Secrets management for the agentic era

Not on the documented flow. In assisted mode the CLI never prints a secret value, refuses one on the command line, and masks secrets in the output of the commands it runs. Launched agent-safe, the agent holds placeholders only. Assisted mode protects against accidents: your agent runs as you, so your approvals are what stop deliberate misuse.

It stops and hands you a command for your own terminal, such as varlatch values set STRIPE_KEY -e production, which asks for the value without showing it. A value Varlatch can create, like a session key, the agent can generate with --generate after you approve; nobody sees it.

varlatch init gives your agent the Varlatch skill, in the open Agent Skills format, and a block in AGENTS.md: plain text with shell commands and no agent-specific tools. Optional guardrails add hooks for Claude Code and Codex, as a second line against accidents. The CLI recognises Claude Code, Codex, Cursor, Copilot, Gemini CLI, and OpenCode sessions and turns assisted mode on by itself. In a dated baseline evaluation (October 2026, Varlatch 0.14.3), the command-line coding agents Claude Code 2.1.278 with Claude Sonnet 5.5 and Codex CLI 0.160.1 passed all 40 cases, 20 each, with no hooks, against a local test server (what was evaluated). Other coding agents, other versions, and editor or cloud interfaces have not been evaluated.

Yes. Everything your agent does is a plain varlatch command or a click in the dashboard. The agent only saves you the typing.

Nobody, until you grant it. Access is default-deny for people and machines alike: you grant each one exactly the environments and actions it needs, directly or through custom roles, groups, and teams. Using a secret and revealing it are separate permissions, so a machine can run with a key it is not allowed to show. A Tailnet Requirement can also limit an environment to machines you choose on your Tailscale network, checked by Tailscale identity rather than by IP address.

Yes, as the project's Contract: a .env.schema file in your repository that says which items your app needs, of what type, whether each is required and in which environments, and which are secret. Items are secrets unless marked @public. Change it in a pull request, then push it with varlatch contract push and activate the new revision. varlatch types generates TypeScript or Python from the Contract, and varlatch validate fails CI when an environment is missing a required value or holds an invalid one. You can also edit the Contract in the dashboard instead. The .env.schema format comes from @env-spec, which DMNO created for Varlock; Varlatch reads a subset of it with its own parser.

Only for an MCP host that gives its model no shell. A coding agent with a shell uses the CLI directly, in assisted mode. varlatch mcp ships inside the CLI for the others.

Varlatch's own code is. The server and dashboard are AGPL-3.0, and the CLI and SDKs are Apache-2.0 (license). By default Varlatch runs on the Convex backend, which is source-available, not open source: its license, FSL-1.1-Apache-2.0, permits internal use, which includes running Varlatch for your own organization, and each version becomes Apache-2.0 two years after its release.

You can check. The code is public, and so is the threat model: what Varlatch guarantees, what it assumes, and what it does not protect against. Releases after 0.15.0 are signed by the release workflow, keyless through Sigstore, and each image carries build provenance and an SBOM: verify a release with cosign before you install it. Report a vulnerability privately, through GitHub or security@varlatch.com, as the security policy describes.