TinyVault guides

TinyVault stores secret values locally and makes them available through a CLI, a terminal studio, and an MCP server. Start with the quickstart, then follow the workflow that matches what you are trying to do.

Start here

Goal	Guide
Decide whether TinyVault fits your use case	What is TinyVault?
Create a vault and run an app with one secret	Getting started
Understand projects, keys, and the encryption hierarchy	Core concepts
Evaluate the trust boundaries	Security and threat model

Everyday workflows

• Secrets — create, inspect, update, and delete keys.
• Run and env — inject secrets into a child process or render environment output.
• Projects — isolate secrets by application or scope.
• Environment groups — model development, staging, and production inheritance.
• Dotenv workflows — import, export, diff, sync, and interpolate .env files.
• Versioning and rollback — inspect history and restore a prior value.

Share and deploy

• Sharing — create identities and grant recipient access to a project.
• Committable secrets — choose a recipient-encrypted file format.
• Git filter — encrypt on commit and decrypt on checkout.
• CI/CD — use recipient identities in automation.
• Kubernetes SealedSecret workflow — seal and render Kubernetes secrets.

Choose an interface

• Studio — browse the vault in a terminal UI.
• Local agent — keep the vault available between CLI commands on Unix.
• MCP server — connect an AI agent through a disk-controlled policy.
• AI agent workflow — find and use keys while minimizing plaintext in model context.

Operate TinyVault

• Key management — back up, restore, and rotate key material.
• Configuration — configure the vault and studio.
• Environment variables — non-interactive and CI inputs.
• Troubleshooting — diagnose common failures.
• CLI reference — look up commands and flags.

Integrations

The integration guides build on the core workflows:

• Pulumi
• DigitalOcean
• Codemap