EnvCP

Secure Environment Variable Management for AI agent

EnvCP lets you safely use AI agent without exposing your secrets.
Your API keys and environment variables stay encrypted on your machine — AI only references them by name.

Installation

npm

npm install -g @fentz26/envcp

curl

curl -fsSL https://envcp.fentz.dev/install.sh | bash

Use without installing

npx @fentz26/envcp init

Quick Start

# 1. Initialize in your project
envcp init

# 2. Add your secrets
envcp add API_KEY --value "your-secret-key"
envcp add DATABASE_URL --value "postgres://..."

# 3. Start the server (auto-detects client type)
envcp serve --mode auto --port 3456

Basic CLI Commands

# Variable Management
envcp add <name> [options]    # Add a variable
envcp list [--show-values]    # List variables
envcp get <name>              # Get a variable
envcp remove <name>           # Remove a variable

# Session Management
envcp unlock                  # Unlock with password
envcp lock                    # Lock immediately
envcp status                  # Check session status

# Sync and Export
envcp sync                    # Sync to .env file
envcp export [--format env|json|yaml]

Why EnvCP?

• Local-only storage — Your secrets never leave your machine
• Encrypted at rest — AES-256-GCM with PBKDF2 key derivation (100,000 iterations)
• Reference-based access — AI references variables by name, never sees the actual values
• Automatic .env injection — Values can be automatically injected into your .env files
• AI Access Control — Block AI from proactively listing or checking your secrets
• Universal Compatibility — Works with any AI tool via MCP, OpenAI, Gemini, or REST protocols

Integration Guides

Claude Desktop / Cursor / Cline (MCP)

Add to your MCP config file:

{
  "mcpServers": {
    "envcp": {
      "command": "npx",
      "args": ["@fentz26/envcp", "serve", "--mode", "mcp"]
    }
  }
}

ChatGPT / OpenAI API

envcp serve --mode openai --port 3456 --api-key your-secret-key

import openai

client = openai.OpenAI(
    base_url="http://localhost:3456/v1",
    api_key="your-secret-key"
)

# Call a function
result = client.post("/functions/call", json={
    "name": "envcp_get",
    "arguments": {"name": "API_KEY"}
})

Gemini / Google AI

envcp serve --mode gemini --port 3456 --api-key your-secret-key

import requests

# G

... [View full README on GitHub](https://github.com/fentz26/EnvCP#readme)