Agentic Coding School
LoginSign up
secret-box, in use

Secrets

secret-box

Lets Claude use your API keys without ever seeing them, through a masked input box and placeholders that turn back into real keys.

ray-amjad/claude-code-modsUpdated

A key that reaches the conversation is in the transcript for good. It goes to the model on every turn after, sits in the session file on disk, and is replayed into every fork. The only real fix is to never send it. Keys get in two ways: you paste one, or a tool prints one. secret-box closes both, and Claude can still run the code that needs the key.

What it does

  • A tool to ask with. Claude gets a request_secret tool that takes a variable name and a one-line reason. Its description tells Claude to use it instead of asking you to paste.
  • A masked box. A pane opens beside the transcript with the field already focused. It only ever draws dots and a character count.
  • A placeholder to use. The mod writes NAME=value to .env, makes sure .gitignore covers it, and gives Claude a placeholder like [REDACTED-SECRET-3f9a1c2e]. Put that in a command and it runs with the real key.
  • Placeholders on the way out. Every tool result is scanned: about 70 vendor key shapes, passwords in connection strings, high-entropy tokens and every .env value with a secret name. cat .env still shows PORT=3000.
  • Placeholders on the way in. A key you paste into the prompt by mistake is swapped before Claude reads it.
  • Never committed. git add .env and a git commit that would carry a .env file are refused.

Claude uses the placeholder in a Bash command and the shell runs it with the real key

Using it

Ask for something that needs a secret, like billing.js needs the Stripe secret key, get it set up. Claude calls secret-box - request_secret. Paste the value, press Enter to save it, or Esc to cancel (nothing is written). Then ask check the key works and Claude uses the placeholder. If Claude doesn't reach for the tool, just say use the secret box to ask me for STRIPE_SECRET_KEY.

Settings

Set them with /plugin configure secret-box@claude-code-mods or under pluginConfigs.

  • secrets (on): hide secrets in tool output and prompts.
  • pii (off): also hide email addresses and public IPs.
  • restoreTools: the tools that may get a real value, Bash,Write,Edit,MultiEdit,NotebookEdit by default. Tools that send data off the machine are left out on purpose.
  • allow, allowPrefixes: strings and prefixes never to hide.

How it works

The box is a pane with an Input. There is no password mode, so the mod masks it itself. On Enter it writes .env and hands the value to an in-memory vault that answers with a random placeholder, stable within the session. The redaction is transcript-redactor, unchanged, so the two can't drift. On top, tool.call hooks learn secret-named values from a .env before a tool reads it and refuse .env in git add and git commit. Every guarding hook fails closed.

Which one do I need?

secret-box is transcript-redactor plus the masked box, .env values hidden by name and the commit guard. Run one or the other, not both.

Limits

  • It hides what Claude reads, not what Claude does. It is not a sandbox against a model trying to leak a key.
  • In auto mode, Claude Code's classifier blocks cat .env first. The placeholder still works.
  • Under 144 columns the box draws above the prompt instead, and you press Ctrl+X then Tab to type in it.
  • A placeholder in a file Claude writes with Write or Edit lands on disk as the real key.
  • The vault is memory only, and claude -p can't open the box.