Credentials. Anyone who can run Envlatch as your user can request saved keys, so lock your Mac and review paired agents.
Who it is forA developer who keeps API keys in plain .env files across many projects.
The problemPlain-text key files leak easily and give every process every key.
The outcomeProcesses that receive exactly the named keys from the Keychain.
What you need first
- macOS
- Swift toolchain to build from source
Steps
- Install with
git clone https://github.com/Raylinkh/envlatch.git,cd envlatchand./scripts/install.sh - Open the app and save your keys
- Run
envlatch run --using ANTHROPIC_API_KEY -- claude - Check setup with
envlatch doctor
Prompt for your agent
With Raylinkh/envlatch, launch <command> using `envlatch run --using <KEY_NAME> -- <command>` and confirm inside the process that only that key is set in the environment.
Caveat. No code change is needed because the launched process sees normal environment variables.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for Raylinkh/envlatch and "Launch a coding agent with only the key it needs"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer