Envlet for GitHub Copilot

Copilot agent mode in VS Code reads MCP servers from .vscode/mcp.json. Commit that file and every teammate's Copilot gets the same tools.

envlet run -- code .production withheld

Set up

Three steps. The host keeps one secret and everything else arrives at boot.

Add the entry to .vscode/mcp.json in the repository.

.vscode/mcp.json

{
  "servers": {
    "envlet": {
      "command": "npx",
      "args": ["-y", "@envlet/cli", "mcp"]
    }
  }
}

02
Give it a token
Add GitHub Copilot under Access in the dashboard, or let the migrate prompt do it. Its token opens one environment, and production starts fully withheld.
agent/copilotagent
Its own token, separate from your login.
token
envlet_•••••••• shown once
opens
one project, one environment
expires
always
production
withheld
03
Run it through Envlet
Start GitHub Copilot with envlet run. It sees the values its token allows and nothing else, and every read shows up under its name.
Terminal
envlet run -- code .

The migrate prompt runs the whole migration in GitHub Copilot. Values never enter the chat.

GitHub Copilotenvlet mcp

Move us to Envlet.

01Signs you in if it has to. You approve in the browser.
02Creates the project with development, staging, and production.
03Finds every .env file and imports each one. No value enters the chat.
04Links the repository so every command knows its environment.
05Creates a token for your CI provider.
06Creates its own token. Production stays withheld until you name what it may read.
07Puts envlet run in front of your start scripts.
08Lists the names you can now delete from .env files, GitHub, Vercel, and AWS. Names only.

Can GitHub Copilot read production secrets?

Not by default. A new agent grant withholds every current and future production variable. You allow specific names when you decide to.

Do agents count toward my plan?

No. Agents and CI jobs are unlimited on every plan. Only humans are members.

One command. The right values for whoever runs it.