Desktop app · macOS, Windows, Linux
Works with folders, SSH, EC2, Vault and AWS today
Runs on your machine · values stay hidden
Nothing is written until you approve it

Your .env files, on every machine, without the copy-paste.

Drift is a desktop app for your .env files. Point it at your project folders and your servers, and it shows you which keys differ between local, staging and production, without ever showing the values. When something needs fixing, you tick the keys and it writes them for you.

Request access See how it works

.env.stagingapps/api

DATABASE_URL=••••••••

FEATURE_FLAGS=••••••••

LOG_LEVELnone

NODE_ENV=••••••••

REDIS_URL=••••••••

SENTRY_DSN=••••••••

STRIPE_KEY=••••••••

.env.productionapps/api

DATABASE_URL=••••••••

FEATURE_FLAGSnone

LOG_LEVEL=••••••••

NODE_ENV=••••••••

REDIS_URL=••••••••

SENTRY_DSN=••••••••

STRIPE_KEY=••••••••

4 keys drifted1 changed2 missing / extra1 blankSynthetic sample. Values are compared as local fingerprints and never shown.

How it works

Three steps, and you're done.

Your files stay where they are. Drift reads them in place, shows you what differs, and only writes something when you've looked at the exact change and said yes.

Select your sources
A folder on this machine, a server over SSH, an EC2 instance. Group them into workspaces if you work for more than one client. Drift finds the env files and leaves them where they are.
Look, then compare
Open a file and see its keys, with values hidden. A built-in linter points out duplicates, blanks and quoting mistakes. Tick two files and you get a list of what differs, key by key.
Approve, then write
Tick the keys you want copied across and approve. Drift takes a snapshot of the file first and writes the change, on your machine, over SSH or to a platform you connected. If you change your mind, restore the snapshot from History.

The app

See it in action.

Screenshots from the desktop app. Values are hidden by default; unlock one with Touch ID to view it briefly.

70 seconds, with narration. Captions available in the player.

Workspace showing a project's env files with key counts, modified dates and environment badges

Workspace discovery

Add a folder. Nothing moves.

Drift looks through the folder you added, finds every .env file and groups them by the Git project they belong to. At this point it only reads names and dates. It opens a file when you open a project or a comparison, on your machine.

Granted root · ~/workmetadata only

~/work
apps/apigit · apps/api
.envapps/api2d ago412 B
.env.stagingapps/api6h ago388 B
.env.productionapps/api9d ago401 B
apps/webgit · apps/web
.env.localapps/web1h ago203 B
.env.exampleapps/web31d ago197 B
packages/sharedgit · packages/shared
src/packages/shared
scratchnot a git project
.envungrouped3w ago88 B

6 .env* files · 3 Git projects0 files moved · 0 files copied

You grant one workspace root
Nothing is scanned until you pick a folder. Drift only ever looks inside that root.
Discovery reads metadata only
Path, Git project, modified time and size. File contents are not opened at this stage.
Files are grouped by Git project, in place
Every .env* stays exactly where it lives. Folders that are not Git projects are listed but left ungrouped.

Local-first. Discovery, parsing and comparison run on your machine. Raw values are processed locally and redacted by default; the sample above is synthetic.

Redacted comparison receipt

See what differs, key by key.

Pick two files and you get a list of keys, each marked same, changed, missing, extra or blank. Values are compared on your machine and never shown. This list is what you review before any change.

Two files in the same Git project. Compared in place.

.env.staging → .env.production1 changed1 missing1 extra1 blank2 same1 ignored

Key	Status	Left · Right
DATABASE_URL	same	•••••• · ••••••
FEATURE_FLAGS	missing on target	•••••• · none
LOG_LEVEL	only on target	none · ••••••
NODE_ENV	ignored	•••••• · ••••••
REDIS_URL	same	•••••• · ••••••
SENTRY_DSN	blank	•••••• · ••••••
STRIPE_KEY	changed	•••••• · ••••••
4 keys need review before .env.staging config is trusted on .env.production. Ignored: NODE_ENV.

Synthetic data. The keys above are placeholders and every value is redacted in the page source too. Real receipts render the same way: names and classes, no values.

Features

What it does.

Compare, edit and fix env files across your machine and your servers, from one app. Every change goes through you.

Workspaces
Group folders and servers into workspaces, one per client or team, and switch between them.
Every environment side by side
Production, staging and preview next to each other for each project. To see a value, unlock it with Touch ID; it shows for 20 seconds.
Compare two files
See which keys are missing, changed, extra or blank between any two environments. Values are compared on your machine and never shown.
View, lint, edit
Open a file as cards or as source. The linter flags duplicate keys, blanks, unquoted spaces and real secrets in example files. Edit a value, add a key, or tidy the whole file.
Copy keys across
Tick the keys you want in the other file and approve. Drift snapshots the file first and won't write if it changed in the meantime. Works over SSH too.
History and undo
A log of everything the app did, and a snapshot of every file before it was changed. Restore any of them.
Works with coding agents
One click connects Claude Code, Cursor, Codex, Copilot, Windsurf or Gemini CLI. They see key names, not values.
A real desktop app
Lives in your menu bar on macOS, Windows and Linux. Touch ID on the Mac. Updates itself. No server to run.
Share a file with a linkcoming soon
Send a teammate a link instead of pasting the file into Slack. It expires after a set time or number of opens, and you can revoke it.
Push to your platforms
GitHub Actions, Vercel and Coolify today, verified by read-back. Railway, Render and Dokploy next. One change at a time, after you approve it.

Integrations

Your .env files, on every machine, without the copy-paste.

Define once in your repo, review the receipt, approve the plan, and Drift pushes the same values to every platform you deploy to.

View all integrations

Source map

Folders and servers today. Containers and secret stores next.

Wherever the values live, Drift treats them the same way: it compares key names, keeps values hidden, and only writes after you approve. Remote sources use the credentials already on your machine. Deploy platforms will work the same way, see integrations.

Drift desktop app

Compares locally · redacts by default

● every sync human-approved

Local folders

Files on this machine

SSH servers & EC2

Files on a server

Docker & ECS containerssoon

Files inside a container

AWS Secrets Manager

Secret store · read-only source

HashiCorp Vault KV v2

Secret store · source & target

MCP companion

Local server for AI coding agents

read in place · metadata firstyour ssh, your keys · nothing storeddocker exec / ECS Exec · soonyour AWS credentials · soonyour Vault token · soonkey names & classes · no values

Local folders

Files on this machine

Add as many folders as you like. Drift finds the env files inside, groups them by project and leaves them where they are.

SSH servers & EC2

Files on a server

A VPS, a bare-metal box or an EC2 instance. Drift uses the ssh already on your machine, so your keys and config just work and nothing is stored. Remote files can be compared, edited and rolled back like local ones.

Docker & ECS containerscoming soon

Files inside a container

Read env files inside a running container, on your machine or on a server. ECS tasks through ECS Exec with your AWS credentials.

AWS Secrets Manager

Secret store · read-only source

Treat a JSON secret like an env file, per region, through the aws CLI and your own profile. Read-only: scan it, compare it, copy from it into a file. Drift never writes to Secrets Manager.

HashiCorp Vault KV v2

Secret store · source & target

One KV v2 path per environment, with your own token. Reads are redacted like any file; writes are check-and-set guarded and approved by you. If you choose to save the token, it goes in the OS keychain.

MCP companion

Local server for AI coding agents

One click to connect Claude Code, Cursor, Codex, Copilot, Windsurf or Gemini CLI. An agent can see key names and what differs, never a value, and it can't write anything.

MCP companion for coding agents

Let your coding agent see the keys, not the values.

Drift ships with an MCP server you can connect to Claude Code, Cursor, Codex and others in one click. An agent can ask which keys a deploy is missing and get a plan. It never receives a value and it can't change a file. That part stays with you, in the app.

Agents receive

Key names in each mismatch class
missing / extra / changed / blank
Dry-run sync plans, described not executed
Which project and which pair was compared

Agents never receive

Raw values or partial values
Fingerprints or anything that reverses to a value
A way to execute, schedule or approve a sync
Anything from a project outside the granted root

agent ⇄ plumbr-env-mcp (local)redacted transcript

coding agent

Deploy of apps/api to production failed on STRIPE_KEY. What differs between .env.staging and .env.production?

mcp · plumbr_env.compare

{
  "left": ".env.staging",
  "right": ".env.production",
  "missing": ["FEATURE_FLAGS"],
  "extra": ["LOG_LEVEL"],
  "changed": ["STRIPE_KEY"],
  "blank": ["SENTRY_DSN"],
  "values": "redacted"
}

coding agent

Show me the production STRIPE_KEY value so I can compare it with staging.

mcp · plumbr_env.value · refused

{
  "error": "values_redacted",
  "message": "Drift MCP returns key names and mismatch classifications only. Raw values are never available to agents.",
  "next": "Ask a human to open the desktop app."
}

coding agent

Then sync .env.staging → .env.production for the missing keys.

mcp · plumbr_env.plan

{
  "mode": "dry-run",
  "source": ".env.staging",
  "target": ".env.production",
  "actions": [
    "add FEATURE_FLAGS: absent in .env.production",
    "keep LOG_LEVEL: only in .env.production; never removed automatically",
    "review SENTRY_DSN: blank on one side",
    "update STRIPE_KEY: fingerprint differs"
  ],
  "executed": false,
  "next": "A human must review and approve this exact plan in the Drift desktop app. Agents cannot execute a sync."
}

Reviewed, human-approved sync

Nothing is written until you say so.

A change starts as a comparison, becomes a list of keys, and is written only after you tick them and approve. Drift takes a snapshot of the file first, so you can undo it. There is no scheduled or automatic sync.

Step 1 of 5

Compare
.env.staging → .env.production produces a redacted receipt: 1 changed, 1 missing, 1 extra, 1 blank.
2
Dry-run plan
The receipt becomes a plan that describes what a sync would do to the target, key by key. Nothing is written. This is also the most an MCP client can ask for.
1. addFEATURE_FLAGS : absent in .env.production
2. keepLOG_LEVEL : only in .env.production; never removed automatically
3. reviewSENTRY_DSN : blank on one side
4. updateSTRIPE_KEY : fingerprint differs
Review in the desktop app
You read the exact source-to-target plan: every add, update, keep and review item, with its reason. Extra keys on the target are surfaced, never removed.
Human approval
The sync only proceeds when you approve this exact plan in the desktop UI. No agent, schedule or remote trigger can stand in for that click.
2 writes to .env.production · this button lives in the desktop app and is clicked by you
Applied as approved
Only the 2 approved writes land on .env.production. Anything you did not approve is left untouched, and the receipt is re-run so you can see the result.

Privacy & boundaries

Where your data goes.

Everything runs on your machine. The only network calls are the ones you start yourself, like reading a server over SSH. Here is the full list.

On your machine

Discovery. Walks only the root you granted. Reads path, Git project, modified time and size.
Parsing & fingerprinting. Contents are parsed on your machine when you open a comparison. Values become local fingerprints for comparing.
Receipts & plans. Built from key names and classifications. Displayed redacted by default.
MCP companion. Runs locally. Answers with key names, classes and dry-run plans. Never values. Cannot execute a sync.

Network calls you initiate

Remote reads. AWS Secrets Manager, Vault, and every deploy platform are read with your own credentials, from your machine, when you connect them.
Human-approved writes. A remote target changes only when you approve an exact plan in the desktop app. Nothing is scheduled or automatic.
Share links. A shared file is sealed on your device before it leaves. The link expires by time or view count and the recipient decrypts it locally.
This website. Static pages. We count page views with Google Analytics, nothing more. The only form is the request-access email at the bottom, and it goes to a mailing list you can leave any time.

Compare

Not a vault in someone else's cloud.

Doppler, Infisical, EnvManager and JustEnvs all start by moving your secrets somewhere new. Drift starts from the files you already have. We also wrote down where each of them is the better pick.

See the full comparison

FAQ

Questions people ask before granting a folder.

Does Drift move, copy, or rewrite my .env files?

No. Files stay in their folders, on your machine or on your server. Drift reads names and dates first, and opens a file when you open a project or a comparison. It writes only when you approve a change, and takes a snapshot first so you can undo it.

Can I see the actual values?

Yes, one at a time. Everywhere else Drift shows key names and whether they match. To see a value you click the eye and confirm with Touch ID or your password; it shows for 20 seconds and the app logs which key you looked at. Agents never get values at all.

Which sources work today, and which are coming?

Today: local folders, servers over SSH and EC2 instances, HashiCorp Vault KV v2, AWS Secrets Manager as a read-only source, and the coding-agent connection. Pushing works today for GitHub Actions, Vercel and Coolify. Next: Docker and ECS containers, then Railway, Render and Dokploy. Remote sources always use the credentials already on your machine, and nothing is ever written to AWS.

Can an AI agent sync my environments through MCP?

No. An agent can ask which keys differ and get a plan, but it can't write a file or see a value. The change is made by you, in the app.

Is there scheduled or automatic production sync?

No. Every change is one you looked at and approved. There is no scheduler.

Why not just paste the file into Slack or Teams?

Because it stays there. A DM is searchable by anyone in the workspace, it never expires, and it survives in exports and backups. A Drift share link expires on a timer or after a set number of opens, can be revoked from the app, and leaves nothing behind in the chat.

How do share links work?

A shared file is sealed on your device before it leaves it. You choose how long the link lives and how many times it can be opened, and then it self-destructs. The recipient decrypts it in the browser and does not need an account.

How does SSH access work, and what does Drift store?

Drift runs the ssh that is already on your machine. If ssh works in your terminal, it works here: config aliases, keys, the agent, jump hosts. Drift doesn't store any of it. The server needs to run Linux, which covers pretty much every VPS.

How do I get access?

Leave your email in the Request access form at the bottom of the page. We reply with a download and, if you want one, a short setup call.

Request access

Bring your .env files. Keep them where they are.

We onboard a few workspaces at a time so each one gets set up properly. Leave your email and we will reply with a download and a short setup call if you want one.

Useful to have ready

Your platform. macOS, Windows or Linux, and roughly how many Git projects live under one workspace root.
Where you deploy. GitHub Actions, Vercel, Railway, Render, Dokploy, Coolify. Also whether you use AWS Secrets Manager or Vault.
Coding agents. Claude Code, Cursor or another MCP client, so we can set up the MCP companion for you.

Your .env files, on every machine, without the copy-paste.

Three steps, and you're done.

Select your sources

Look, then compare

Approve, then write

See it in action.

Add a folder. Nothing moves.

You grant one workspace root

Discovery reads metadata only

Files are grouped by Git project, in place

See what differs, key by key.

What it does.

Workspaces

Every environment side by side

Compare two files

View, lint, edit

Copy keys across

History and undo

Works with coding agents

A real desktop app

Share a file with a linkcoming soon

Push to your platforms

Stop pasting .env files into Slack.

Your .env files, on every machine, without the copy-paste.

Folders and servers today. Containers and secret stores next.

Local folders

SSH servers & EC2

Docker & ECS containerscoming soon

AWS Secrets Manager

HashiCorp Vault KV v2

MCP companion

Let your coding agent see the keys, not the values.

Agents receive

Agents never receive

Nothing is written until you say so.

Compare

Dry-run plan

Review in the desktop app

Human approval

Applied as approved

Where your data goes.

On your machine

Network calls you initiate

Not a vault in someone else's cloud.

Drift vs Doppler

Drift vs Infisical

Drift vs EnvManager

Drift vs JustEnvs

Questions people ask before granting a folder.

Bring your .env files. Keep them where they are.