Absolutely. Doppler custodies the credentials entirely themselves, and Infisical ditched zero-trust earlier on citing complexity and UX concerns - IMO they just didn't try hard enough ;)

I also decided to embrace .env because that's how humans (and apparently agents -- for now) like to work when building stuff. Except Capy is the only solution I know of that allows you to cryptographically revoke access to those .env files in real time.

Regarding the MCP, watch this space: https://www.capy.sc/