maisecrets menu
Free · Apache-2.0 · by mcpgate

Detected secrets stay off the model. Your tools still get the real value.

Your AI reads everything you give it: the password you type, the .env it opens, the customer list a tool returns. maisecrets stops the values it detects on your computer, before they reach the model, wherever Claude Code or Codex runs its hooks. A free plugin for both.

  • Catches what identifies you: passwords, keys and personal data in prompts, files and command output
  • Leaves the rest readable: it is built to keep commit hashes, IDs and file names as they are, so your agent can still work
  • The model sees a placeholder, your commands, files and MCP calls get the real value
  • Check any value first with ms:(…), without sending it
  • Guards PDFs, images and SSH: you decide what the model or a server gets
  • Runs locally: no telemetry, no account, no server
  • Free and open source, Apache-2.0
Install View on GitHub

It works in Claude Code and Codex, where the client runs plugin hooks. Check your client · For your company · What it does not protect

What it catches

E-mail addresses An address has a fixed shape, so maisecrets finds it anywhere in the text. The model gets the type and a short display, so it still knows that it is an address.
Other personal data Phone numbers with a country code, IBAN and card numbers with their checksums, public IP addresses, German ID numbers. In a tool result also names, addresses, birth dates, phone and ID numbers after their label, in tables, JSON and XML records and vCards.
Secrets API tokens and keys by their shape, private keys and Bearer headers, from the rules of betterleaks (the successor of gitleaks) and Yelp detect-secrets, plus maisecrets’ own rules.
Passwords you type After a label in any spelling, such as password: or DB_PASSWORD=. A password without a label you store once with /maisecrets:put.

Names have no shape: put the ones you care about on your term list, or import what your own NER found. How it detects, and how well each kind is found

Two jobs: hide what identifies you, keep the rest readable

Like a parcel locker: the courier gets “locker 47”, not your name and address, but still reads the delivery note. Your AI gets a placeholder for a password, and still reads the commit hash.

What maisecrets hides and what it leaves readable A command printed a password, an e-mail address, a commit hash, a file name and a version. The AI reads placeholders for the password and the e-mail address; their values stay in the vault on your computer. The commit hash, the file name and the version reach the AI unchanged. What a command printed What your AI reads DB_PASSWORD=hX7-Lq2v-9Rk DB_PASSWORD=⟦SECRET_c1⟧ owner: ana.berg@nordwerk.de owner: ⟦EMAIL_c2⟧ commit a3f9c1e commit a3f9c1e file deploy.sh file deploy.sh version 2.4.1 version 2.4.1 maisecrets Your vault real values, on your computer 1 · Hidden: the AI gets a placeholder 2 · Kept: the AI can read and use it What maisecrets hides and what it leaves readable What a command printed DB_PASSWORD=hX7-Lq2v-9Rk owner: ana.berg@nordwerk.de commit a3f9c1e file deploy.sh version 2.4.1 maisecrets Your vault on your computer What your AI reads DB_PASSWORD=⟦SECRET_c1⟧ owner: ⟦EMAIL_c2⟧ commit a3f9c1e file deploy.sh version 2.4.1 1 · Hidden 2 · Kept, readable
Job 1 · Hide what identifies you If it fails, a value slips through: your password or a customer's address reaches the model. In our tests maisecrets found more secrets than the other tools we tested. The measurement
Job 2 · Keep the rest readable If it fails, the AI reads placeholders where it needs a commit hash or a file name, and quietly gets things wrong. On the same documents, every other tool made at least 11 times as many wrong masks. The measurement

The cost: maisecrets misses some values, mostly names in free text. We measure both jobs and show where other tools do better.

What the model sees

You ask the agent to write a deploy script, and it reads your .env.

What the command printed
DB_USER=deploy
DB_PASSWORD=Tq8vR2pLm4Wz
What the model received
DB_USER=deploy
DB_PASSWORD=⟦SECRET_c1⟧

The agent writes the command with the placeholder. You approve it. At execution the value is read once from your keychain, and the output is redacted again on the way back. The password does not appear in the prompt, the transcript or the model's context.

See your values, the AI does not

From maisecrets 0.9.0, Claude Code shows you the real values with a lock. A click copies one.

What you see
Claude Code in the terminal: the person's prompt and Claude's reply show an IBAN, a phone number and a token in clear text, each with a lock.
What Claude gets
The same conversation as the AI receives it: the IBAN, the phone number and the token are placeholders.

Values with a lock are on your screen only. Claude gets placeholders, and maisecrets puts the values back where a command or a file needs them.

What maisecrets does, all on your machine

YOUR MACHINE LEAVES YOUR MACHINE You type a token in the prompt The agent reads .env file or command output You hand a password over password: … or /maisecrets:put maisecrets Detect and swap value → ⟦SECRET_c1⟧ Vault your keychain At execution insert the real value one-time grant, this session only redact the output The model Anthropic · OpenAI sees placeholders only Your tools API · deploy · MCP server · gateway get the real value ⟦SECRET_c1⟧ the agent writes curl -u ⟦SECRET_c1⟧ … real value output
The real value (orange) stays off the model. maisecrets inserts it on your machine, only into the call that needs it. The model gets placeholders, in both directions.
  1. You work as usual. You type a prompt, or the agent reads a file or runs a command.
  2. maisecrets finds the secret on your machine and keeps the value in your local vault.
  3. Everything else stays readable. maisecrets is built to let commit hashes, IDs, version numbers and file names reach the model as they are.
  4. The model sees a placeholder such as ⟦SECRET_c1⟧.
  5. The real call gets the real value. maisecrets puts it back in, on your machine, when the command runs.

Detection uses fixed rules: the betterleaks ruleset (the successor of gitleaks), Microsoft Presidio's PII patterns with their checksums, Yelp detect-secrets, and maisecrets' own rules for more token formats and personal data. You can add rules of your own. No model decides what is a secret. A value is put back only in the session where it came in, for one call at a time, under a cap per hour.

For your company

For a team, three things are separate: how the plugin reaches each machine, which settings it must use, and whether its hooks run there.

  • Deploy it centrally: make it available or required in your claude.ai organisation, or through Claude Code managed settings
  • Enforce a machine policy that a user cannot loosen from their own settings, with your token formats and your customers' names
  • Check each machine: /maisecrets:status shows the version, the policy keys and, in Codex, whether its hooks run
maisecrets for your company

Install

Claude Code 
claude plugin marketplace add Mcpgate-de/maisecrets
claude plugin install maisecrets@maisecrets

For your own code: the detection core is on PyPI as a library, pip install maisecrets. The Python library

Our marketplace has the current release, 0.9.9. The Claude plugin directory installs 0.5.9, an earlier release that blocks a prompt with a password instead of sending it on with a placeholder. Codex and the directory: all install steps.

Why you can trust it

  • Your values stay on your computer, in the vault of your operating system
  • It sends no value and no prompt to a server, and has no telemetry. The NER service is off by default; if you turn it on, a prompt goes only to the container on your own computer
  • Open source: read every file it runs
  • Listed in the Claude plugin directory with version 0.5.9

High precision, no language model. On four labelled datasets of personal data, maisecrets 0.8.6 made the fewest wrong masks of four open-source tools. It finds fewer values than a tool with a language model, mostly because it does not guess names. If you want names too, turn on the opt-in NER service.

Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1

Higher: fewer wrong masks. Further right: more values found. The dashed curves join points of equal F1. Benchmark V3, maisecrets 0.8.6 with and without NER on 31 October 2026, the other tools on 21 October 2026.

Choose a dataset
Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Nemotron Nemotron, Nemotron-PII, 834 documents, 2,781 values. Presidio (RULES + LANGUAGE MODEL): recall 72.2 %, precision 92.8 %, F1 0.812; Preserve (RULES + NAME DICTIONARY): recall 66.0 %, precision 82.5 %, F1 0.733; pii-anon (REGEX): recall 76.6 %, precision 29.7 %, F1 0.428; maisecrets (RULES): recall 61.7 %, precision 99.6 %, F1 0.762; maisecrets + NER (RULES + NER (OPT-IN)): recall 85.9 %, precision 99.3 %, F1 0.921. 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 72.2 % · P 92.8 % PreserveR 66.0 % · P 82.5 % pii-anonR 76.6 % · P 29.7 % maisecretsR 61.7 % · P 99.6 % maisecrets + NERR 85.9 % · P 99.3 % Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Nemotron 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 72.2 %P 92.8 % PreserveR 66.0 %P 82.5 % pii-anonR 76.6 %P 29.7 % maisecretsR 61.7 %P 99.6 % maisecrets + NERR 85.9 %P 99.3 %
Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Mendeley Mendeley, Mendeley financial, 362 documents, 2,084 values. Presidio (RULES + LANGUAGE MODEL): recall 67.7 %, precision 89.5 %, F1 0.771; Preserve (RULES + NAME DICTIONARY): recall 66.6 %, precision 81.3 %, F1 0.732; pii-anon (REGEX): recall 61.0 %, precision 65.8 %, F1 0.633; maisecrets (RULES): recall 70.6 %, precision 98.8 %, F1 0.824; maisecrets + NER (RULES + NER (OPT-IN)): recall 93.7 %, precision 86.3 %, F1 0.899. 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 67.7 % · P 89.5 % PreserveR 66.6 % · P 81.3 % pii-anonR 61.0 % · P 65.8 % maisecretsR 70.6 % · P 98.8 % maisecrets + NERR 93.7 % · P 86.3 % Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Mendeley 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 67.7 %P 89.5 % PreserveR 66.6 %P 81.3 % pii-anonR 61.0 %P 65.8 % maisecretsR 70.6 %P 98.8 % maisecrets + NERR 93.7 %P 86.3 %
Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Gretel Gretel, Gretel finance, 334 documents, 1,141 values. Presidio (RULES + LANGUAGE MODEL): recall 45.3 %, precision 27.3 %, F1 0.340; Preserve (RULES + NAME DICTIONARY): recall 41.6 %, precision 24.6 %, F1 0.309; pii-anon (REGEX): recall 42.9 %, precision 27.7 %, F1 0.337; maisecrets (RULES): recall 31.2 %, precision 90.4 %, F1 0.464; maisecrets + NER (RULES + NER (OPT-IN)): recall 51.3 %, precision 91.8 %, F1 0.658. 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 45.3 % · P 27.3 % PreserveR 41.6 % · P 24.6 % pii-anonR 42.9 % · P 27.7 % maisecretsR 31.2 % · P 90.4 % maisecrets + NERR 51.3 % · P 91.8 % Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Gretel 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 45.3 %P 27.3 % PreserveR 41.6 %P 24.6 % pii-anonR 42.9 %P 27.7 % maisecretsR 31.2 %P 90.4 % maisecrets + NERR 51.3 %P 91.8 %
Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Privy Privy, Privy, 2,816 documents, 1,076 values. Presidio (RULES + LANGUAGE MODEL): recall 47.3 %, precision 52.7 %, F1 0.498; Preserve (RULES + NAME DICTIONARY): recall 20.5 %, precision 41.5 %, F1 0.275; pii-anon (REGEX): recall 28.6 %, precision 93.6 %, F1 0.438; maisecrets (RULES): recall 23.7 %, precision 99.2 %, F1 0.383; maisecrets + NER (RULES + NER (OPT-IN)): recall 66.4 %, precision 93.5 %, F1 0.776. 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 47.3 % · P 52.7 % PreserveR 20.5 % · P 41.5 % pii-anonR 28.6 % · P 93.6 % maisecretsR 23.7 % · P 99.2 % maisecrets + NERR 66.4 % · P 93.5 % Precision against recall: maisecrets has the highest precision on every dataset; with its opt-in NER, it finds the most and has the best F1: Privy 0 0 25 25 50 50 75 75 100 100 F1 0.2 F1 0.4 F1 0.6 F1 0.8 Found (recall, %): more values masked whole → Right when flagged (precision, %) → PresidioR 47.3 %P 52.7 % PreserveR 20.5 %P 41.5 % pii-anonR 28.6 %P 93.6 % maisecretsR 23.7 %P 99.2 % maisecrets + NERR 66.4 %P 93.5 %

What to notice: maisecrets (orange) has the highest precision on every dataset, so its masks are wrong least often. Without NER it is further left than other tools on three datasets, because it finds fewer names.

With the opt-in NER service (blue), maisecrets finds the most and has the best F1 on every dataset. Its precision falls on Mendeley to 86.3 %, below Presidio, and on Privy it ties with pii-anon. The NER point: 31 October 2026, the image mcpgate/ner:v2.0.3573 on the same samples.

Source: Benchmark V3, bench/results/2026-10-31-v3-0.8.6 and bench/results/2026-10-21-v3/run (tag v0.8.6)
The numbers of this chart
DatasetToolHow it finds personal dataFound (recall)Right when flagged (precision)False alarmsF1
NemotronPresidiorules + language model72.2 %92.8 %1730.812
NemotronPreserverules + name dictionary66.0 %82.5 %3560.733
Nemotronpii-anonregex76.6 %29.7 %4,4370.428
Nemotronmaisecretsrules61.7 %99.6 %70.762
Nemotronmaisecrets + NERrules + ner (opt-in)85.9 %99.3 %140.921
MendeleyPresidiorules + language model67.7 %89.5 %3970.771
MendeleyPreserverules + name dictionary66.6 %81.3 %3800.732
Mendeleypii-anonregex61.0 %65.8 %1,0890.633
Mendeleymaisecretsrules70.6 %98.8 %180.824
Mendeleymaisecrets + NERrules + ner (opt-in)93.7 %86.3 %3150.899
GretelPresidiorules + language model45.3 %27.3 %2,3980.340
GretelPreserverules + name dictionary41.6 %24.6 %2,4610.309
Gretelpii-anonregex42.9 %27.7 %2,0120.337
Gretelmaisecretsrules31.2 %90.4 %390.464
Gretelmaisecrets + NERrules + ner (opt-in)51.3 %91.8 %640.658
PrivyPresidiorules + language model47.3 %52.7 %1,0600.498
PrivyPreserverules + name dictionary20.5 %41.5 %3500.275
Privypii-anonregex28.6 %93.6 %220.438
Privymaisecretsrules23.7 %99.2 %20.383
Privymaisecrets + NERrules + ner (opt-in)66.4 %93.5 %510.776

How you check each point, and the full comparison with its gaps

Sensitive References for MCP

Since mcpgate 2.0.3651 and maisecrets 0.8.14, the two use Sensitive References in Claude Code. mcpgate gives the model a reference instead of a sensitive value. maisecrets puts the real value into a local file, or into a command if you allow it, outside the model context.

We are also exploring this pattern as an independent pre-SEP MCP design: Sensitive References for MCP. It is not an MCP standard or an accepted SEP. maisecrets is one implementation informing the design. How the two relate