@arkenv/agent-plugin
Coding-agent plugin and MCP server for init and env audits.
Coding agents that support plugins can scaffold ArkEnv and audit
unvalidated env access without grepping the tree.
@arkenv/agent-plugin is that plugin: slash commands, a bundled skill,
and an MCP server.
Host cannot load plugins?
Use the Agent skill instead. The plugin already includes the skill, slash commands, and MCP. Do not install both.
Install
npx plugins add yamcodes/arkenvAsk the assistant to add ArkEnv. Slash commands /arkenv:init and
/arkenv:audit are optional shortcuts for the same MCP tools. You do
not run a second install command.
MCP-only hosts
If the host has no plugin marketplace, add the server to MCP config.
npx -y @arkenv/agent-plugin is the process the host spawns, not
a follow-up to plugins add.
{
"mcpServers": {
"arkenv": {
"command": "npx",
"args": ["-y", "@arkenv/agent-plugin"]
}
}
}Commands
Two slash commands wrap the CLI and the auditor. Parse JSON on stdout.
Do not pass --force unless a refusal's nextActions include a --force run-command.
/arkenv:init
Delegates to npx arkenv init --agent.
/arkenv:audit
Runs the TypeScript AST auditor. Each diagnostic includes file,
line, character, severity, ruleId, message, and
suggestedFix.
ruleId | Meaning |
|---|---|
unvalidated-access | process.env or import.meta.env outside env.ts |
secret-leak | Server-only key referenced from a client module |
prefix-violation | Public prefix on a secret-looking name |
legacy-ambient | v0 ProcessEnv / ImportMetaEnv .d.ts glob |
Valid import { env } from "./env" usage is not flagged.
Programmatic API
Call auditProject from tests or a local script when you don't want
MCP.
import { auditProject } from "@arkenv/agent-plugin";
const { diagnostics } = await auditProject(".");