For WordPress, Laravel & PHP developers

Local WordPress & PHP, from one calm command room.

Sites, 7 PHP versions, databases, real HTTPS and every outgoing mail caught — native on macOS, Windows and Linux. No Docker. Free and open source.

The app is not notarized yet, so its first open from a browser download meets Gatekeeper. The command below meets no dialog. Why?

Also for

macOS 13+ · universal · Intel and Apple Silicon · v0.8.13

Or in a terminal
curl -fsSL https://rexenv.rex.bd/install.sh | bash

The installer is unsigned, so SmartScreen warns before it runs. The command below meets no dialog. Why?

Also for

Windows 11 x64 · per-user install · no admin for setup · v0.8.13

Or in PowerShell
irm https://rexenv.rex.bd/install.ps1 | iex

No signing dialog: the command adds rexenv’s signed apt repository and installs from it, dependencies included. How it installs

Also for

Ubuntu 22.04+ · x86_64 and arm64 · apt, .deb or AppImage · v0.8.13

Or in a terminal
curl -fsSL https://rexenv.rex.bd/install.sh | bash
All running

Sites

4 sites · 3 running

+ New site
  • WShopshop.rexRunning
  • LAPIapi.rexRunning
  • WDocs sitedocs.rexRunning
  • PLegacy toolslegacy.rexStopped by you
Example — click around. Rebuilt from the app's own design tokens, not a screenshot. An example of the rexenv window with a sidebar of pages — Sites, Services, Databases, Import, Mail, Tunnels and Settings — that can be switched between. It starts on Sites: four sites, three running and one stopped by its user.
PHP versions, per site
7
7.4.33 – 8.5.8
Database engines
4MySQL, MariaDB, PostgreSQL and Redis
2MySQL and PostgreSQL
Operating systems
3
macOS, Windows and Linux
rex CLI commands
60+
each with an AI-agent tool twin

Who it is for

Built for WordPress. Just as much at home with Laravel.

WordPress

A new WordPress site is one click, not an afternoon.

  • WordPress downloaded, installed and served on https://name.rex with a trusted certificate
  • wp-admin opens already logged in — one click, no password to remember
  • Plugins and themes from wp.org, a zip, a git clone or a folder on your disk
  • Multisite, subdomain or subdirectory
  • Every email caught by Mailpit — password resets and order confirmations never reach a real inbox
  • Share a site on a public URL, with the URL rewriting WordPress needs
The WordPress manager →

Laravel & PHP

Every site keeps its own PHP version, switched in one click.

  • A Laravel or blank PHP site — or serve a folder you already have, in place, never copied
  • Clone a site straight from a git repository
  • 7 PHP versions, 7.4 to 8.5, each pinned to an exact build
  • MySQL and PostgreSQL, chosen per site — MariaDB and Redis too
  • Composer always runs through the site’s own PHP
  • The rex CLI: logs with --follow, database export and import, rex doctor
Creating a site →

What you get

One app instead of nine.

HTTPS that just works

A real lock on https://yoursite.rex, signed by a local authority that never leaves your machine. No warning page, no port number, no hosts file — a DNS resolver on macOSan NRPT rule on Windowsa dummy network link on Linux sends .rex home.

7 PHP versions

From 7.4.33 to 8.5.8, switchable per site in one click, on all three operating systems. Versions past their security-end date are badged wherever they appear.

Every mail caught

Password resets, order confirmations, plugin notifications. They all land in Mailpit, and none of them reach a real inbox.

Share it publicly

A Cloudflare quick tunnel puts a local site on a public URL, outbound-only, with the URL rewriting WordPress needs. It dies when you quit — a share you forgot about is one you did not consent to.

The rex CLI

Over 60 commands driving the running app over a private socket: site lifecycle, logs with --follow, PHP and Xdebug switches, database export and import.

Off until you turn it on

Your coding agent can drive it too

Every rex command has an MCP tool. An agent can make a throwaway WordPress site, install the plugin you are writing, run WP-CLI against it and read the mail it sent. One dial decides how far it may go with the sites you made yourself.

claude mcp add rexenv -- rex mcp
Readlook, and make scratch sitesChangeschange how your sites are servedFulldelete, publish, run code
What an agent can and cannot do →

Databases, per site

Chosen per site. Each engine keeps a separate data directory per version series, so switching is never an in-place upgrade. MariaDB and Redis are macOS-only; MySQL and PostgreSQL ship everywhere.

MySQL8.4.6 · 8.0.44:13306
MariaDB12.3.2 · 11.4.12macOS only
PostgreSQL18.6.0 · 17.11.0 · 16.15.0:15432
Redis8.8.0macOS only

The pictures in these cards are examples, built from the app's own design tokens — not screenshots.

Honest status

Every dot is derived from a probe.

Not from what the app asked for, and not from a port that happens to be listening. A service is running when rexenv owns the process and the process answers — anything less shows as unknown rather than as green.

That rule is one of about a dozen the interface follows, each written down because a screen once lied to somebody.

Read the honest-UI rules →
ServicesExample
  • Edge proxycaddy · :80, :443running
  • Web servernginx · :18088running
  • PHP 8.4php-fpm · :9784running
  • MySQL 8.4mysqld · :13306running
  • PostgreSQLpostgres · :15432running
  • Redisnot startedstopped

Honest UI

Rules the interface follows, written down.

  • Status derives from reality — never from what we asked for.
  • Progress moves only on real completions. Failure freezes the bar — it never rolls back.
  • A counter that cannot advance is not shown at all.
  • A control whose only outcome is an error is not rendered.

Each one exists because a screen lied to somebody once. They are the reason rexenv sometimes shows you less than another tool would.

Read all of them →

Bring your sites

macOS only, for now

Coming from Herd, Valet or Local?

rexenv finds your sites where the old tool keeps them and brings them over in four stages, each one opt-in. The old tool is strictly read-only throughout — rexenv reads its setup and never writes to it, so you can keep using it while you decide.

  • Laravel HerdSites, PHP pins, databases
  • Laravel ValetParked and linked sites
  • LocalWordPress sites, by WP Engine

The Windows and Linux builds do not look for another tool's sites yet, and the Import page says so rather than reporting "no sites found" about folders nobody searched. Linking an existing folder works everywhere.

Run both for a while if you like: rexenv's ports are offset from the usual defaults. Only ports 80 and 443 cannot be shared, so one tool serves at a time.

Read the migration guide, Local included →
  1. 1Scanrexenv lists what it found — sites, paths, PHP versions, domains. Nothing is imported because it was found.
  2. 2ImportThe sites you choose are created pointing at the same folders. Your code is not copied.
  3. 3Copy the databasesDumped from the old server and restored into rexenv’s. Both copies exist afterwards.
  4. 4Rewrite connection configA diff of exactly what changes in wp-config.php or .env, and a backup first. Optional for Valet and Herd; ticked by default for Local.

Coming from Local

rexenv refuses .local — shadowing it breaks Bonjour — so a Local site is re-homed onto your default TLD as it comes in. Its database is copied from Local's own server, which runs only while that site is started in Local; rexenv never starts or stops it for you. Connecting is ticked by default for Local sites, because under rexenv they read no database until they are.

Install

One command. Nothing to click past.One command. No SmartScreen, no admin.One command. apt brings the rest.

Terminal
curl -fsSL https://rexenv.rex.bd/install.sh | bash
  • No Gatekeeper step. Gatekeeper checks a file carrying the quarantine attribute, and the downloading app sets it — a browser does, curl does not. rexenv opens the first time.
  • Checked before it installs. The download must match the release's own .sha256, then rexenv.app goes into Applications and opens.
  • Already installed? Nothing changes. rexenv updates itself from Settings → About.
  • It is short — read install.sh before you run it. Running it is your decision to trust this source, as trusting the tap is.
PowerShell
irm https://rexenv.rex.bd/install.ps1 | iex
  • No SmartScreen dialog. SmartScreen checks a file a browser marked as downloaded — the Mark of the Web — and PowerShell's download writes no mark.
  • No administrator prompt. The installer runs silently for your user only, after the download matches the release's .sha256, and adds a Start-menu and a desktop shortcut.
  • Already installed? Nothing changes. rexenv updates itself from Settings → About.
  • Smart App Control, where it is on, still blocks unsigned apps — no command changes that. It is short — read install.ps1 before you run it.
  • rex on your Path — a copy under %LOCALAPPDATA%\rexenv\bin, added to your user Path by the app. A copy rather than a symlink, because creating a symlink on Windows needs a privilege an ordinary account may not have.
  • Updating later is in-app — Settings → About offers the new version, verifies its signature and checksum, and swaps the install directory while rexenv is running.
  • Five components are not in this build — Apache, FrankenPHP, Xdebug, Redis and MariaDB. Each is refused with a message naming the reason, not offered and then broken.
Terminal
curl -fsSL https://rexenv.rex.bd/install.sh | bash
  • Through apt, dependencies included. The script adds rexenv's apt repository and installs the rexenv package for your architecture — amd64 or arm64 — so WebKitGTK, the tray library, certutil and the database libraries come with it. sudo asks for your password in the terminal.
  • Signed, and checked before it installs. apt verifies the repository's signature against the key the script carries. While the repository lags a brand-new release, the script installs that release's .deb instead, after it matches the release's own .sha256.
  • Updates arrive with sudo apt upgrade too. The same package the in-app update installs.
  • No apt? It puts the AppImage in ~/Applications instead — untested outside Ubuntu.
  • Already installed? The package is left alone. rexenv updates itself from Settings → About; the script only adds the apt repository if it is not configured yet.
  • It is short — read install.sh before you run it.
  • rex on your PATH — the .deb installs it as /usr/bin/rex, beside the app.
  • Updating later is in-app — Settings → About. A .deb is installed with one password prompt; an AppImage is swapped with none.
  • Four components are not in this build — Apache, Xdebug, Redis and MariaDB. Each is refused with a message naming Linux, not offered and then broken. FrankenPHP ships.

The pinned stack

Every version, written down.

Nothing here is "latest". Every binary is pinned to an exact version and locked to a checksum, downloaded on demand from its own upstream and prepared for your machine. You can read what you are about to run before you run it. The Windows build is the same versions from different publishers, and five rows below are not in it — they are dimmed and named rather than quietly dropped.The Linux build is the same versions, native for x86_64 and arm64, and four rows below are not in it — they are dimmed and named rather than quietly dropped.

PHP

Seven versions. Switch a site between them in one click — no rebuild of docroot, certificate or database.

PHP8.5.8 · 8.4.23 · 8.3.32 · 8.2.32 · 8.1.34rexenv's own builds on macOS, with PDO PostgreSQL; php.net's on Windows, static-php.dev's on Linux. Per-site switch, per-version php.ini editorXdebug 3.5.3 · macOS
PHP 8.08.0.30The one PHP rexenv does not build — static-php.dev's, and past its security-end dateOn macOS 13: not available — the app says which macOS it needsEOL · no Xdebug · no PostgreSQL
PHP 7.47.4.33rexenv's own reproducible build, on macOS and Linux — static-php.dev publishes no 7.4EOL · no Xdebug · no PostgreSQL

Web servers

One shared Nginx serves every site by default. Override per site when a project needs something else.

Nginx1.30.4Shared, one server block per site. rexenv's own buildDefault
FrankenPHP1.12.4Per-site override; embeds its own PHPNot on Windows
Apache httpd2.4.68Per-site override with working .htaccessOn macOS 13: 2.4.65Not on WindowsNot on Linux
OpenLiteSpeed1.9.3Per-site override with .htaccess and LSCache. rexenv's own buildNot on Windows
Caddy2.11.4The edge — TLS termination on :80 and :443

Databases

Chosen per site at create time. Each engine keeps a separate data directory per version series, so switching is never an in-place upgrade.

MySQL8.4.6 · 8.0.44On macOS 13: 8.4.3 · 8.0.40:13306
MariaDB12.3.2 · 11.4.1211.4 is the LTS seriesOn macOS 13: 12.0.2 · 11.4.8Not on WindowsNot on Linux:13307
PostgreSQL18.6.0 · 17.11.0 · 16.15.0A site database for Laravel and blank PHP on PHP 8.1+On macOS 14: 16.4.0On macOS 13: not available — the app says which macOS it needsNot for WordPress:15432
Redis8.8.0On macOS 13: 8.2.1Not on WindowsNot on Linux:16379

Tools

Bundled, pinned, and checksum-locked like everything else.

WP-CLI2.12.0Powers the WordPress manager and `rex wp`
Composer2.10.2Always run through the site's own PHP
Adminer6.1.1Deep-linked into the site's database
Mailpit1.30.3Catches every outgoing mail:11025 / 18025
cloudflared2026.6.1Quick tunnels, outbound-onlyOn macOS 14: 2025.4.0On macOS 13: 2025.4.0
Xdebug3.5.3PHP 8.1–8.5 only; your IDE listens on 9003. On macOS 13, PHP 8.1–8.4 onlyOn macOS 13: 3.4.5Not on WindowsNot on Linux

Ports are offset from the usual defaults on purpose, so rexenv never collides with a server you already run.

What it costs

Free. All of it.

rexenv is open source and earns nothing. There is no Pro version to upgrade to, and no account to make before you can use it.

Read the source on GitHub
  • No paid tierMail catching, every database engine, tunnels, the CLI and the agent endpoint are in the one build everyone downloads.
  • Apache License 2.0The source is public — the same repository every release is published from and issues are filed on.
  • Nothing reports your usageComponents are downloaded from their upstreams on first use, checksum-verified. The local certificate authority never leaves your machine.

Before you install

The things worth knowing first.

macOS

13 (Ventura) or later — 15 for everything

Intel or Apple Silicon — one universal build. On macOS 13 a few components are older builds and PostgreSQL and PHP 8.0 are refused by name; 14 differs from 15 in two rows. Read the requirements

First run

Internet required, up to ~600MB

rexenv downloads its components on demand rather than bundling them, checksum-verified. After that it works offline. What gets downloaded

Permissions

Three prompts, once

An admin password for the DNS resolver, a Keychain prompt to trust a local CA that signs only your sites, and an admin password to bind ports 80 and 443. What each prompt writes

Where it lives

The menu bar — no dock icon

Closing the window hides it and stops nothing; Quit is in the menu-bar menu. The rex CLI and the agent endpoint are remote controls for the running app, so a close that quit used to take them down. The menu bar

Uninstalling

One in-app step first

Settings → Remove system changes, then delete the app. Dragging it to the Bin leaves a root daemon holding port 443. How to uninstall

Windows

11 x64

Windows 10 22H2 is best-effort — it left mainstream support in October 2025. arm64 is unsupported: the x64 build runs under emulation, but PHP publishes no arm64 Windows build and PostgreSQL’s portable build is x64 only, so there is nothing native to ship. Read the requirements

The installer

Unsigned — SmartScreen speaks first

rexenv is open source and earns nothing, so it buys no code-signing certificate. Windows shows “Windows protected your PC” and Run anyway is behind More info. The installer itself is per-user, about 37MB, and asks for no administrator approval. What the dialogs say, word for word

First run

Internet required, then two prompts

rexenv downloads its components on demand, checksum-verified, then asks twice: one UAC prompt for the .rex DNS rule, and Windows’ own certificate dialog to trust a local CA in your user’s Root store. There is no third prompt — the edge binds 80 and 443 unelevated. What each prompt writes

Where it lives

The tray — left-click opens it

Left-click the tray icon for the window, right-click for the menu — the reverse of macOS, because that is what Windows users expect. Closing the window does not quit rexenv; Quit is in the tray menu. The tray

Not in this build

Five components

Apache, FrankenPHP, Xdebug, Redis and MariaDB are refused with a message that says why, rather than offered and then failing. MySQL 8.4 and 8.0 both ship, so a database is there either way. What ships on Windows

Uninstalling

One in-app step first

Settings → Remove system changes — one UAC prompt, removing the NRPT rules, the \rexenv\dns-agent scheduled task, the CA trust and the rex copy on your Path. Then remove the app. How to uninstall

Linux

Ubuntu 22.04 LTS or newer

x86_64 or arm64, a native build for each. 22.04 is the first LTS with libwebkit2gtk-4.1, which the app’s window needs, so the one-command installer refuses 20.04 with a sentence saying so. Other distributions with systemd-resolved and polkit will probably work; none has been tested. Read the requirements

The package

apt — a signed repository — or an AppImage

The one command adds rexenv’s apt repository and installs the rexenv package from it, so its dependencies come with it, sudo apt upgrade sees later versions, and sudo asks for your password in the terminal. Without apt it puts the AppImage in ~/Applications. The repository is signed with rexenv’s own key; the app carries no code-signing certificate — rexenv earns nothing — and every file on a release has a .sha256 beside it. Every install route

First run

Internet required, then two polkit prompts

rexenv downloads its components on demand, checksum-verified. Then your desktop’s password dialog asks twice: once for the .rex DNS route and the local CA in the system store together, once for the web server on ports 80 and 443. Your browsers’ own certificate databases need no prompt. What each prompt writes

Where it lives

The tray — any click opens the menu

An appindicator icon in the top bar has no click of its own, so its menu is the whole interaction: Open rexenv is there, and Quit. Closing the window does not quit rexenv. The tray

Not in this build

Four components

Apache, Xdebug, Redis and MariaDB are refused with a message naming Linux, rather than offered and then failing — Homebrew’s Linux builds of them are x86_64 only and unrelinked. FrankenPHP, all seven PHP versions, MySQL and PostgreSQL ship. What ships on Linux

Uninstalling

One in-app step first

Settings → Remove system changes — one password dialog, removing the DNS route, the edge unit and its root folder, both certificate trusts, the DNS agent and the rex link. Then sudo apt remove rexenv, or delete the AppImage. How to uninstall

Questions

Asked before installing.

Is it really free?

Yes. rexenv is licensed under the Apache License 2.0, the source is public, and there is no paid tier — nothing on this page is held back for one. Free and open source

Does it run on Windows and Linux?

Yes — Windows 11 x64, and Ubuntu 22.04 or newer on x86_64 and arm64. Each build leaves a few components out and refuses them by name rather than offering them and failing: six on Windows (FrankenPHP, Apache httpd, OpenLiteSpeed, MariaDB, Redis and Xdebug), four on Linux (Apache httpd, MariaDB, Redis and Xdebug). The requirements, per platform

Why no Docker?

On a Mac or a PC, Docker means a Linux VM, and a VM means a filesystem boundary between your editor and your code — where the latency comes from and where file watchers stop firing. rexenv runs nginx, PHP and MySQL as native binaries in the filesystem your editor is already in.

The trade is real: you do not get the exact same image as production. If byte-identical parity with a Linux container is your requirement, use the container. The full answer

Will it fight Herd, Valet or Local if I keep them?

It tries hard not to. Its ports are offset from the usual defaults — MySQL on 13306, Mailpit on 11025 and 18025 — and it never touches a server you installed yourself. Ports 80 and 443 are the exception, because a URL without a port number means them: if something else holds them, rexenv names what is holding them. On macOS it even recognises Local’s router by name. Running alongside other tools

Where do my sites live?

In ~/rexenv/Sites%USERPROFILE%\rexenv\Sites, unless you point the Sites folder elsewhere. A linked folder stays wherever you keep it — rexenv serves it in place and never copies or moves it. Where everything lives

What happens to my sites if I quit rexenv?

They keep serving. The services outlive the app, and rexenv adopts them again when you reopen it. Tunnels are the deliberate exception: a public share dies with the app, because a share you have forgotten about is one you did not consent to. Quitting and reopening

Every question in the FAQ →

Your whole stack, in about a minute.

Free, native, and no Docker. The macOS build is the complete one — every web server, every database engine, Xdebug on five PHP versions. Windows 11 x64 and Ubuntu 22.04+ builds ship from the same release, each without a few components.

brew tap rexenv/tap
brew trust rexenv/tap
brew install --cask rexenv

Free, native, and no Docker. Sites, real HTTPS on .rex, seven PHP versions, MySQL, PostgreSQL, WordPress and mail — without Apache, FrankenPHP, Xdebug, Redis or MariaDB, which are not in the Windows build and say so rather than failing.

rexenv_0.8.13_x64-setup.exe — per-user, unsigned, and SmartScreen will say so once.

Free, native, and no Docker. Sites, real HTTPS on .rex, seven PHP versions, FrankenPHP, MySQL, PostgreSQL, WordPress and mail — without Apache, Xdebug, Redis or MariaDB, which are not in the Linux build and say so rather than failing.

curl -fsSL https://rexenv.rex.bd/install.sh | bash