crafter-station

Rotate CLI — Development skill for Claude Code

Development community

Agent-first secrets rotation CLI.

How to install Rotate CLI

This entry records only its repository, not the path inside it, so there is no exact command to give. Open crafter-station/rotate-cli and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Rotate CLI does

Agent-first secrets rotation CLI. Local-first, zero servers. Built after the Vercel April 2026 breach.

Alternatives in Development

Clicky — Update: April 27, 2026 7.4k ★
Breach Check — HIBP k-anonymity check on a password wordlist 4.5k ★
Update Scaffold — Check for and apply myPKA scaffold framework updates safely 296 ★

README

rotate-cli

Agent-first secrets rotation CLI. Local-first. Zero servers.

`rotate-cli` is the first secrets rotation tool designed for the AI-native stack. Your master credentials never leave your machine. They are borrowed from CLIs you already trust (`vercel`, `gh`, `clerk`). It ships an **agent mode** with hard guardrails so Claude Code and Codex can rotate safely, and an **incident mode** that responds to vendor breaches in a single command.

Built by [Crafter Station](https://crafterstation.com) after the April 2026 Vercel breach left one of us staring at 1,516 env vars flagged *Need to Rotate*.

**Status**: `v0.1.0-dev`. Pre-release, not yet on npm. Ownership detection and dedup are battle-tested against a 318-project Vercel team. `apply` end-to-end smoke tests against real providers are in progress.

Docs: [rotate-cli.crafter.run/docs](https://rotate-cli.crafter.run/docs)

Install

# npm publish pending
git clone https://github.com/crafter-station/rotate-cli
cd rotate-cli
bun install
bun link                # exposes `rotate-cli` globally
rotate-cli --help

Three commands, one flow

# 1. Discover every env var across every Vercel project
rotate-cli scan

# 2. For each mapped secret, decide mine vs someone else's
rotate-cli who --from-scan --tag non-sensitive

# 3. Rotate the ones you own. Auto-only is the default phase.
rotate-cli apply --from-scan --tag non-sensitive \
  --yes --confirm-bulk \
  --reason "vercel-apr-2026 breach"

# 4. Close rotations once consumers have redeployed
rotate-cli status                     # see in-flight rotations
rotate-cli revoke        # invalidate the old secret

If you prefer explicit config, write a `rotate.config.yaml` with declared `secrets` and `consumers`. See `docs/ADAPTER_SPEC.md` for the schema.