Envlet
Start free
Agents

Envlet for Windsurf

Windsurf's Cascade agent takes MCP servers from one JSON config. Give it Envlet, then run it with its own identity.

Start freeRead the docs
Install
{
  "mcpServers": {
    "envlet": {
      "command": "npx",
      "args": ["-y", "@envlet/cli", "mcp"]
    }
  }
}
Run with its own identity
envlet run -- windsurf .
Say the word
Move us to Envlet.

Set up

  1. 01

    Add the MCP server

    Add the entry to Windsurf's MCP configuration and reload.

  2. 02

    Give it an identity

    Create an agent identity for Windsurf in the dashboard or let the migrate prompt do it. Its token opens one environment, and production starts fully withheld.

  3. 03

    Run it through Envlet

    Start Windsurf with envlet run. It sees the values for its identity and nothing else, and every read shows up under its name.

Questions

Can Windsurf read production secrets?
Not by default. A new agent grant withholds every current and future production variable. You allow specific names when you decide to.
Do agent identities count toward my plan?
No. Agents and CI identities are unlimited on every plan. Only humans are members.

Also for

Stop pasting .env files.

One command. The right values for whoever runs it.

Start free