TinyVault guides
TinyVault stores secret values locally and makes them available through a CLI and an MCP server. Start with the quickstart, then follow the workflow that matches what you are trying to do.
Start here
| Goal | Guide |
|---|---|
| Decide whether TinyVault fits your use case | What is TinyVault? |
| Create a vault and run an app with one secret | Getting started |
| Understand projects, keys, and the encryption hierarchy | Core concepts |
| Evaluate the trust boundaries | Security and threat model |
Everyday workflows
- Secrets — create, inspect, update, and delete keys.
- Run and env — inject secrets into a child process or render environment output.
- Projects — isolate secrets by application or scope.
- Environment groups — model development, staging, and production inheritance.
- Dotenv workflows — import, export, diff, sync, and interpolate
.envfiles. - Versioning and rollback — inspect history and restore a prior value.
Share and deploy
- Sharing — create identities and grant recipient access to a project.
- Committable secrets — choose a recipient-encrypted file format.
- Git filter — encrypt on commit and decrypt on checkout.
- CI/CD — use recipient identities in automation.
- Kubernetes SealedSecret workflow — seal and render Kubernetes secrets.
Choose an interface
- Desktop app — an Electron GUI over
tvault mcp, built from source. - Local agent — keep the vault available between CLI commands on Unix.
- MCP server — connect an AI agent through a disk-controlled policy.
- AI agent workflow — find and use keys while minimizing plaintext in model context.
Operate TinyVault
- Backups & recovery — scheduled rotated snapshots, safety snapshots before destructive commands, and restore.
- Key management — back up, restore, and rotate key material.
- Configuration — configure the vault and agent.
- Environment variables — non-interactive and CI inputs.
- Troubleshooting — diagnose common failures.
- CLI reference — look up commands and flags.
Integrations
The integration guides build on the core workflows: