A cross-platform CLI that encrypts your secrets locally with AES-256-GCM, organises them into namespaced realms, and injects them into commands, shells, or .env.maige config files. No cloud. No third-party service. Just your passphrase and your machine.
The problem
AI coding agents read your filesystem. They index your .env files, your shell history, your config directories. Plaintext secrets sitting on disk are a liability — not just from breaches, but from the tools you've invited in. Traditional secret managers solve the cloud problem but ignore the local one: your dev machine is the new attack surface.
How it works
Maige encrypts every secret at rest using AES-256-GCM authenticated encryption, with keys derived from your passphrase via Argon2id (memory-hard, resistant to GPU/ASIC attacks). Secrets are grouped into realms — namespaced collections you can inject into any command or shell session. Nothing is ever stored in plaintext.
AES-256
GCM
Argon2id
KDF
Zero
Plaintext
Local
Only
Core features
Realm-based organisation
Group secrets by environment — dev, staging, prod. Inject one or multiple realms into any command.
Command injection
maige run --realm dev -- node server.js — secrets are injected as env vars, never written to disk.
.env.maige config files
Mix plaintext values with encrypted references: OPENAI_KEY=maige("var:/prod/OPENAI_KEY"). Resolves at runtime.
Import and export
Import from existing .env files. Export to .env or JSON when needed.
Key rotation
maige key:rotate re-encrypts all realms with a new passphrase in one step.
CI/CD ready
Non-interactive mode via --passphrase flag or MAIGE_PASSPHRASE env var for automation pipelines.
Security model
- → AES-256-GCM authenticated encryption — tamper detection built in
- → Argon2id key derivation — memory-hard, resistant to GPU/ASIC brute-force
- → Memory zeroisation via the
zeroizecrate — secrets are wiped from RAM after use - → No plaintext secrets on disk — ever
- → Passphrase verification tokens prevent silent corruption
- → Automatic
.gitignorein storage directory
Quick start
# Install
cargo install --git https://github.com/ikcore/maige
# Initialise
maige init
# Create a realm and add a secret
maige realm:create dev
maige var:set dev API_KEY
# Run a command with secrets injected
maige run --realm dev -- node server.js
Design philosophy: Your secrets belong on your machine, encrypted, under your control. Maige doesn't phone home, doesn't require an account, and doesn't store anything in plaintext. If an AI agent reads your project directory, all it finds are ciphertext and config pointers — nothing it can use.