RunEnv AI Agent Integration (MCP)

Secure, time-scoped, and audit-logged secret access for your AI companions (Claude, Cursor, etc.) via the Model Context Protocol.

🚀 Quick Start Guide

If you want to give your AI agent secure access to your environment variables without copy-pasting .env files into chat, you are in the right place!

1. Generate an Agent Token

First, you need a specialized Agent Token. Do not use a standard Service Token (rtk_...) for AI agents.

1. Open your RunEnv Dashboard.
2. Navigate to your Project and go to the MCP Agents panel.
3. Click "Create Agent Session" or "Generate Agent Token".
4. Copy the token. It will always start with rma_ (RunEnv MCP Agent).

2. Configure Your AI

You don't need to install anything globally, you can just use npx directly in your AI's configuration file!

For Claude Desktop

Open your Claude config file:

• Mac: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the runenv server to your mcpServers object:

{
  "mcpServers": {
    "runenv": {
      "command": "npx",
      "args": ["-y", "runenv-mcp"],
      "env": {
        "RUNENV_TOKEN": "rma_your_token_here",
        "RUNENV_API_URL": "https://runenv.dev"
      }
    }
  }
}

⚠️ Important: After saving the file, you must fully quit and restart Claude Desktop, and click New Chat to ensure the tools are loaded into the chat context.

For Cursor

1. Go to Cursor Settings > Features > MCP.
2. Click + Add new MCP server.
3. Name it runenv, select command type, and enter: npx -y runenv-mcp.
4. Add the necessary environment variables (RUNENV_TOKEN and RUNENV_API_URL).

🛠️ How it Works & Available Tools

To ensure your environment stays incredibly secure, your AI Agent cannot just read all your secrets immediately. It must explicitly request time-scoped permission first!

This server exposes exactly three tools to the AI:

| Tool | What it does | |------|-------------| | runenv_list_secrets | Lists the names of the available secret keys in the environment (but NOT their values). | | runenv_request_access | The AI must call this to request temporary "Just-In-Time" access to specific keys. This generates a detailed audit log in your RunEnv Dashboard. | | runenv_read_secret | Reads the decrypted value of a secret (Only works after temporary access has been granted!). |

Recommended Prompts

Because the AI needs to know which environment to request access for, use specific prompts like this:

"I need to debug the database for the production environment. Please use your tools to request access to the DATABASE_URL."

🔐 End-to-End Encryption (E2EE)

If your RunEnv project has strict End-to-End Encryption enabled, the AI will need your Project Key to decrypt the secret values locally on your machine. Simply append the project key to the end of your token separated by a dot:

"RUNENV_TOKEN": "rma_your_token_here.YOUR_PROJECT_KEY"

License

Proprietary