Fnox
title: fnox type: tool created: 2026-05-19 last_updated: 2026-05-19 related: ["Playradar", "radar/tools/Varlock", "radar/tools/Infisical"] sources: ["https://fnox.jdx.dev/"] radar_quadrant: Tools radar_ring: Hold radar_position: center
A CLI tool for managing secrets across development and production environments. Secrets are either encrypted and committed directly to the git repository (using age, AWS KMS, or GCP KMS) or referenced at runtime from cloud providers including AWS Secrets Manager, Azure Key Vault, 1Password, Bitwarden, and Infisical.
fnox uses TOML configuration files (fnox.toml) that declare secret sources and profile mappings. Secrets pulled from cloud providers are resolved at runtime; secrets stored locally are encrypted at rest and decrypted on demand. Shell integration injects resolved values into the process environment without writing to disk.
Profile support allows different secret sets for development, staging, and production environments within the same configuration file.
| Backend | Use case |
|---|---|
| age | Local key-based encryption; no cloud dependency |
| AWS KMS | KMS-managed key; integrates with IAM |
| GCP KMS | Cloud KMS key; integrates with GCP IAM |
Fetches secrets at runtime from AWS Secrets Manager, Azure Key Vault, 1Password, Bitwarden, and Infisical. Provider-specific configuration is declared in fnox.toml; no code changes are required in the consuming application.
Varlock (Trial/inner) focuses on schema-first env configuration for AI-safe context sharing; fnox focuses on encrypted secret storage and multi-provider secret fetching. Infisical (Assess/inner) is a centralised secrets platform with a dashboard and team access controls; fnox is a single-developer CLI without a server component. The three tools address different points on the secrets management spectrum.
fnox is moved to Hold. Its two value propositions — git-encrypted secrets (age/KMS) and runtime cloud provider fetching (AWS Secrets Manager, Azure Key Vault) — both require infrastructure not in active use. AWS/GCP KMS are not part of the current stack, making the encryption backends irrelevant. The cloud provider fetching overlaps with Infisical's roadmap. The shell env loading use case is covered by lpassrc (Trial/inner). No concrete gap remains that fnox would fill; do not start new work with it.
