envbouncer

🎯 Why?

AI coding agents and MCP servers often need environment variables, but giving them full shell or .env access risks leaking secrets. Existing guardrails mostly block dangerous shell commands or reduce context, but do not broker environment-variable access at runtime. EnvBouncer fills that gap with a declarative allowlist, redaction tooling, and an audit trail.

Target audience: Developers using Claude Code, Cursor, Codex, or custom MCP servers who want to grant agents limited access to environment configuration without exposing the entire .env file or shell environment.

✨ Features

• ✨ Declarative TOML allowlist for environment variables
• ✨ MCP tools for listing, reading, and redacting allowed variables
• ✨ CLI commands for init, check, redact, audit, and stdio MCP serving
• ✨ JSONL audit trail for reads, denials, missing variables, and redactions

🚀 Quick Start

# Install
pip install envbouncer

# Run
envbouncer --help

📦 Installation

From Source

git clone https://github.com/YOUR_USERNAME/envbouncer.git
cd envbouncer

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate

# Install in development mode
pip install -e ".[dev]"

# Run tests
pytest -v

🎬 Demo

The GIF above was recorded using Charm VHS:

vhs < demo.tape

📖 Usage

# Show help
envbouncer --help

# Common usage examples
envbouncer --example

🏗️ Architecture

graph LR
    A[Input] --> B[Core Engine]
    B --> C[Output]
    B --> D[Plugins]
    D --> E[Extensions]

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repo
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

📄 License

MIT © 2026 — See LICENSE for details.