - General configuration.
- `files` (FilesConfig) - File paths and reference file settings.
- `offsets` (OffsetsConfig) - Protected line offsets.
- `protected_blocks` (ProtectedBlocksConfig) - Protected block markers.
- `groups` (HashMap<String, Vec<String>>) - Group definitions.
- `profiles` (ProfilesConfig) - Profile settings.
- `validation` (HashMap<String, String>) - Validation rules.
- `clipboard` (ClipboardConfig) - Clipboard behavior.
- `lifecycle` (LifecycleConfig) - Lifecycle settings.
- `analytics` (AnalyticsConfig) - Analytics settings.

### Sub-types
- `GeneralConfig` - `default_shell: String` (default `"zsh"`)
- `FilesConfig` - `primary`, `reference: String`, `use_reference_file: bool` (defaults `~/.zshrc`, `~/.env_managed`, `true`)
- `OffsetsConfig` - `header_protected_lines: usize`, `footer_protected_lines: usize` (defaults `0`, `0`)
- `ProtectedBlocksConfig` - `markers: Vec` (default `[]`)
- `ClipboardConfig` - `enabled: bool`, `warn_on_secret: bool` (defaults `true`, `true`)
- `LifecycleConfig` - `default_stale_threshold_days`, `default_grace_period_days`, `default_rotation_strategy`, `snapshot_retention_days` (defaults `90`, `7`, `"replace"`, `30`)
- `ProfilesConfig` - `active: String`, `shared_file: String`, `entries: HashMap` (defaults `"default"`, `~/.env_managed.shared`)

### Convenience Methods (ProfilesConfig)
- `active_entry(&self) -> Option<&ProfileEntry>`
- `active_file(&self) -> Option<String>`
- `profile_names(&self) -> Vec<String>`
```
Tokens:
Raw