Vault Management Commands

mf init

Initialize an encrypted vault container and bind it to the current directory inode.

mf init [-path DIR]

mf set

Assign or update an encrypted secret variable in the current project vault.

# Direct assignment
mf set STRIPE_KEY="sk_live_1234567890"

# Interactive ephemeral alt-screen prompt (recommended)
mf set STRIPE_KEY

Ephemeral Alt-Screen Entry

When run without a value argument in an interactive terminal, MayFly opens a temporary alternate terminal screen:

  Enter value for STRIPE_KEY: █

• The secret is visible to you for instant visual verification of copy-pastes.
• Pressing Enter immediately closes the alternate screen and saves the secret to the encrypted vault.
• Zero traces are left in terminal scroll-back or shell history files (~/.bash_history / ~/.zsh_history).

mf get

Retrieve and view the decrypted value of a secret key with zero terminal scroll-back history.

mf get <KEY> [--clip] [--raw]

Ephemeral Zero-History Secret Viewer

When executed in an interactive terminal, mf get automatically launches an isolated alternate-screen modal (\x1b[?1049h):

• Displays the secret name, project context, and secret value in a clean, focused window.
• Press C to immediately copy the secret to the system clipboard.
• Press Q, Esc, or Enter to exit and destroy the screen.
• Zero plaintext leakage: The terminal screen is completely restored to its exact previous state, leaving nothing in terminal scroll-back or command history.

Flags & Pipeline Usage

• --clip / -c: Copy the secret value directly to your system clipboard (using OSC 52, pbcopy, wl-copy, or Windows clip) without displaying the modal.
• --raw / -r: Output raw plaintext directly to stdout.
• Pipelines & Subshells: When piped or captured in scripts (e.g. TOKEN=$(mf get STRIPE_KEY) or mf get KEY | pbcopy), MayFly automatically detects non-TTY output and prints raw plaintext for seamless script compatibility.

# Copy directly to clipboard
mf get STRIPE_SECRET_KEY --clip

# Output raw in shell scripts
TOKEN=$(mf get STRIPE_SECRET_KEY)

mf list

List all secret keys registered for the current project.

mf list [--json]

Flags

• --json: Output secrets as a structured JSON array for CI automation and scripting.

mf delete

Remove a secret key from the project vault.

mf delete <KEY>

mf import

Bulk-import an existing .env file directly into your encrypted project vault.

# Interactive import (prompts to delete plaintext file after success)
mf import [.env]

# Automatically delete the plaintext file upon successful import
mf import .env --delete

# Keep the plaintext file without prompting
mf import .env --no-delete

Parses standard .env formats (handles comments, export prefixes, single and double quotes) and registers all valid secrets into the vault. Upon successful import, MayFly interactively asks if you want to securely delete the plaintext .env file from disk so credentials are never left exposed.

mf rotate-password

Re-encrypt the entire vault under a new master password with a fresh 32-byte random cryptographic salt.

mf rotate-password

Prompts for your current master password (with echo suppressed), validates it, derives a new 256-bit AES key with PBKDF2 (600,000 iterations), and re-encrypts all project credentials in memory before writing to disk.

mf backup & mf restore

Export and restore encrypted vault snapshots across workstations or disaster recovery targets.

# Export encrypted snapshot
mf backup [snapshot.json]

# Restore from snapshot
mf restore <snapshot.json>

mf migrate

Update project bindings when a repository directory moves or is renamed across filesystems.

mf migrate <OLD_PATH> <NEW_PATH>

mf completion

Generate shell autocompletion scripts for your interactive shell environment (bash, zsh, or fish).

# Bash completion
mf completion bash > /etc/bash_completion.d/mayfly
# or in ~/.bashrc:
source <(mf completion bash)

# Zsh completion
mf completion zsh > "${fpath[1]}/_mayfly"

# Fish completion
mf completion fish > ~/.config/fish/completions/mayfly.fish

mf uninstall

Cleanly remove mayfly and mf binaries, remove PATH exports from shell configuration files, and wipe all local vault data.

mf uninstall

Automated CI Environments

You can supply the master password non-interactively using the MAYFLY_VAULT_PASSWORD environment variable in headless CI pipelines (e.g., GitHub Actions, GitLab CI):

export MAYFLY_VAULT_PASSWORD="ci-vault-password"
mf npm test