Envlet for Replit
Replit Agent runs in the cloud. Give it a token in Replit Secrets and it reads its own environment at boot.
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Add the MCP server
Add ENVLET_TOKEN to Replit Secrets with a token created for Replit Agent, and call inject() at boot.
Terminalnpm install @envlet/sdk - 02
Give it a token
Add Replit under Access in the dashboard, or let the migrate prompt do it. Its token opens one environment, and production starts fully withheld.
agent/replitagentIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- production
- withheld
- 03
Run it through Envlet
Start Replit with envlet run. It sees the values its token allows and nothing else, and every read shows up under its name.
Terminalenvlet run -- npm start
Migrate with one prompt
The migrate prompt runs the whole migration in Replit. Values never enter the chat.
- 01Signs you in if it has to. You approve in the browser.
- 02Creates the project with development, staging, and production.
- 03Finds every .env file and imports each one. No value enters the chat.
- 04Links the repository so every command knows its environment.
- 05Creates a token for your CI provider.
- 06Creates its own token. Production stays withheld until you name what it may read.
- 07Puts envlet run in front of your start scripts.
- 08Lists the names you can now delete from .env files, GitHub, Vercel, and AWS. Names only.
Questions
Can Replit read production secrets?
Not by default. A new agent grant withholds every current and future production variable. You allow specific names when you decide to.
Do agents count toward my plan?
No. Agents and CI jobs are unlimited on every plan. Only humans are members.