Lade CLI
Lade hands a command secrets and private-network access only while it runs, then removes it, for humans and agents alike
- 136 ★ on the repository
- Last commit
- MPL-2.0
Broad access
Why this level
- Injects secrets and opens forwarded ports into private networks for any command matching a rule
- Installs a shell profile hook and agent hooks, so it sees every command you type
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/zifeo/lade/main/installer.sh | bashThen `lade setup` in the repository root.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Injects secrets and opens forwarded ports into private networks for any command matching a rule
- Installs a shell profile hook and agent hooks, so it sees every command you type
This is third-party code. Review the repository files before installing.
What it does
Lade reads `lade.yaml` and matches every command you type against it. When a rule fits, Lade injects values into the process environment and the access disappears once the process exits. Rules fall into three families: `secret` for values from vaults such as `op://`, files or raw strings, `tunnel` for local forwards, for example through `kubectl://` and `tsh://`, and `package` for pinned `mise://`, `apm://` and `skills://` packages. The `lade setup` command installs a Fish, Bash or Zsh hook once, plus pre-tool hooks for Cursor, Claude Code, Codex and OpenCode. Provider values are masked in output, and a `disclaimer` field holds access back until you run `lade approve`.
Who it is for. Developers and infrastructure engineers who run `tofu apply`, `psql` or `kubectl` and want agents to stop keeping keys in files and shell history.
Good fit when
- An agent runs `tofu apply` and the 1Password key should exist only for that process
- `psql` or `kubectl` needs a forwarded port into a private network that closes with the command
- A tool expects a credentials file on disk and it has to be created as a temporary one
- Risky agent commands must wait for your approval through `lade approve`
Not a fit when
- A plain `.env` is enough for you: a separate Lade layer is overkill for one secret
- You need Windows: Lade targets macOS and Linux
- You need a central team secret store: Lade only injects values from your existing vaults
Example request
Set up Lade in this repository so that `tofu apply` gets `TF_VAR_api_key` from 1Password only for the runLimitations
- It supports macOS and Linux with Fish, Bash and Zsh.
- A raw string in `lade.yaml` is not a vault secret: it stays plain text in the repository, and `lade add` warns about it once.
- On macOS the secret cache needs a hardened-runtime signature, and a `codesign` command is provided for source builds.
- The shell hook is installed once into the user profile; `lade teardown` removes only repository hooks and the shell hook stays.
- The rules file is resolved from the current folder up to `$HOME`, with the nearest file taking priority.
How to disable. `lade teardown` removes repository hooks for Cursor, Claude Code, Codex and OpenCode. `lade off` pauses it in the current shell, and the shell hook is removed separately from the user profile.
FAQ
How does Lade know which command needs secrets?
By a regular expression in `lade.yaml`. If the command matches, its process receives the values and every other run goes unchanged.
Which secret stores are supported?
The README shows `op://` references for 1Password, `file://` and raw values. Provider values are masked in output, and `--no-mask` turns the mask off.
How do I use Lade without hooks?
Add a prefix: `lade -- tofu apply`. This works in scripts and CI where the shell hook is not loaded.
What is the tunnel family?
A local port forward that opens for the lifetime of the process and closes automatically. Example schemes are `kubectl://` and `tsh://`.
Can I require approval for risky commands?
Yes, a `disclaimer` field withholds access until you review the text and run `lade approve`.
Discussion
No questions or reviews yet.
Related
CLI toolsVahta lets an agent use your passwords and API keys from an encrypted vault without ever showing it the values
A Bash command hook for Claude Code that auto-approves safe commands, stops dangerous ones and steers the agent to another route
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
agent-secrets lends keys to an AI agent for a limited time: age encryption, TTL leases, an access log and an emergency revoke.
Lagune builds security into the agent workflow: a project charter, hardening as code is written, an audit chain to verification
The elbab CLI keeps keys and passwords encrypted and lets an agent run commands with secrets without ever showing them.
Comparison with similar tools
Cards that share the main search query, and how they differ.
README in short
The README states the idea in one sentence and gives three install commands at once. Eight usage patterns with animations, the `lade.yaml` format, three rule families and a provider reference follow.