RunEnv is an environment-variable and secret-management platform that injects authorized values into a process at runtime and lets AI agents take approved actions without receiving standing credentials. Teams use it to replace ad-hoc .env sharing with a project and environment workspace that has access control and history.

Does runenv run write a .env file?

No. For the `runenv run` path, authorized values are injected into the child process environment and are not written to `.env`, `.env.local`, logs, or `.runenv.json`. Download, offline-cache, secret-file, and `*_FILE` workflows intentionally use different storage boundaries and can write to disk.

Can AI agents read secret values from RunEnv?

Not through Agent Guard. Agent Guard exposes approved, auditable actions rather than general secret-read access. Coding agents should use Agent Guard or a scoped MCP workflow. Do not place secret values, service tokens, or RunEnv tokens in prompts.

How is RunEnv different from a .env file?

A local .env file does not show who changed a value, which environment it belongs to, or whether a teammate is working from an outdated copy. RunEnv keeps configuration in a project and environment model with scoped access, version history, and runtime delivery for the supported `runenv run` path.

Is there a free RunEnv plan?

Yes. Personal workspaces are free. Organization plans (Pro Org, Business Org, and Enterprise) add team capacity, longer audit history, and additional operating limits. See the pricing page for the current limits.

Can RunEnv be self-hosted?

Yes. RunEnv documents a self-hosting bootstrap and operational readiness path. Review the self-hosting guide for domain, TLS, and Agent OAuth requirements before using Agent Guard in a self-hosted deployment.

What clients does RunEnv provide?

RunEnv provides a web dashboard, a CLI (`runenv-cli`), Node.js and Python SDKs, a VS Code extension, a Desktop app, GitHub Actions integration, and an MCP/Agent Guard surface for coding agents.

Agent Guard is the RunEnv workflow for coding agents. It lets an agent preview, request, execute, and roll back approved actions without receiving general secret-read access or connector credentials. The recommended model is to give agents actions, not secrets.

How does RunEnv compare with Doppler, Infisical, Vault, or AWS Secrets Manager?

RunEnv is a team environment-variable workspace with runtime injection and Agent Guard. It is not a drop-in replica of Doppler, Infisical, HashiCorp Vault, or AWS Secrets Manager, and it does not migrate live workspaces from those products. Read the comparison pages for what RunEnv does today, and confirm current competitor capabilities on those products’ own sites.

Environment variable management for teamswith runtime secret injection.

RunEnv is an environment-variable and secret-management platform for teams. Inject authorized secrets at runtime instead of passing .env files around, and let coding agents take approved actions without standing credentials.

Start for Free ExploreRunEnv docs

RunEnv solutions

Environment variable management that maps to the work.

Explore the workflows teams use when shared .env files stop being enough: team management, version control, rollback, runtime injection, and Agent Guard for coding agents.

Manage shared environment variables

A practical workspace for teams that have outgrown copying .env files between laptops, chat threads, and deployment systems.

Read the guide

Version and roll back environment changes

Keep configuration changes reviewable and recovery close when a deployment depends on the right environment variables.

Read the guide

Inject secrets at runtime

Deliver the configuration a process needs at execution time while keeping the no-file boundary explicit for the runtime-injection workflow.

Read the guide

Give agents actions, not secrets

Connect Codex, Claude, Copilot, or Cursor through Agent Guard so a coding agent can preview and execute approved work without holding standing credentials.

Read the guide

Compare and how-to

Direct answers for the questions people ask engines.

Comparison pages state what RunEnv does today. How-to pages walk the supported CLI, CI, and Agent Guard paths, including the disk and credential limits.

Compare

RunEnv vs Doppler RunEnv vs Infisical RunEnv vs HashiCorp Vault RunEnv vs AWS Secrets Manager

How to

How to replace shared .env files How to inject secrets without a .env file How to give coding agents access without pasting tokens How to rotate a production secret with approval How to compare staging and production env vars How to use RunEnv in GitHub Actions

The RunEnv operating model

Context becomes controlled runtime delivery.

RunEnv gives platform teams one deliberate path from repository context to an environment-aware process, without separating developer speed from the controls around it.

Repository context

Start from the work already in front of you.

Quickstart uses the local command as the beginning of a project and environment path.

npm run dev

Repositorymy-api

Environmentdevelopment

Change reviewselected diff

Policy gateapproval if required

Runtime deliverychild process

Recorded outcomesnapshot + audit

01 / Bootstrap once

A CLI that understands the repository before it runs it.

Quickstart detects a local command, links the project and environment, and hands back the next command without turning the demo into a real shell session.

Read the CLI guide

Interactive CLI demo

$runenv quickstart

Quickstart is selected. Press Run demo to see it in action, or choose another flow above.

Simulated in your browser. No command is executed.

Compare the shape of two environments before you move anything.

An interactive reproduction of the RunEnv dashboard’s environment diff workflow using masked, fictional values only.

Environment Compare & Sync

Compare secret differences between two environments and copy values.

Source Environment

Target Environment

Show only items with differences

Showing 13 of 13

Secret Key	test	production
API_KEYChanges	`••••••••`	`••••••••`
AWS_REGIONChanges	`••••••••`	`••••••••`
DATABASE_URLChanges	`••••••••`	`••••••••`
JWT_SECRETChanges	`••••••••`	`••••••••`
NODE_ENVChanges	`••••••••`	`••••••••`
PORTChanges	`••••••••`	`••••••••`
QA_TEST_SECRETNew	`••••••••`	(none)
REDIS_URLChanges	`••••••••`	`••••••••`
S3_BUCKETChanges	`••••••••`	`••••••••`
SMTP_HOSTChanges	`••••••••`	`••••••••`
SMTP_PASSWORDChanges	`••••••••`	`••••••••`
SMTP_PORTChanges	`••••••••`	`••••••••`
SMTP_USERChanges	`••••••••`	`••••••••`

Source

Target (Overwrite)

03 / Promote with intent

Make production changes a reviewable handoff.

RunEnv supports environment promotion with snapshots and approval rules so a developer’s change can move quickly without losing the control point.

Environment promotion

Move selected changes through a controlled environment path.

SourceTarget

+ 2 new↻ 3 changed= 8 unchanged

Selected changes	Policy
`PAYMENTS_API_URL`Changed	approved scope
`FEATURE_BILLING_V2`New	approved scope
`SENTRY_TRACES_SAMPLE_RATE`Changed	approved scope

Policy check: a snapshot is captured before the simulated promotion request.

Snapshot captured before applyProduction approval required

04 / Bound every agent

Issue a narrow access pack instead of a reusable credential.

Agent Access Packs are scope- and TTL-bound. Agent Guard adds policy, approval, and tamper-evident receipts around the action itself.

Explore agent integrations

Create Access Pack

Project

Runtime delivery pack

Limits one agent to selected keys, one environment, and a short-lived session.

Default TTLMax TTL

Require human approval for every request

EnvironmentRead Secret Lifecycle metadataValue-free lifecycle findings and runs only. It never grants secret values or direct mutation.

Exact Secret Keys2 selected

STRIPE_WEBHOOK_SECRETRuntime delivery for webhook validationPAYMENTS_API_URLService endpoint used by the workerSENTRY_DSNObservability runtime configurationFEATURE_BILLING_V2Feature rollout flag

Policy summary. Allow 2 exact keys for payments-api/development; expires after 60 minutes and requires approval.

05 / Keep recovery close

Every change has a version you can inspect and restore.

Environment snapshots and audit history let teams understand the delta first, then take a deliberate rollback action when it is needed.

Snapshot History

development

1 removed1 changed

- SENTRY_DSN=••••••••

~ PAYMENTS_API_URL: •••••••• → ••••••••

Restoring creates a new version and preserves this snapshot in the audit history.

The operational surface

One workspace for environments, controls, and the people who own them.

Secret inventory, environment context, audit controls, members, and access settings meet in the operational surface teams use every day.

RunEnv dashboard showing a project’s environments and masked secret inventory

Authentic product interface. Secret values in the screenshot are masked.

Start with the repository you have.

Create an account, connect a project, and use Quickstart to choose the next safe command for your local workflow.

Create a free account Read the docs

FAQ

Questions people ask about RunEnv.

Direct answers for search and answer engines, including the disk and agent-access limits.

What is RunEnv?: RunEnv is an environment-variable and secret-management platform that injects authorized values into a process at runtime and lets AI agents take approved actions without receiving standing credentials. Teams use it to replace ad-hoc .env sharing with a project and environment workspace that has access control and history.
Does runenv run write a .env file?: No. For the `runenv run` path, authorized values are injected into the child process environment and are not written to `.env`, `.env.local`, logs, or `.runenv.json`. Download, offline-cache, secret-file, and `*_FILE` workflows intentionally use different storage boundaries and can write to disk.
Can AI agents read secret values from RunEnv?: Not through Agent Guard. Agent Guard exposes approved, auditable actions rather than general secret-read access. Coding agents should use Agent Guard or a scoped MCP workflow. Do not place secret values, service tokens, or RunEnv tokens in prompts.
How is RunEnv different from a .env file?: A local .env file does not show who changed a value, which environment it belongs to, or whether a teammate is working from an outdated copy. RunEnv keeps configuration in a project and environment model with scoped access, version history, and runtime delivery for the supported `runenv run` path.
Is there a free RunEnv plan?: Yes. Personal workspaces are free. Organization plans (Pro Org, Business Org, and Enterprise) add team capacity, longer audit history, and additional operating limits. See the pricing page for the current limits.
Can RunEnv be self-hosted?: Yes. RunEnv documents a self-hosting bootstrap and operational readiness path. Review the self-hosting guide for domain, TLS, and Agent OAuth requirements before using Agent Guard in a self-hosted deployment.
What clients does RunEnv provide?: RunEnv provides a web dashboard, a CLI (`runenv-cli`), Node.js and Python SDKs, a VS Code extension, a Desktop app, GitHub Actions integration, and an MCP/Agent Guard surface for coding agents.
What is Agent Guard?: Agent Guard is the RunEnv workflow for coding agents. It lets an agent preview, request, execute, and roll back approved actions without receiving general secret-read access or connector credentials. The recommended model is to give agents actions, not secrets.
How does RunEnv compare with Doppler, Infisical, Vault, or AWS Secrets Manager?: RunEnv is a team environment-variable workspace with runtime injection and Agent Guard. It is not a drop-in replica of Doppler, Infisical, HashiCorp Vault, or AWS Secrets Manager, and it does not migrate live workspaces from those products. Read the comparison pages for what RunEnv does today, and confirm current competitor capabilities on those products’ own sites.

Read the full FAQ