Your agent needs the secrets, not the file

Yes, and it is important to be exact about this rather than sell you a guarantee that does not hold. envless run puts decrypted values into the child process environment, so anything that can execute the wrapped command can also read that environment. What changes is that there is no plaintext file in the repository: nothing for the agent to open while reading your code, nothing to include in a summary, nothing to commit. You are removing the accidental disclosure path, not sandboxing the process.

No. There is no MCP integration today, and we would rather say so than imply one exists. The integration surface an agent actually uses is the shell: it runs the commands in your package.json, and if those commands are wrapped with envless run, the agent gets working secrets with no further integration at all.

No. There is one machine credential shape, the ev_sk_ API key, and an agent key is a normal key you scoped narrowly. That means the controls you have are real ones: per-resource read/write scopes, a project allowlist, a clamp so a key can never outrank its creator, and immediate revocation. What it does not mean is a separate agent identity in the audit trail, which is the next question.

Not at key granularity. Events record the acting user, and a key's actions are attributed to the human who owns it, so two keys owned by the same person are indistinguishable in the record. If you need to tell agents apart, give each one a key owned by a distinct service account rather than by a shared human account. We would rather you design around this than assume a distinction the data does not carry.

No. Keys live until you deactivate or delete them; there is no TTL, no automatic rotation, and no expiry field. What you do get is lastUsedAt, stamped on every authenticated request, so you can see whether a key has gone quiet before revoking it. Revocation takes effect on the next request, with no grace period.

Nothing in Envless, and you should plan for that. There is no redaction layer over a child process's stdout, and nothing inspects model input or output for prompt injection. Envless narrows what the agent can reach, through read-only scopes and a project fence, and removes the file that makes casual disclosure easy. Treat the process environment itself as visible to whatever runs inside it.

A key with variables:read and nothing else, fenced with projectIds to the single project it works on, pointed at a development or staging environment rather than production, paired with ENVLESS_KEY rather than a passphrase so no human-chosen string is in the environment. Then wrap the project scripts so the agent never needs to reason about credentials, and keep the production environment on a key it does not hold.

A gitignored .env is still a plaintext file in the working directory, which is exactly what an agent reads. It also still has to reach every developer and every CI runner somehow, which in practice means a chat message or a shared vault entry. Envless removes both problems at once: no file in the tree, and one encrypted source of truth that a scoped key reads at run time.