Overview

.monkeys is a .env you can commit. Keys stay in the file, secrets stay in each person's vault, and monkeys run hands them to the command that needs them. Even that command cannot print one.

Why it exists

Two reasons, and either would have been enough.

1. LLMs read .env. cat .env is just too tempting, and once it's in the transcript, it's there for good. monkeys takes that path away. The secret goes from the vault straight into the process, a missing one comes back as a message saying what to ask for, and whatever the command prints comes back redacted.

2. .env was never good, even for people. Sharing it means pasting the whole file into a chat. Test and production mean two more files and a loader. Staying out of git means an .env.example that drifts. monkeys folds all of it into one committed file, and pack shares the whole thing or the part a teammate needs.

What it is

The same project, kept both ways. With .env, three files have to stay in step, and the one with the secrets is the one you must not commit:

OPENROUTER_API_KEY=sk-or...
STRIPE_SECRET_KEY=sk_li...

OPENROUTER_API_KEY=
STRIPE_SECRET_KEY=

.env

With monkeys, one file holds the keys, the vault holds the secrets, and the file is the one you commit:

+foo
@test
OPENROUTER_API_KEY
STRIPE_SECRET_KEY

monkeys remember OPENROUTER_API_KEY  # the secret goes into the vault, once
monkeys run ./hello.sh               # the command gets them, nothing else does
monkeys pack                         # to share: one encrypted file

One file replaces three. A line that was never secret sits in it as KEY=value. One binary for macOS and Linux does the rest: no runtime, no service, no vault of its own.

What it is not

Not a secret manager with a server or an audit log. Not a wall against an agent that sets out to read a secret; it removes the reflex, which is the everyday problem.

Where to go next

Quickstart remembers a secret and uses it, Concepts defines every term the reference uses, and Commands has one page per command.