Install the chainenv Claude plugin to teach agents how to use the chainenv CLI for local secret workflows.
npx claudepluginhub dvcrn/chainenvClaude plugin for chainenv, the CLI for config-aware local secret workflows across keychain and 1Password.
A simple macOS Keychain and Linux Secret Service wrapper for getting/setting secrets from keychain or 1Password, and using them as environment variables.
Also available as a mise plugin
brew
brew install dvcrn/formulas/chainenv
npm
npm install -g @dvcrn/chainenv
(this tool is not written in JavaScript, just distributed through NPM)
... or with Go:
go install github.com/dvcrn/chainenv@latest
To use 1Password functionality, you need to have the 1Password CLI installed as well:
brew install 1password-cli
npx skills
npx skills add dvcrn/chainenv --full-depth --list
npx skills add dvcrn/chainenv --full-depth
Claude marketplace CLI
claude plugin marketplace add dvcrn/chainenv
claude plugin install chainenv@dvcrn-chainenv --scope user
If the marketplace was already added, update it before reinstalling:
claude plugin marketplace update dvcrn-chainenv
claude plugin install chainenv@dvcrn-chainenv --scope user
Claude UI
Open Claude's plugin or marketplace UI, add or select the dvcrn/chainenv marketplace, then install the chainenv plugin. The bundled chainenv skill will be available after installation.
Usage:
chainenv [command]
Available Commands:
completion Generate the autocompletion script for the specified shell
copy Copy passwords between backends
get Get a password for an account
get-env Get passwords as environment variables
help Help about any command
list List keys declared in config
ls List all stored accounts
set Set a password for an account
update Update a password for an existing account
diag Diagnose available backends
Flags:
--backend string Backend to use (keychain or 1password) (default "keychain")
--debug Enable debug logging
-h, --help help for chainenv
--vault string 1Password vault to use (default "chainenv")
Caveats: 1Password mode is very very slow. This is sped-up somewhat by using goroutines to parallelize the requests, but it's still slow.
My recommendation: Use chainenv cp --from 1password --to keychain to copy passwords from 1Password to the keychain, then use keychain for fast access.
❯ time ./chainenv get-env TEST,TEST2,Test3
TEST='123'
TEST2='123'
________________________________________________________
Executed in 36.67 millis fish external
usr time 19.28 millis 30.00 micros 19.25 millis
sys time 19.04 millis 502.00 micros 18.54 millis
❯ time ./chainenv get-env TEST,TEST2,Test3 --backend 1password
TEST='123'
TEST2='123'
________________________________________________________
Executed in 3.42 secs fish external
usr time 256.23 millis 48.00 micros 256.18 millis
sys time 129.46 millis 587.00 micros 128.87 millis
Lists all accounts that have passwords stored in the configured backend.
chainenv ls
chainenv ls --backend 1password
Lists keys declared in .chainenv.toml or chainenv.toml.
chainenv list
Retrieves a password from the keychain for a specified account.
chainenv get <account>
chainenv get <account> --backend 1password
Stores a new password in the keychain for a specified account.
Also registers the key in .chainenv.toml (or chainenv.toml if found).
chainenv set <account> <password>
chainenv set <account> <password> --backend 1password
chainenv set <account> <password> --default <value>
Updates an existing password in the keychain for a specified account.
chainenv update <account> <password>
chainenv update <account> <password> --backend 1password
Retrieves multiple passwords and outputs them as shell exports.
chainenv get-env <account1,account2,...> [--fish|--bash|--zsh]
chainenv get-env <account1,account2,...> [--fish|--bash|--zsh] --backend 1password
... will output
account1='foo'
account2='bar'
or with --zsh
export account1='foo'
export account2='bar'
If no accounts are provided, chainenv get-env will load keys from .chainenv.toml or chainenv.toml.
chainenv cp --from <backend> --to <backend> ITEM1,ITEM2
If .chainenv.toml or chainenv.toml exists, chainenv will read it and use it to:
chainenv list)chainenv get-env without args)Lookup order:
.chainenv.tomlchainenv.tomlExample config:
["1password"]
service_account_token_key = "CHAINENV_OP_TOKEN"
Development marketplace for Superpowers core skills library
Harness-native ECC skills, hooks, rules, MCP conventions, and operator workflows
Open Design — local-first design app exposed to coding agents over MCP. Install once with your agent's plugin command and projects/files/skills are reachable through stdio.