Muth

Muth is an ephemeral secret vault and process environment injector using native age encryption.

Muth encrypts environment secrets into an muth.lock file using native X25519 (age) public key stanzas or SSH keys (~/.ssh/id_ed25519). During child process execution (muth run -- <command>), secrets are decrypted in-memory and injected directly into the process environment without shell hooks, cd mutations, or writing unencrypted files to disk.

Note: Muth was created as an engineering experiment in process environment security under maintainer guidance.

Key Distribution Model

Muth uses the native age format:

• Solo-First: muth init auto-detects ~/.ssh/id_ed25519 or generates a local identity at ~/.muth/identity.
• Team Onboarding: muth grant <pubkey> appends a recipient stanza to muth.lock wrapping the file key for team members without re-encrypting underlying payloads.
• Interoperability: You can decrypt muth.lock anytime with standard age CLI tools:

  age -d -i ~/.ssh/id_ed25519 muth.lock

Security Posture on Revocation: muth revoke <pubkey> removes recipient stanzas for future file edits. As in any offline decentralized encryption system (such as sops or GPG), revoking recipient access for future commits does not retroactively purge secrets previously decrypted locally by that user. Rotating compromised secret values is required upon team offboarding.

Quick Start

Installation via Lown:

lown install gh:iamvxrn/muth

Initialize local repository:

muth init

Set encrypted secret:

muth set OPENAI_API_KEY=sk-proj-xyz123

Execute child process with injected secrets:

muth run -- revoq run

Grant access to team member:

muth grant age1...

License

Released under the MIT License.