Lade

The case for Lade is a security-posture argument, not a feature argument. Daemon-based secret tooling — envconsul, Vault Agent — keeps credentials live in a process that outlives any single command, and refreshes them on a schedule. Lade inverts that: the secret exists for the duration of one shell command and is cleared when the command exits. On the Metatype ecosystem page, Lade is described as loading secrets from your preferred vault as environment variables and clearing them once your shell command is over, and it notes that the Meta CLI bundles Lade to load secrets into typegates. That bundling is Lade's genuine differentiator — it means Metatype users get command-scoped secret injection without adding a second tool to their stack. The context matters too. Lade sits in a four-tool ecosystem that Metatype is explicit about: ghjk is a programmable runtime manager and an attempt at an asdf successor, Substantial is brokerless durable execution for Python and serves as a sandbox for Metatype's workflows engine, and Whiz is a modern DAG/tasks runner for multi-platform monorepos. These read as tools Metatype built to develop Metatype — the ecosystem page says ghjk "powers the development of Metatype on its authors' machines, on the CI and containers," and Whiz "enables to develop the core components of the ecosystem together." That is worth understanding before you adopt: you are picking up tooling from a small vendor's internal stack, which is excellent for fit and less excellent for the kind of support surface a large commercial secret-management vendor provides. The honest limitations are structural. Lade is one-shot by design, so dynamic secret renewal, lease management, and persistent secret storage are out of scope — those are the reasons you would choose envconsul or Vault Agent instead. It is a CLI, so there is no management interface. Windows support is not documented in the material available to us. The core repo and its own documentation are not among the pages we could read for this pass; the authoritative description we have is Metatype's ecosystem page, which is a summary rather than a manual. Treat specific backend-support and platform claims as things to verify against the repository before you commit a production pipeline to it. Where it fits: CI/CD steps with short-lived credential needs, local development where you want a database password to never land in your shell history or a dotfile, and administrative one-offs. Where it does not: anything requiring secrets to stay available across a session, anything needing a UI, or teams that want a commercial support contract behind their secret tooling.