Envcp
- fentz26/EnvCP
envcp is an MCP server that provides an encrypted environment-variable vault with AI access policies for safer agent workflows.
About
EnvCP (envcp) is an encrypted environment-variable vault exposed as an MCP server so developers can separate secrets from codebase and chat logs while still automating deploy and integration tasks. Access policies define what an agent may read or inject, reducing the risk of accidentally pasting production keys into Claude or Cursor threads. Install via npm @fentz26/envcp, connect stdio MCP, and use it during ship security hardening, operate infra secret rotation, and build integrations when wiring third-party APIs. It complements host-level secret managers rather than replacing cloud KMS for large teams. Skillselion places it under ship → security because credential governance is the primary gate before launch.
- Encrypted environment variable vault designed for AI agent access with explicit policies
- npm package @fentz26/envcp v1.0.82 with stdio MCP transport
- Keeps secrets out of prompts and repos while still letting agents fetch allowed values at runtime
- GitHub-backed EnvCP project with MCP Registry schema 2025-12-11 listing
Envcp by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
claude mcp add envcp -- npx -y @fentz26/envcpAdd your badge
Show developers this MCP server is listed on Skillselion. Paste this into your README.
| Package | @fentz26/envcp |
|---|---|
| Transport | STDIO |
| Auth | None |
| Repository | fentz26/EnvCP ↗ |
What it does
Store API keys and env secrets in an encrypted vault while granting your agent policy-bound access instead of pasting.env into chat.
Who is it for?
Best when you use multiple AI agents and need centralized, policy-gated env secrets without a full enterprise vault contract.
Skip if: Organizations that already mandate a team-wide cloud secrets manager with audited RBAC and no local MCP bridge.
What you get
After EnvCP is configured, agents retrieve only policy-approved secrets from an encrypted vault, shrinking blast radius during ship and operate.
- Policy-scoped secret retrieval for agents
- Encrypted store separated from repository and chat
- stdio MCP bridge at envcp v1.0.82
By the numbers
- npm version 1.0.82
- Package: @fentz26/envcp
- Transport: stdio
Recommended MCP Servers
1Claw VaultHSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.2
1passwordMCP server for 1Password service accounts — tools and resources for vaults and credentials18
402sentinel McpAssess an x402 counterparty's risk BEFORE paying: allow/review/block, scored on-chain (Base).1
A2adependencyinspector McpRemote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi
A2a Governance Bridge McpA2A Governance Bridge MCP server.A2aidentitytoll McpRemote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.How it compares
Encrypted secrets MCP vault, not a generic .env linter skill or infrastructure deployer.
FAQ
Who is envcp for?
Developers and small teams who automate with AI agents but refuse to keep secrets in chat history or unencrypted repo files.
When should I use envcp?
Use it before ship when hardening access to API keys, and during operate when rotating credentials agents depend on.
How do I add envcp to my agent?
Install @fentz26/envcp from npm (v1.0.82), configure the vault and policies per EnvCP docs, and register the package as a stdio MCP server in Claude Code or Cursor.