Set Vercel env vars without the agent seeing them

Works with any MCP client running the local server (Claude Code, Cursor, Codex, Gemini CLI). It uses your existing `vercel login` session, or VERCEL_TOKEN, and the project linked in .vercel/project.json unless you name one. Variables are created as sensitive for production and preview.

with an agent

you:    put my Stripe key in Vercel production
agent:  ncrypted_request("Stripe secret key for billing, Vercel production")
        -> https://ncrypted.ai/r/…#…   (you open it and paste the key)
agent:  ncrypted_request_fulfill(id, destination: "vercel_env",
                                 key: "STRIPE_SECRET_KEY", targets: ["production"])
agent:  STRIPE_SECRET_KEY is set on production. Redeploy to use it.

from the command line

npx ncrypted request "Stripe secret key for billing"
# send the printed url to whoever has the key, then:
npx ncrypted receive <id> --vercel-key STRIPE_SECRET_KEY --target production

# or, if someone already sent you an ncrypted link:
npx ncrypted vercel-env "https://ncrypted.ai/s/…#…" --key STRIPE_SECRET_KEY --target production

safety

Vercel access is checked before the one-time link is consumed. If the write still fails, the value is re-saved to a fresh one-time link that's returned in the error, so it isn't lost. This keeps secrets out of transcripts by default; it doesn't stop an agent that later runs `vercel env pull`.