# dmno-dev/varlock

AI-safe .env files: Schemas for agents, Secrets for humans.

Repository: https://github.com/dmno-dev/varlock
Canonical: https://ross.abutalabs.com/products/varlock
Homepage: https://varlock.dev
Language: TypeScript
License: MIT
License Family: permissive
Topics: configuration, dotenv, env, env-vars, schema, security, validation
Last push: 2026-08-26T21:21:30+00:00

## Health v2 (maintenance only)
Score: 82/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 87, longevity 36
- inputs: {"age_days": 509, "days_push": 7, "days_rel": 8, "gap_med": 0, "n_releases_24m": 378}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4220, forks 112 (observed 2026-08-28T04:08:39.272879+00:00)

## What it is
Varlock is a CLI tool and library for managing environment variables and secrets via a typed .env.schema file, serving as a drop-in dotenv replacement. It gives AI agents schema context without exposing secret values, and adds validation, encryption, leak scanning, and log redaction.

## Use cases
- validate and type-check environment variables in a project
- replace dotenv with a schema-driven env loader
- prevent AI coding agents from reading secret values
- scan repos and code for leaked secrets
- load secrets from 1Password, AWS, Vault, or Infisical into env vars
- manage multi-environment .env files with local overrides
- redact sensitive values from logs at runtime

## When to choose
- you want a single source of truth for env config instead of .env.example
- you use AI coding assistants and worry about secrets leaking to their servers
- you need validation, coercion, and IntelliSense for env vars
- you want encrypted local overrides and secret provider plugins

## When to avoid
- you need a fully managed cloud secrets platform rather than a local-first tool
- your project is locked into plain dotenv with no room for tooling changes
- you require non-JS runtimes without using varlock run or generated modules

## Facets
- artifact type: cli-tool
- maturity: active
- function: configuration-management, secrets-management, security, form-handling, cli, developer-tools
- domain: developer-tools, security, backend, web-development, self-hosted
- platform: cli, cross-platform, windows
- tags: dotenv, env-vars, env-schema, ai-safe-config, secret-management, leak-detection, log-redaction, type-safety, 1password, vault, mcp, devops, nodejs, macos, linux, docker

## Member repositories
- dmno-dev/varlock (main) score 82

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:39.272879+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:22:24.615478+00:00, confidence not recorded.
  - readme: https://github.com/dmno-dev/varlock (fetched 2026-08-28T04:08:39.272879+00:00, sha 1cfd28f86966)
  - homepage: https://varlock.dev (fetched 2026-08-29T09:12:51.419268+00:00, sha b7504b156984)
  - site_page: https://varlock.dev/getting-started/introduction (fetched 2026-08-29T09:12:51.429221+00:00, sha 65019f482296)
  - site_page: https://varlock.dev/getting-started/installation (fetched 2026-08-29T09:12:51.431724+00:00, sha 9a8e7bb820f7)
  - site_page: https://varlock.dev/getting-started/usage (fetched 2026-08-29T09:12:51.433849+00:00, sha db4eaafee48a)
  - site_page: https://varlock.dev/getting-started/migration (fetched 2026-08-29T09:12:51.436094+00:00, sha 3f05f688d38f)
  - site_page: https://varlock.dev/getting-started/wrapping-up (fetched 2026-08-29T09:12:51.437874+00:00, sha ac2829fe16fc)
  - site_page: https://varlock.dev/guides/mcp/docs-mcp (fetched 2026-08-29T09:12:51.440050+00:00, sha 8d02e0f18220)
  - registry_npm: https://registry.npmjs.org/varlock (fetched 2026-08-29T09:12:51.445989+00:00, sha 2eaf7346418b)
  - site_page: https://varlock.dev/integrations/javascript (fetched 2026-08-29T09:12:51.444136+00:00, sha a487327e2b1a)
- Data as of 2026-08-30T08:39:29.467469+00:00.