Envibe

io.github.dominic-rightherePublished by GitHub account dominic-rightherev0.2.7Updated Oct 24, 2026

Secure permission layer between AI agents and your .env files

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that gives an AI coding assistant permission-controlled access to your .env environment variables instead of raw file access.

What you can do
  • List visible environment variables together with their access levels
  • Read a variable's value, subject to its permission level
  • Describe a variable's format and example value
  • Check which required variables are still missing
  • Set a variable's value, only where full access is granted
When to use it
Useful when an AI coding assistant needs to understand or help configure a project's environment variables but should not see every secret. It suits setups where you want per-variable control over what the assistant can read, modify, or only see as a placeholder.
Requirements
Runs as a local process via npx from the npm package envibe-mcp, so Node.js and network access for the package are needed. No authentication, environment variables or headers are declared. On first run it creates a manifest from .env.example, generates a filtered .env.ai view, and blocks direct .env access.
Before you install
It reads and can modify your .env values, and env_set writes changes for variables marked full access. On first run it creates files in the project and blocks direct .env access, which changes how other tools reach that file. Review the access levels assigned to each variable before letting an assistant use it.

Installation

In SourceWeft

  1. Open Envibe in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

envibe-mcp

[npm version] [License: MIT]

MCP server for envibe - the missing permission layer between AI agents and your .env.

Install

Add to your AI tool's MCP config:

json
{  "mcpServers": {    "envibe": {      "command": "npx",      "args": ["envibe-mcp"]    }  }}
Claude Code
bash
claude mcp add envibe npx envibe-mcp
Claude Desktop

Add to claude_desktop_config.json:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
VS Code / Cursor / Windsurf

Add to your editor's MCP settings (see main envibe docs for details).

On first run, envibe automatically:

  1. Creates .env.manifest.yaml from your .env.example
  2. Generates .env.ai (filtered view for AI)
  3. Blocks direct .env file access

What is this?

This is the MCP server component of envibe. It gives AI coding assistants controlled access to your environment variables with 5 access levels:

LevelAI Can SeeAI Can Modify
fullActual valueYes
read-onlyActual valueNo
placeholder<VAR_NAME>No
schema-onlyFormat onlyNo
hiddenNothingNo

MCP Tools

ToolDescription
env_listList visible variables with access levels
env_getGet a variable's value (respects permissions)
env_setSet a variable (only full access)
env_describeGet detailed info including format and example
env_check_requiredCheck which required variables are missing

v0.2.0 Features

  • Better error messages - When access is denied, get helpful guidance
  • Format hints - Know what format a variable should be (url, key, number, etc.)
  • Required var checking - Use env_check_required to guide users through setup

For CLI tools

If you need CLI commands like envibe setup -i (interactive mode), envibe view, or envibe generate, install the full package:

bash
npm install -g envibe

License

MIT

Source: README.md at commit 08e2850

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.7LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.