diff --git a/hack/agent-env/main.go b/hack/agent-env/main.go
new file mode 100644
index 000000000..d1307a7fb
--- /dev/null
+++ b/hack/agent-env/main.go
@@ -0,0 +1,19 @@
+// Agent environment setup tool for Devsy repository.
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, "error:", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	fmt.Println("Agent environment setup verified.")
+	return nil
+}
diff --git a/hack/agent-env/setup.sh b/hack/agent-env/setup.sh
new file mode 100755
index 000000000..521181c3b
--- /dev/null
+++ b/hack/agent-env/setup.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+cd "${REPO_ROOT}"
+
+echo "==> Installing go-task..."
+if ! command -v task &>/dev/null; then
+    sudo sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin
+fi
+
+echo "==> Installing prek..."
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.0/prek-installer.sh | sh
+if git rev-parse --git-dir &>/dev/null; then
+    prek install --force || true
+fi
+
+echo "==> Setting up Go modules..."
+export GOTOOLCHAIN=auto
+go mod download
+go mod verify
+
+echo "==> Installing golangci-lint..."
+GOLANGCI_VERSION="$(cat .golangci-version | tr -d '[:space:]')"
+curl -sSfL https://golangci-lint.run/install.sh | sh -s "${GOLANGCI_VERSION}"
+
+echo "==> Installing Node dependencies with pnpm..."
+pnpm install
+
+if [ -n "${GPG_PRIVATE_KEY:-}" ]; then
+    echo "==> Configuring GPG signing..."
+    mkdir -p ~/.gnupg
+    chmod 700 ~/.gnupg
+    echo "allow-loopback-pinentry" >>~/.gnupg/gpg-agent.conf
+    gpgconf --kill gpg-agent || true
+
+    echo "$GPG_PRIVATE_KEY" | gpg --batch --import --passphrase "${GPG_PASSPHRASE:-}" || true
+
+    KEY_ID=$(gpg --list-secret-keys --keyid-format LONG 2>/dev/null | awk '/^sec/ {print $2}' | cut -d'/' -f2 | head -n 1 || true)
+
+    if [ -n "$KEY_ID" ]; then
+        git config --global user.signingkey "$KEY_ID"
+        git config --global commit.gpgsign true
+        git config --global gpg.program gpg
+        if [ -n "${GPG_PASSPHRASE:-}" ]; then
+            git config --global gpg.pinentryMode loopback
+        fi
+        echo "GPG signing configured with key ID: $KEY_ID"
+    fi
+fi
+
+echo "==> Running agent-env Go entrypoint..."
+go run ./hack/agent-env
+
+echo "done"