CLI reference

npm install -g @envlet/cli

The package installs the envlet command. Run envlet --help or envlet -h to print the command list.

The init, run, list, pull, and set commands must run inside a Git repository. init creates the repository selection that the other four commands use.

`envlet login`

Usage: envlet login

Start a browser login and save a credential for later CLI commands. The command prints a URL and a short code, then waits for you to approve the login in your browser.

Envlet saves the credential in ~/.envlet/credentials.json with file mode 0600. The command does not accept flags or arguments.

Example:

envlet login

`envlet mcp`

Usage: envlet mcp

Start the Envlet MCP stdio server for Claude Code, Cursor, or Codex. Protocol messages use stdout. The command does not accept flags or arguments.

See MCP server for client setup, tools, migration flow, and token handling.

`envlet init [--force]`

Usage: envlet init [--force]

Select a project and environment for the current Git repository. Envlet uses the credential saved by envlet login, asks you to select a project and environment, and writes .envlet at the repository root.

The .envlet file stores the selected project and environment names and stable IDs. Commit this file so each identity resolves the same project and environment.

With no flag, the command stops if .envlet already exists.
--force replaces the existing .envlet file.

Example:

envlet init

`envlet run -- <command> [arguments...]`

Usage: envlet run -- <command> [arguments...]

Resolve the variables allowed for the active identity and start a child command with them. The -- separator is required. Everything after it is the child command and its arguments.

The child inherits your current environment, except for ENVLET_TOKEN. Resolved Envlet values replace inherited values with the same names. The child uses your terminal input and output, and its exit status becomes the Envlet exit status.

Example:

export ENVLET_TOKEN="paste-the-token-here"
envlet run -- npm test

`envlet list [--values]`

Usage: envlet list [--values]

Resolve the active identity’s variables and print them in name order.

With no flag, the command prints variable names only.
--values prints each name and its JSON-quoted value as NAME="value". This can expose secrets in terminal output or logs.

Example:

envlet list --values

`envlet pull [--force]`

Usage: envlet pull [--force]

Resolve the active identity’s variables and write them to .env at the repository root. The file contains plaintext values and uses file mode 0600.

Envlet warns if Git tracks .env or if the root .gitignore does not ignore it. Load this file with a dotenv-compatible tool. Do not source it in a shell.

With no flag, the command stops if .env already exists.
--force replaces an existing regular .env file. It does not replace a symbolic link or another file type.

If a value cannot be written without changing it, the command stops. Use envlet run for that value because it does not write variables to disk.

Example:

envlet pull --force

`envlet set KEY=value [--as <identity>]`

Usage: envlet set KEY=value [--as <identity>]

Create or update a variable in the project and environment selected by .envlet. This command requires a manage credential.

With no flag, the command creates the shared variable or updates its shared value.
--as <identity> sets an override for one identity. The shared variable must already exist, and the identity must have a grant for the selected environment.

If ENVLET_TOKEN contains a resolve token, it still takes precedence over the saved login credential and set stops. Remove ENVLET_TOKEN or provide a manage token before you run the command.

Quote KEY=value when the value contains spaces or shell characters.

Example:

envlet set LOG_LEVEL=info
envlet set LOG_LEVEL=debug --as ci-preview