Does EnvShield send my environment variables over the network?

Never. EnvShield has zero runtime dependencies and makes zero network calls. All secret scanning, Shannon entropy checks, and schema validations happen 100% locally on your machine.

How does EnvShield detect secret leaks?

EnvShield uses precision regex signatures for known token formats (AWS, GitHub, Stripe, OpenAI, Slack, etc.) combined with Shannon entropy analysis to detect high-randomness credential tokens.

Can I use EnvShield with Claude Code, Cursor, or OpenCode?

Yes! EnvShield provides a built-in stdio MCP server (envshield-mcp) that allows any MCP-compatible AI agent to audit environments and validate .env files natively.

FastPress Labs · Apache-2.0 · Zero runtime dependencies

Stop credential leaks before they hit GitHub.

Zero-dependency environment security auditor, secret leak detector, and schema validator. Protects your repository from leaked API keys, unignored .env files, and configuration drift across local, staging, and CI.

Try Live Simulator

Zero runtime dependencies
100% offline & private
Rated A+ 100/100 on LaunchGrade
CLI + MCP server + GitHub Action
Shannon entropy + signature detection

terminal — envshield audit

$ npx envshield audit . --fail-under 80

======================================================
  EnvShield Security Audit · Grade: A+ (100/100)
======================================================
Checks: 4 pass  |  0 warn  |  0 fail

[PASS] .gitignore ignores .env files
[PASS] No unignored sensitive .env files committed
[PASS] .env.example contains no leaked secrets
[PASS] Local .env satisfies all keys in .env.example

Interactive Live Simulator

Test secret leak detection and automatic .env.example generation right in your browser. All processing is 100% client-side.

Input .env Content

Scan Results & Sanitized Output Ready

Click "Scan for Leaks" or "Sanitize" to see EnvShield analysis.

Why Developers and Agents Choose EnvShield

🔒

Secret & Leak Detection

Combines Shannon entropy estimation with signature matching for AWS, GitHub PATs, OpenAI, Anthropic, Stripe, Slack, private keys, and database connection strings.

⚡

Zero Runtime Dependencies

Runs on pure Node.js (>=18.17). Zero external npm packages, zero telemetry, zero background network calls. Never risks leaking your variables.

📋

Parity & Type Checking

Validates that every variable in your template is configured in local development, with support for types like port, boolean, url, and enum.

🤖

AI Agent Ready (MCP)

Includes an stdio Model Context Protocol (MCP) server so AI coding assistants can audit workspace security before writing code or making commits.

🛡️

CI Guardrail Action

Drop the composite GitHub Action into any repository to block pull requests containing leaked credentials or missing .gitignore protection.

🧹

Automated Sanitizer

One command generates a pristine, production-ready .env.example with placeholder values while preserving safe configuration defaults.

MCP Server & GitHub Action Integration

claude_desktop_config.json / opencode.json

{
  "mcpServers": {
    "envshield": {
      "command": "npx",
      "args": ["-p", "github:fastpresspages/envshield", "envshield-mcp"]
    }
  }
}

Exposes audit_env, scan_secrets, validate_env, and generate_example to your agents.

.github/workflows/security.yml

- name: Audit Environment Security
  uses: fastpresspages/envshield@v0.1.0
  with:
    path: .
    fail-under: 80
    example: .env.example

Fails the CI build automatically if secrets leak or .gitignore protection is missing.

Frequently Asked Questions

Does EnvShield send my environment variables anywhere?

No. EnvShield is strictly zero-telemetry and has zero runtime dependencies. Everything runs 100% locally on your machine or inside your GitHub Actions runner.

How is Shannon entropy used in secret scanning?

Real passwords and API keys typically have high information randomness (entropy >= 4.2 bits/character). EnvShield calculates character frequency distributions to catch unformatted high-entropy credentials.

How can I generate a clean .env.example?

Run npx -p github:fastpresspages/envshield envshield generate .env -o .env.example. EnvShield will mask sensitive tokens while keeping comments and safe configuration defaults.

Is EnvShield free and open source?

Yes. 100% free under the Apache-2.0 license. Maintained by FastPress Labs.

Have questions or rule suggestions?

EnvShield is built in the open. If you have feature requests, custom regex pattern suggestions, or security questions, get in touch.

Email: meetcode99@gmail.com · Discussions

About FastPress Labs

EnvShield is built and maintained by FastPress Labs. We engineer high-integrity open-source tools with zero runtime dependencies for developers and autonomous AI agents. Check out our launch ecosystem: LaunchGrade, RepoGrade, and ContextPack.