Secrets & env vars
For a human hire: credentials and a keycard
Scoped env vars and secrets, encrypted with AES-256-GCM before they leave your machine. The server stores ciphertext it can never read.
Set up any coding agent, on any machine, in one command.
Every agent run starts from an empty sandbox — no secrets, no credentials, no context. Envo syncs the env vars, secrets, skills, and provider auth your agents need to any sandbox, container, or CI job, as an encrypted pack the server can never read. Works with Claude Code, Codex, and Cursor out of the box.
$ curl -fsSL https://envo.sh/install | sh
Everything an agent needs to do real work.
A new employee gets accounts, credentials, tools, and training on day one. Your agents get an empty sandbox. Envo closes that gap — four layers, one encrypted pack.
Identity
For a human hire: accounts and a badge
Each agent gets a scoped, pull-only token — expiring, revocable, sha256-hashed at rest. Every pull is on the record, so you always know which agent accessed what.
Skills
For a human hire: the handbook and training
Skills land exactly where each harness looks — .claude/skills, .agents/skills, .cursor/rules — so Claude Code, Codex, or Cursor starts already knowing how your team works.
Provider auth
For a human hire: IT setup
API keys and OAuth token files for Claude Code, Codex, and OpenCode — captured fresh at each push, auto-refreshed client-side, never stale.
Zero to working agent in one command.
envo agent create mints a scoped, revocable token and prints a one-line bootstrap. Paste that line into any sandbox, container, or CI job — the agent pulls its pack, decrypts it locally, and gets to work.
your machine — create the agent
$ envo agent create atlas --env unionstreet/prod
✓ atlas created
identity envo_agt_9f3c•••••••••••• pull-only · scoped to unionstreet/prod · revocable
bootstrap one line, works in any sandbox, container, or CI:
curl -fsSL https://envo.sh/install | sh && ENVO_TOKEN=envo_agt_9f3c… envo up unionstreet/prod
fresh container — nothing pre-installed
$ curl -fsSL https://envo.sh/install | sh && envo up unionstreet/prod
✓ pulled pack v12 — decrypted inside this container
✓ 12 secrets · 3 skills · provider OAuth fresh
✓ doctor — identity, badge, skills, provider auth: all present
✓ atlas is on the clock
Works everywhere your agents run.
The same one-line setup on every surface — same identity, same secrets, same skills. Also on Homebrew: brew install envo-sh/tap/envo.
Live proof, every day.
Don’t take our word for it. A public GitHub workflow sets up an agent from scratch every day — empty runner in, fully configured agent out. Anyone can watch it run.
Before — fresh runner
$ printenv DATABASE_URL ✗ no DATABASE_URL ✗ no provider auth · 0 skills
After — one step
- uses: Envo-sh/setup-envo@v1 ✓ DATABASE_URL=postgres://•••••••••• ✓ doctor — all checks passed
Your secrets never reach our servers in plaintext.
Six invariants hold on every push, pull, and deploy — enforced by an open-source client you can audit. Full detail in the spec.
Ciphertext-only server
Packs are encrypted with AES-256-GCM on your machine. The server stores ciphertext and never holds a key.
Context-bound crypto
Ciphertext is bound to its environment via AAD. Blocks cannot be spliced from one context into another.
Scoped, revocable identities
Agent tokens are pull-only, per-environment, expiring, and revocable — sha256-hashed at rest, with a full audit trail of every pull.
Fresh provider auth
OAuth token files are captured at each push and refreshed client-side. Agents never run on stale credentials.
Local credentials stay yours
Existing credentials on a machine are never overwritten. Envo adds; it does not clobber.
Checksummed releases
Every release ships with checksums, so what you install is what we built.
Pricing
Free on your own machines. Pay when you sync agents everywhere else.
Free
$0
The local CLI. Set up agents on your own machines.
- ✓Unlimited local packs
- ✓Encrypted packs and envo doctor
- ✓All four layers: secrets, identity, skills, provider auth
Solo
$10/mo
Unlimited agents and environments, hosted encrypted sync, full audit trail.
- ✓Unlimited agents and environments
- ✓Hosted encrypted sync — push once, set up anywhere
- ✓Full audit trail of every pull
- ✓Pack version history
Early pricing. Per-agent team pricing coming.
Start freeSandbox credits
$5+ prepaid
Deploy an environment as a hosted sandbox URL, decrypted at the edge.
- ✓Prepaid top-ups: $5, $20, $50
- ✓$0.05 per deploy, then $0.36/M requests + $0.024/M CPU-ms
- ✓1.2× Cloudflare's own rates
- ✓Prepaid, no surprise bills — sandboxes pause when your balance runs out
Set up your first agent in two minutes.
One command creates it. One line gives it everything it needs, on any machine it ever runs on.
Start free
envo agent create atlas