Keep secrets in the environment .env

Store MCP credentials and other secrets beside the env — never in cvm.yaml.

1. Open the editor:

   cvm edit work
   # or, with an active env:
   cvm edit

2. Add KEY=VALUE lines (standard dotenv conventions).
3. Use / open / run load those variables into the process. Export only records the names.