diff --git a/bin/envcheck.sh b/bin/envcheck.sh
new file mode 100644
index 0000000..4094c27
--- /dev/null
+++ b/bin/envcheck.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Print which of the relay vars are set, WITHOUT printing their values. Handy
+# when a script dies with ":? not set" and you cannot tell which one.
+for v in RELAY_ENDPOINT RELAY_USER RELAY_TOKEN CONTAINMENT_CODE; do
+  eval "val=\${$v:-}"
+  if [ -n "$val" ]; then echo "$v: set"; else echo "$v: MISSING"; fi
+done