Envlet for Claude Code
Add one MCP server and run the migrate prompt. Claude Code signs you in, creates the project, imports your .env files, and creates its own token with production withheld.
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Add the MCP server
One command registers the Envlet MCP server for every project on your machine.
Terminalclaude mcp add --scope user envlet -- npx -y @envlet/cli mcp - 02
Give it a token
Add Claude Code under Access in the dashboard, or let the migrate prompt do it. Its token opens one environment, and production starts fully withheld.
agent/claude-codeagentIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- production
- withheld
- 03
Run it through Envlet
Start Claude Code with envlet run. It sees the values its token allows and nothing else, and every read shows up under its name.
Terminalenvlet run -- claude
Migrate with one prompt
The migrate prompt runs the whole migration in Claude Code. Values never enter the chat.
- 01Signs you in if it has to. You approve in the browser.
- 02Creates the project with development, staging, and production.
- 03Finds every .env file and imports each one. No value enters the chat.
- 04Links the repository so every command knows its environment.
- 05Creates a token for your CI provider.
- 06Creates its own token. Production stays withheld until you name what it may read.
- 07Puts envlet run in front of your start scripts.
- 08Lists the names you can now delete from .env files, GitHub, Vercel, and AWS. Names only.
Questions
Can Claude Code read production secrets?
Not by default. A new agent grant withholds every current and future production variable. You allow specific names when you decide to.
Do agents count toward my plan?
No. Agents and CI jobs are unlimited on every plan. Only humans are members.