Docs — NoEnv

01

Install

Windows

The installer

No account. No telemetry. The vault stays on this machine.

Installer temporarily unavailable.

From source

Clone and build

git clone https://github.com/0xm0w/noenv
cd noenv
npm ci
npx tsc -p tsconfig.json --outDir dist

Local model

Your own endpoint, if you want one

The default warden is Muse Spark via the Meta API; nothing to download. To keep request metadata on your hardware, point Settings at an Ollama or OpenAI-compatible server you run. We recommend a Meta open model such as Muse Glimmer.

Get Ollama

02

Set up locally, then connect your IDE

Local-hardening candidate, not a new release: deliberate uninstall warns then wipes the fixed app profile; Cancel preserves it and in-place updates retain it. Shared legacy keys or linked profiles block cleanup. Back up the matching stopped DB and key together. Windows Hello screen lock is not passkey-backed encryption; PRF custody and remote Connections are not included in this candidate.

1 · init

Create the vault

AES-256-GCM. The installed Windows app has a password setup/unlock screen. The master key is password-wrapped (scrypt by default) and later daemon starts are locked. Run noenv unlock; it auto-locks after 15 idle minutes.

2 · Settings

Optional warden

Add a Meta API key for Muse Spark, or set your own local endpoint. Skip this and policy still holds the ceiling; anything that needs judgement comes to you.

3 · add

Store a secret once

noenv add stripe --scope charges.read reads a hidden prompt. The agent learns the alias and the ceiling.

03 · MCP

One snippet per IDE

Installed Windows candidate: use Settings > Daemon > Agent Integration & MCP to generate/rotate a private token and copy the installed-runtime config. No separate Node or source checkout is needed. Raw tokens are shown once; rotate after losing the config. The examples below are source-development examples only: replace <noenv> with your checkout. Full host notes live in docs/MCP.md.

{
  "mcpServers": {
    "noenv": {
      "command": "node",
      "args": ["<noenv>/dist/packages/mcp/src/server.js"],
      "env": {
        "NOENV_AGENT_ID": "cursor",
        "NOENV_AGENT_TOKEN": "<generated-private-agent-token>",
        "NOENV_IDE": "Cursor"
      }
    }
  }
}

request_capability list_aliases request_enrollment enrollment_status revoke

Five tools. There is no approve tool. An agent that calls the approve route itself gets 401.

04

What you see in the app

Real screenshots. The credential in them is a test value.

Add credential modal, prefilled alias and scope, secret field empty — The agent asks to enroll. You type the secret. The field does not come back.

05 · Warden

A stronger model means stronger security.

The policy floor holds whatever the model does: ceilings, expiry and your approval still apply with the warden off, down, or wrong.

Tier 0

Policy only

Rules and ceilings. No model.

Tier 1 · default

Muse Spark · Meta API

Metadata only. The key stays in the daemon.

Tier 2 · bring your own

Your local endpoint

Ollama or OpenAI-compatible, on hardware you run. Muse Glimmer recommended. Metadata goes only to your URL.

Tier 3 · opt-in

BFT quorum

Spark + your endpoint. The stricter verdict wins.

Effort: Fast, Standard or Deep. Deep runs two passes; if they disagree, the narrower scope and higher risk win and you approve. Why the floor holds: architecture.

06

Every grant dies

After use

One call

The grant expires when that call returns.

After TTL

60 seconds

A pending approval that you ignore is gone.

On revoke

One click

App, CLI, or the MCP revoke tool. Pending and future grants for that agent stop.

07

The log shows the decision, not the key

Always logged

Who asked, which IDE, the scope, the warden line, your decision, execution, expiry, revocation.

Never logged

No key, fragment, or hash. Same ban on MCP responses and the settings screen. The check is the 27-surface canary.

08 · Policy floor

The ceiling is the law

Ceiling

A write never runs

stripe → charges.read means a write never runs, even if a model recommends it.

Standing

Always-allow is narrow

Always-allow is only for a low, read-only repeat.

Memory

Clears on restart

Those standing approvals live in memory and clear on restart.

Apache-2.0. Windows is the supported platform today. macOS packaging is parked.