@arkenv/agent-plugin
Coding-agent plugin and MCP server for init and env audits.
@arkenv/agent-plugin is the installable ArkEnv plugin for coding
agents. It ships slash commands, a bundled skill, and an MCP server that
scaffolds projects and audits source for unvalidated env access.
Install the plugin. It already includes the skill, slash commands, and MCP. Use the Agent skill only when the host cannot load plugins. Do not install both.
Install
npx plugins add yamcodes/arkenvpnpm dlx plugins add yamcodes/arkenvyarn dlx plugins add yamcodes/arkenvbunx plugins add yamcodes/arkenvAsk the assistant to add ArkEnv. Slash commands /arkenv:init and
/arkenv:audit are optional shortcuts for the same MCP tools. You do
not run a second install command.
MCP-only hosts
If the host has no plugin marketplace, add the server to MCP config.
npx -y @arkenv/agent-plugin is the process the host spawns, not
a follow-up to plugins add.
{
"mcpServers": {
"arkenv": {
"command": "npx",
"args": ["-y", "@arkenv/agent-plugin"]
}
}
}Commands
Two slash commands wrap the CLI and the auditor. Parse JSON on stdout.
Do not pass --force unless a refusal's nextActions include a --force run-command.
/arkenv:init
Delegates to npx arkenv init --agent.
/arkenv:audit
Runs the TypeScript AST auditor. Each diagnostic includes file,
line, character, severity, ruleId, message, and
suggestedFix.
ruleId | Meaning |
|---|---|
unvalidated-access | process.env or import.meta.env outside env.ts |
secret-leak | Server-only key referenced from a client module |
prefix-violation | Public prefix on a secret-looking name |
legacy-ambient | v0 ProcessEnv / ImportMetaEnv .d.ts glob |
Valid import { env } from "./env" usage is not flagged.
Programmatic API
Call auditProject from tests or a local script when you don't want
MCP.
import { auditProject } from "@arkenv/agent-plugin";
const { diagnostics } = await auditProject(".");