Always onsurvives app quits — not affected by Stop all
DnDNS resolverResolves *.rex — always on, resolves even when rexenv is closed:15353:53Running
Databases
1/4 running1/2 running
MySQL 8.4.6 ▾127.0.0.1:13306 · pid 4182RunningBrowse
MariaDB 12.3.2 ▾127.0.0.1:13307Stopped
PostgreSQL 18.6.0 ▾127.0.0.1:15432Stopped
Redis 8.8.0 ▾127.0.0.1:16379Stopped
Adminer6.1.1Deep-linked into each site's database
Import from Valet, Herd or Local
3 found · 2 ready to import · scanned just nownot scanned here yet
Rescan
rexenv can't serve .local — macOS uses it for Bonjour, so taking it over breaks printers and AirDrop. 1 site will be served on .rex instead, and each copied database has its URLs updated to match (rexenv's copy only — Local's database is never written).
Public link confirmed reachable — checked every 30 s.Anyone with this link can reach your local site.
Shareable sites
LAPIapi.rexShare publicly
WDocs sitedocs.rexShare publicly
Settings
General
Theme
Start rexenv at loginrexenv opens in the menu bar when you sign in to your Mac (a macOS login item) and runs Start all — your sites come back after a reboot without a click. Never downloads or prompts at login.rexenv opens in the notification area when you sign in to Windows (a startup app — Task Manager’s Startup tab can turn it off too) and runs Start all — your sites come back after a reboot without a click. Never downloads or prompts at login.rexenv opens in the system tray when you sign in (an autostart entry in ~/.config/autostart) and runs Start all — your sites come back after a reboot without a click. Never downloads or prompts at login.
Command-line toolInstalled — manage rexenv from any terminal: rex status, rex start, rex site create.Reinstall
DNS resolver*.rex → 127.0.0.1 · agent
Local CAtrusted · login keychaintrusted · Trusted Root storetrusted · browser (NSS) and system trust stores
Re-trust local CARegenerate certificates
PHP versions
8.5.8Installed
8.4.23DefaultInstalled
8.3.32Installed
8.2.32Installed
8.1.34Install
8.0.30Install
7.4.33Install
AI agents (MCP)
Before you turn this on: this lets an AI agent connect to rexenv and use its tools. With the endpoint on, an agent can look at your sites — status, logs, users and content, every site's mail (password-reset links included) and their databases, read-only (password hashes and API keys are in there) — and it can create disposable “scratch” sites of its own, put code into them and run it. It cannot change or delete the sites you made yourself unless you turn Agent access up below, for this session, 7 days or always: that refusal lives in rexenv, not in the agent's good behaviour. Code running in a scratch site — or in one of your sites once you allow changes — runs as you, with your files and your permissions. rexenv never asks for your administrator password on an agent's behalf; at Full an agent can also publish a site to the internet, and rexenv stops any share it starts within the hour. Every call an agent makes is listed below. Turn this off when you're not using it.
Enable the MCP endpointOff by default. Enabling opens rexenv's private socket for rex mcp; turning it off closes it and disconnects any agent.
rexenvv0.8.13A calm, fast command room for your local kingdom — every server, site, and database in one place.
Example — click around. Rebuilt from the app's own design tokens, not a screenshot. An example of the rexenv window with a sidebar of pages — Sites, Services, Databases, Import, Mail, Tunnels and Settings — that can be switched between. It starts on Sites: four sites, three running and one stopped by its user.
PHP versions, per site
7
7.4.33 – 8.5.8
Database engines
4MySQL, MariaDB, PostgreSQL and Redis
2MySQL and PostgreSQL
Operating systems
3
macOS, Windows and Linux
rex CLI commands
60+
each with an AI-agent tool twin
Who it is for
Built for WordPress. Just as much at home with Laravel.
WordPress
A new WordPress site is one click, not an afternoon.
WordPress downloaded, installed and served on https://name.rex with a trusted certificate
wp-admin opens already logged in — one click, no password to remember
Plugins and themes from wp.org, a zip, a git clone or a folder on your disk
Multisite, subdomain or subdirectory
Every email caught by Mailpit — password resets and order confirmations never reach a real inbox
Share a site on a public URL, with the URL rewriting WordPress needs
A real lock on https://yoursite.rex, signed by a local authority that never leaves your machine. No warning page, no port number, no hosts file — a DNS resolver on macOSan NRPT rule on Windowsa dummy network link on Linux sends .rex home.
https://shop.rex
Trusted certificateNo port numberNo hosts file
7 PHP versions
From 7.4.33 to 8.5.8, switchable per site in one click, on all three operating systems. Versions past their security-end date are badged wherever they appear.
shop.rex · PHP version
8.5.88.4.238.3.328.2.328.1.348.0.307.4.33
Every mail caught
Password resets, order confirmations, plugin notifications. They all land in Mailpit, and none of them reach a real inbox.
Password reset requestWordPress · shop.rex
Your order has been receivedShop · shop.rex
New user registrationDocs site · docs.rex
Share it publicly
A Cloudflare quick tunnel puts a local site on a public URL, outbound-only, with the URL rewriting WordPress needs. It dies when you quit — a share you forgot about is one you did not consent to.
shop.rexShared
https://quiet-lake-tune.trycloudflare.com
Ends when rexenv quits.
The rex CLI
Over 60 commands driving the running app over a private socket: site lifecycle, logs with --follow, PHP and Xdebug switches, database export and import.
$ rex statusServices + DNS state
$ rex site listAll sites, and whether each is serving
$ rex site loginOpen a logged-in wp-admin
$ rex doctorDiagnose DNS, ports and the CLI link
Off until you turn it on
Your coding agent can drive it too
Every rex command has an MCP tool. An agent can make a throwaway WordPress site, install the plugin you are writing, run WP-CLI against it and read the mail it sent. One dial decides how far it may go with the sites you made yourself.
claude mcp add rexenv -- rex mcp
Readlook, and make scratch sitesChangeschange how your sites are servedFulldelete, publish, run code
Chosen per site. Each engine keeps a separate data directory per version series, so switching is never an in-place upgrade. MariaDB and Redis are macOS-only; MySQL and PostgreSQL ship everywhere.
MySQL
8.4.6 · 8.0.44
:13306
MariaDB
12.3.2 · 11.4.12
macOS only
PostgreSQL
18.6.0 · 17.11.0 · 16.15.0
:15432
Redis
8.8.0
macOS only
The pictures in these cards are examples, built from the app's own design tokens — not screenshots.
Honest status
Every dot is derived from a probe.
Not from what the app asked for, and not from a port that happens to be listening. A service is running when rexenv owns the process and the process answers — anything less shows as unknown rather than as green.
That rule is one of about a dozen the interface follows, each written down because a screen once lied to somebody.
rexenv finds your sites where the old tool keeps them and brings them over in four stages, each one opt-in. The old tool is strictly read-only throughout — rexenv reads its setup and never writes to it, so you can keep using it while you decide.
Laravel HerdSites, PHP pins, databases
Laravel ValetParked and linked sites
LocalWordPress sites, by WP Engine
The Windows and Linux builds do not look for another tool's sites yet, and the Import page says so rather than reporting "no sites found" about folders nobody searched. Linking an existing folder works everywhere.
Run both for a while if you like: rexenv's ports are offset from the usual defaults. Only ports 80 and 443 cannot be shared, so one tool serves at a time.
1Scanrexenv lists what it found — sites, paths, PHP versions, domains. Nothing is imported because it was found.
2ImportThe sites you choose are created pointing at the same folders. Your code is not copied.
3Copy the databasesDumped from the old server and restored into rexenv’s. Both copies exist afterwards.
4Rewrite connection configA diff of exactly what changes in wp-config.php or .env, and a backup first. Optional for Valet and Herd; ticked by default for Local.
Coming from Local
rexenv refuses .local — shadowing it breaks Bonjour — so a Local site is re-homed onto your default TLD as it comes in. Its database is copied from Local's own server, which runs only while that site is started in Local; rexenv never starts or stops it for you. Connecting is ticked by default for Local sites, because under rexenv they read no database until they are.
Install
One command. Nothing to click past.One command. No SmartScreen, no admin.One command. apt brings the rest.
No Gatekeeper step. Gatekeeper checks a file carrying the quarantine attribute, and the downloading app sets it — a browser does, curl does not. rexenv opens the first time.
Checked before it installs. The download must match the release's own .sha256, then rexenv.app goes into Applications and opens.
It is short — read install.sh before you run it. Running it is your decision to trust this source, as trusting the tap is.
Terminal
brew tap rexenv/tap
brew trust rexenv/tap
brew install --cask rexenv
brew trust is required, not optional. Current Homebrew refuses to install a cask from a tap it has not been told to trust. Skip that line and the install stops with a refusal that reads like a broken package.
No Gatekeeper step. The cask removes the quarantine attribute, so rexenv opens on a normal double-click the first time.
rex on your PATH automatically, linked into Homebrew's bin.
Updating later is brew upgrade --cask rexenv.
1. Download the universal disk image from the releases page.
2. Verify it — download the rexenv_0.8.13_universal.dmg.sha256 published beside the image, then check it. Prints OK, or tells you the file does not match.
shasum -a 256 -c rexenv_0.8.13_universal.dmg.sha256
3. Drag rexenv into Applications and eject the image.
4. Right-click → Open, then Open again in the dialog. Once only.
rexenv is ad-hoc code-signed and not yet notarized by Apple, so macOS refuses a plain double-click the first time. The one command and the Homebrew path both skip this entirely. What the dialog looks like →
PowerShell
irm https://rexenv.rex.bd/install.ps1 | iex
No SmartScreen dialog. SmartScreen checks a file a browser marked as downloaded — the Mark of the Web — and PowerShell's download writes no mark.
No administrator prompt. The installer runs silently for your user only, after the download matches the release's .sha256, and adds a Start-menu and a desktop shortcut.
3. Run it, past SmartScreen — More info → Run anyway. The wizard itself asks nothing else: install location, Install, Finish. No administrator approval, because it installs for your user only.
4. Let the Finish page start rexenv, or open it from the Start menu. Both work.
“Windows protected your PC” is expected. The build carries no code-signing certificate, so SmartScreen blocks an app it does not recognise, and Run anyway sits behind More info. Each new release is a new hash and goes through it again — the one command meets none of it. Both dialogs, word for word →
rex on your Path — a copy under %LOCALAPPDATA%\rexenv\bin, added to your user Path by the app. A copy rather than a symlink, because creating a symlink on Windows needs a privilege an ordinary account may not have.
Updating later is in-app — Settings → About offers the new version, verifies its signature and checksum, and swaps the install directory while rexenv is running.
Five components are not in this build — Apache, FrankenPHP, Xdebug, Redis and MariaDB. Each is refused with a message naming the reason, not offered and then broken.
Through apt, dependencies included. The script adds rexenv's apt repository and installs the rexenv package for your architecture — amd64 or arm64 — so WebKitGTK, the tray library, certutil and the database libraries come with it. sudo asks for your password in the terminal.
Signed, and checked before it installs. apt verifies the repository's signature against the key the script carries. While the repository lags a brand-new release, the script installs that release's .deb instead, after it matches the release's own .sha256.
Updates arrive with sudo apt upgrade too. The same package the in-app update installs.
No apt? It puts the AppImage in ~/Applications instead — untested outside Ubuntu.
Already installed? The package is left alone. rexenv updates itself from Settings → About; the script only adds the apt repository if it is not configured yet.
1. Downloadrexenv_0.8.13_amd64.deb or rexenv_0.8.13_arm64.deb from the releases page, with the .sha256 beside it. dpkg --print-architecture says which one is yours.
2. Verify it. Prints OK, or tells you the file does not match.
4. Open rexenv from your applications. It starts into the tray.
1. Downloadrexenv_0.8.13_amd64.AppImage or rexenv_0.8.13_aarch64.AppImage into a folder you own — ~/Applications is what the script uses. The in-app update replaces the file where it sits, and refuses a folder it cannot write.
2. Verify it against the .sha256 beside it — sha256sum -c on that file prints OK.
3. Make it executable and run it. An AppImage mounts itself with libfuse2, which Ubuntu 22.04 and later do not install by default.
An AppImage declares no dependencies. Where certutil, xdg-utils or the tray library is missing, rexenv's own message names it at the moment it is needed. And its password dialog is polkit's generic one — run /bin/sh as the super user — because the sentence naming rexenv comes from a file only the .deb installs.
rex on your PATH — the .deb installs it as /usr/bin/rex, beside the app.
Updating later is in-app — Settings → About. A .deb is installed with one password prompt; an AppImage is swapped with none.
Four components are not in this build — Apache, Xdebug, Redis and MariaDB. Each is refused with a message naming Linux, not offered and then broken. FrankenPHP ships.
The pinned stack
Every version, written down.
Nothing here is "latest". Every binary is pinned to an exact version and locked to a checksum, downloaded on demand from its own upstream and prepared for your machine. You can read what you are about to run before you run it. The Windows build is the same versions from different publishers, and five rows below are not in it — they are dimmed and named rather than quietly dropped.The Linux build is the same versions, native for x86_64 and arm64, and four rows below are not in it — they are dimmed and named rather than quietly dropped.
PHP
Seven versions. Switch a site between them in one click — no rebuild of docroot, certificate or database.
PHP
8.5.8 · 8.4.23 · 8.3.32 · 8.2.32 · 8.1.34rexenv's own builds on macOS, with PDO PostgreSQL; php.net's on Windows, static-php.dev's on Linux. Per-site switch, per-version php.ini editor
Xdebug 3.5.3 · macOS
PHP 8.0
8.0.30The one PHP rexenv does not build — static-php.dev's, and past its security-end dateOn macOS 13: not available — the app says which macOS it needs
EOL · no Xdebug · no PostgreSQL
PHP 7.4
7.4.33rexenv's own reproducible build, on macOS and Linux — static-php.dev publishes no 7.4
EOL · no Xdebug · no PostgreSQL
Web servers
One shared Nginx serves every site by default. Override per site when a project needs something else.
Nginx
1.30.4Shared, one server block per site. rexenv's own build
Default
FrankenPHP
1.12.4Per-site override; embeds its own PHP
Not on Windows
Apache httpd
2.4.68Per-site override with working .htaccessOn macOS 13: 2.4.65
Not on WindowsNot on Linux
OpenLiteSpeed
1.9.3Per-site override with .htaccess and LSCache. rexenv's own build
Not on Windows
Caddy
2.11.4The edge — TLS termination on :80 and :443
Databases
Chosen per site at create time. Each engine keeps a separate data directory per version series, so switching is never an in-place upgrade.
MySQL
8.4.6 · 8.0.44On macOS 13: 8.4.3 · 8.0.40
:13306
MariaDB
12.3.2 · 11.4.1211.4 is the LTS seriesOn macOS 13: 12.0.2 · 11.4.8
Not on WindowsNot on Linux:13307
PostgreSQL
18.6.0 · 17.11.0 · 16.15.0A site database for Laravel and blank PHP on PHP 8.1+On macOS 14: 16.4.0On macOS 13: not available — the app says which macOS it needs
Not for WordPress:15432
Redis
8.8.0On macOS 13: 8.2.1
Not on WindowsNot on Linux:16379
Tools
Bundled, pinned, and checksum-locked like everything else.
No paid tierMail catching, every database engine, tunnels, the CLI and the agent endpoint are in the one build everyone downloads.
Apache License 2.0The source is public — the same repository every release is published from and issues are filed on.
Nothing reports your usageComponents are downloaded from their upstreams on first use, checksum-verified. The local certificate authority never leaves your machine.
Before you install
The things worth knowing first.
macOS
13 (Ventura) or later — 15 for everything
Intel or Apple Silicon — one universal build. On macOS 13 a few components are older builds and PostgreSQL and PHP 8.0 are refused by name; 14 differs from 15 in two rows. Read the requirements
First run
Internet required, up to ~600MB
rexenv downloads its components on demand rather than bundling them, checksum-verified. After that it works offline. What gets downloaded
Permissions
Three prompts, once
An admin password for the DNS resolver, a Keychain prompt to trust a local CA that signs only your sites, and an admin password to bind ports 80 and 443. What each prompt writes
Where it lives
The menu bar — no dock icon
Closing the window hides it and stops nothing; Quit is in the menu-bar menu. The rex CLI and the agent endpoint are remote controls for the running app, so a close that quit used to take them down. The menu bar
Uninstalling
One in-app step first
Settings → Remove system changes, then delete the app. Dragging it to the Bin leaves a root daemon holding port 443. How to uninstall
Windows
11 x64
Windows 10 22H2 is best-effort — it left mainstream support in October 2025. arm64 is unsupported: the x64 build runs under emulation, but PHP publishes no arm64 Windows build and PostgreSQL’s portable build is x64 only, so there is nothing native to ship. Read the requirements
The installer
Unsigned — SmartScreen speaks first
rexenv is open source and earns nothing, so it buys no code-signing certificate. Windows shows “Windows protected your PC” and Run anyway is behind More info. The installer itself is per-user, about 37MB, and asks for no administrator approval. What the dialogs say, word for word
First run
Internet required, then two prompts
rexenv downloads its components on demand, checksum-verified, then asks twice: one UAC prompt for the .rex DNS rule, and Windows’ own certificate dialog to trust a local CA in your user’s Root store. There is no third prompt — the edge binds 80 and 443 unelevated. What each prompt writes
Where it lives
The tray — left-click opens it
Left-click the tray icon for the window, right-click for the menu — the reverse of macOS, because that is what Windows users expect. Closing the window does not quit rexenv; Quit is in the tray menu. The tray
Not in this build
Five components
Apache, FrankenPHP, Xdebug, Redis and MariaDB are refused with a message that says why, rather than offered and then failing. MySQL 8.4 and 8.0 both ship, so a database is there either way. What ships on Windows
Uninstalling
One in-app step first
Settings → Remove system changes — one UAC prompt, removing the NRPT rules, the \rexenv\dns-agent scheduled task, the CA trust and the rex copy on your Path. Then remove the app. How to uninstall
Linux
Ubuntu 22.04 LTS or newer
x86_64 or arm64, a native build for each. 22.04 is the first LTS with libwebkit2gtk-4.1, which the app’s window needs, so the one-command installer refuses 20.04 with a sentence saying so. Other distributions with systemd-resolved and polkit will probably work; none has been tested. Read the requirements
The package
apt — a signed repository — or an AppImage
The one command adds rexenv’s apt repository and installs the rexenv package from it, so its dependencies come with it, sudo apt upgrade sees later versions, and sudo asks for your password in the terminal. Without apt it puts the AppImage in ~/Applications. The repository is signed with rexenv’s own key; the app carries no code-signing certificate — rexenv earns nothing — and every file on a release has a .sha256 beside it. Every install route
First run
Internet required, then two polkit prompts
rexenv downloads its components on demand, checksum-verified. Then your desktop’s password dialog asks twice: once for the .rex DNS route and the local CA in the system store together, once for the web server on ports 80 and 443. Your browsers’ own certificate databases need no prompt. What each prompt writes
Where it lives
The tray — any click opens the menu
An appindicator icon in the top bar has no click of its own, so its menu is the whole interaction: Open rexenv is there, and Quit. Closing the window does not quit rexenv. The tray
Not in this build
Four components
Apache, Xdebug, Redis and MariaDB are refused with a message naming Linux, rather than offered and then failing — Homebrew’s Linux builds of them are x86_64 only and unrelinked. FrankenPHP, all seven PHP versions, MySQL and PostgreSQL ship. What ships on Linux
Uninstalling
One in-app step first
Settings → Remove system changes — one password dialog, removing the DNS route, the edge unit and its root folder, both certificate trusts, the DNS agent and the rex link. Then sudo apt remove rexenv, or delete the AppImage. How to uninstall
Questions
Asked before installing.
Is it really free?
Yes. rexenv is licensed under the Apache License 2.0, the source is public, and there is no paid tier — nothing on this page is held back for one. Free and open source
Does it run on Windows and Linux?
Yes — Windows 11 x64, and Ubuntu 22.04 or newer on x86_64 and arm64. Each build leaves a few components out and refuses them by name rather than offering them and failing: six on Windows (FrankenPHP, Apache httpd, OpenLiteSpeed, MariaDB, Redis and Xdebug), four on Linux (Apache httpd, MariaDB, Redis and Xdebug). The requirements, per platform
Why no Docker?
On a Mac or a PC, Docker means a Linux VM, and a VM means a filesystem boundary between your editor and your code — where the latency comes from and where file watchers stop firing. rexenv runs nginx, PHP and MySQL as native binaries in the filesystem your editor is already in.
The trade is real: you do not get the exact same image as production. If byte-identical parity with a Linux container is your requirement, use the container. The full answer
Will it fight Herd, Valet or Local if I keep them?
It tries hard not to. Its ports are offset from the usual defaults — MySQL on 13306, Mailpit on 11025 and 18025 — and it never touches a server you installed yourself. Ports 80 and 443 are the exception, because a URL without a port number means them: if something else holds them, rexenv names what is holding them. On macOS it even recognises Local’s router by name.Running alongside other tools
Where do my sites live?
In ~/rexenv/Sites%USERPROFILE%\rexenv\Sites, unless you point the Sites folder elsewhere. A linked folder stays wherever you keep it — rexenv serves it in place and never copies or moves it. Where everything lives
What happens to my sites if I quit rexenv?
They keep serving. The services outlive the app, and rexenv adopts them again when you reopen it. Tunnels are the deliberate exception: a public share dies with the app, because a share you have forgotten about is one you did not consent to. Quitting and reopening
Free, native, and no Docker. The macOS build is the complete one — every web server, every database engine, Xdebug on five PHP versions. Windows 11 x64 and Ubuntu 22.04+ builds ship from the same release, each without a few components.
brew tap rexenv/tap
brew trust rexenv/tap
brew install --cask rexenv
Free, native, and no Docker. Sites, real HTTPS on .rex, seven PHP versions, MySQL, PostgreSQL, WordPress and mail — without Apache, FrankenPHP, Xdebug, Redis or MariaDB, which are not in the Windows build and say so rather than failing.
rexenv_0.8.13_x64-setup.exe — per-user, unsigned, and SmartScreen will say so once.
Free, native, and no Docker. Sites, real HTTPS on .rex, seven PHP versions, FrankenPHP, MySQL, PostgreSQL, WordPress and mail — without Apache, Xdebug, Redis or MariaDB, which are not in the Linux build and say so rather than failing.