Install MayFly and run your first zero-disk sandboxed command in under two minutes.

Installation

MayFly is distributed as a single static binary with zero external dependencies. Choose your platform:

curl -fsSL https://raw.githubusercontent.com/vishnunandan555/mayfly/main/install.sh | bash

Note: The installer automatically detects your operating system, CPU architecture (Intel or Apple Silicon), installs mayfly and the mf alias to ~/.local/bin, and configures your shell PATH.

irm https://raw.githubusercontent.com/vishnunandan555/mayfly/main/install.ps1 | iex

Note: The PowerShell script installs mayfly.exe and mf.exe to ~/.local/bin and updates your Windows User PATH automatically.

# Native Windows PowerShell build (recommended)
git clone https://github.com/vishnunandan555/mayfly.git
cd mayfly
$binDir = Join-Path $env:USERPROFILE ".local\bin"
New-Item -ItemType Directory -Force -Path $binDir | Out-Null
$env:CGO_ENABLED = "0"
go build -trimpath -ldflags="-s -w -buildid=" -o (Join-Path $binDir "mayfly.exe") .\cmd\mayfly
Copy-Item (Join-Path $binDir "mayfly.exe") (Join-Path $binDir "mf.exe")
$env:Path += ";$binDir"

# Makefile path (Git Bash / MSYS2 / WSL or choco install make)
git clone https://github.com/vishnunandan555/mayfly.git
cd mayfly
make install

make targets require Git Bash/MSYS2/WSL or choco install make; on native PowerShell/cmd use the commands above instead.

Verify the installation:

mf version
# -> mayfly v0.0.5 (zero-dependency)

4-Step Workflow

1. Initialize the Project Vault

Navigate to your application root directory and initialize the encrypted storage:

cd /path/to/my-project
mf init

MayFly prompts you to set a master password on first run. It derives a 256-bit AES encryption key using PBKDF2-HMAC-SHA256 (600,000 iterations) and binds the vault to your hardware directory inode.

2. Store Application Secrets

Add secrets individually without writing unencrypted files to disk:

mf set DATABASE_URL="postgres://user:password@localhost:5432/app"
mf set STRIPE_SECRET_KEY="sk_live_0123456789abcdef"
mf set JWT_SECRET="super-secret-token"

Importing an Existing `.env` File

If you already have a .env file, you can bulk-import it directly into the vault:

mf import .env
# -> [OK] Imported 8 secrets from .env into project
# -> Would you like to delete the plaintext .env file from disk now? [y/N]: y
# -> [OK] Deleted plaintext .env from disk.

To list registered variable names for the project:

mf list

3. Run Your Application with In-Memory Injection

Execute any command directly using mf (or mayfly):

# Node.js / Next.js
mf npm run dev

# Python / FastAPI / Django
mf python main.py

# Docker Compose
mf docker compose up -d

MayFly resolves the project identity, decrypts secrets directly into volatile RAM, and spawns the target binary via host-native os/exec. Decrypted secrets never touch the filesystem.

4. Verify the Cryptographic Audit Trail

Validate that the execution was immutably recorded in the tamper-evident SHA-256 hash chain:

mf audit verify
# -> Audit log hash chain verified successfully.

To inspect chronological access history:

mf audit

Visual Terminal Dashboard (TUI)

Prefer a visual dashboard? MayFly includes a built-in terminal UI built entirely with the Go standard library:

# Launch global workspace dashboard
mf

# Or open directly scoped to current repository
mf current

Use arrow keys (↑/↓/←/→), Enter to open projects, and Esc to navigate.

Zero Disk Footprint

MayFly never writes an unencrypted file to disk. If your application or a third-party dependency inspects the filesystem for a .env file, none exists. Decrypted variables reside strictly in the child process RAM table.

Next Steps

Why MayFly?: Threat model, supply-chain risks, and alternatives comparison.
Concepts: Inode binding, memory safety, and Merkle hash chains.
Node.js Guide: Using MayFly with Next.js, Express, and npm scripts.
Python Guide: Using MayFly with FastAPI, Django, and Flask.
CLI Reference: Full syntax reference for all CLI commands and flags.

Quickstart