Environments and secrets

An md-doc Environment is a set of variables (for example my-app.com with API_KEY and SSH_PASS) that an AI can use without seeing their value. Values are encrypted in your browser with your master key; the server only stores encrypted data and MCP never returns them.

Principle: use yes, see no.

How to use it

1. In md-doc → Environments, create an environment and add your variables (or import a .env).
2. Install the mddoc CLI and connect it with a CLI-type API key.
3. Your AI, from its terminal, runs:

mddoc run my-app.com -- npm run deploy

The CLI downloads the encrypted environment, decrypts it on your machine, injects the variables into that process and masks its output (****). The model sees the command’s result, not the key.

What the AI can and cannot do

Can	Cannot
See the names of environments and variables	See, print or copy values
Run commands with mddoc run	Unlock the CLI on its own
Add the name of a missing variable (it stays “pending value”)	Write, change or delete existing values
Generate a random secret with mddoc set … --generate without ever seeing it	Create environments

You set values yourself on the web or with mddoc set <environment> <VARIABLE> in your terminal.

If the CLI is locked

mddoc run exits with code 3. The AI must stop and ask you to run mddoc unlock yourself; it must never ask you for the value or look for it in a .env file or the history. The attempt is logged and you can get a desktop notification.

Limits worth knowing

Masking prevents accidental leaks, not deliberate ones: a program written on purpose could transform the value before printing it. Values shorter than 6 characters (ports, true…) are not masked. More in Security.