EnvRelay
An Agent Skill for macOS and Linux

Your whole dev setup, on your next machine.

EnvRelay teaches your coding agent to move a development machine. It finds your dotfiles, keys, repositories, software and AI agent setup, packs what you approve into one encrypted file, and puts it all back on the new machine.

curl -fsSL https://envrelay.com/install.sh | sh

No sudo. Every download is checked against the release's SHA256SUMS. Read the script

Then ask your coding agent

On the old machineBack up this machine with EnvRelay.
On the new oneRestore my environment from backup.envrelay.

Watch it move a machine

Install once, then ask in your own words. The agent does the work; you approve what it proposes and type the passphrase yourself.

It proposes. You decide.

The agent goes through the machine the way you would with a free afternoon, and leaves behind whatever can be rebuilt.

Dotfiles and config

Shell, git and editor config, ~/.config, package-manager settings. Caches, node_modules and build output stay behind.

Credentials

SSH keys, cloud CLIs, tokens. Each one named for your OK, copied without being read, restored at 0600.

Git repositories

Pushed repositories travel as a list and are cloned again. One with unpushed work travels whole, .git included.

Software

Homebrew, npm, cargo, pipx, apt and more, as a list. Each name is checked, and nothing installs without your OK.

AI agents

Config, memory, hand-written skills and hooks for Claude Code, Codex, Cursor and the rest. Sessions: none, recent or all.

Your work

Projects, notes and documents. For Photos, Mail or Notes, you export from the app, and the export travels.

The agent thinks. A small binary holds the lock.

Moving a machine is mostly remembering, which agents are good at. A passphrase must never enter an agent's context, so it never does.

the brain

The skill

Markdown and a few standard-library Python scripts. It decides what to carry, copies it, writes a manifest, and replays it on the new machine.

the lock

The envrelay CLI

Four commands and nothing else. No state, no network. It asks for the passphrase in your own terminal, not in the agent's.

encryptdecryptinspectverify

the decisions

You

Approve the list, type the passphrase, and say yes to each install.

Your passphrase never passes through the agent.

Four hard rules in the skill, and a file format you can open without us.

Typed in your terminal

The agent prints the command and you run it. You type the passphrase at its prompt, so it never lands on a command line, in an environment variable or in shell history.

Nothing is uploaded

The result is one file on your disk. A USB stick, AirDrop, your own cloud: where it goes next is up to you.

Keys are never clobbered

Credentials come back at 0600 (0700 for folders), and a file already on the new machine is never overwritten.

Code is named first

MCP servers and hooks run on their own, so each one is shown with the command it runs before it comes back. Strike any of them.

A software list is data

Package names from a backup are checked with the package manager itself, and each install waits for your OK.

Opens without EnvRelay

A backup is age (scrypt) over tar and zstd, so the standard tools open it:

age -d backup.envrelay | zstd -d | tar -xp

Lose the passphrase and the backup is gone.

No recovery, no back door, and nobody who can help, us included. Put it in your password manager before you encrypt.

Works with the agent you already use

Any agent that reads Agent Skills. The installer puts the skill where they look for it.

macOS 11 or later and Linux, on x86_64 and arm64. On Windows, use WSL.

Prefer a skill manager? npx skills, gh skill, ClawHub and the Claude Code and Copilot plugins work too. Other ways to install

Ready when your new machine is.

curl -fsSL https://envrelay.com/install.sh | sh
Star on GitHub

Found EnvRelay useful? A star means a lot, and it helps other people find it.