Detected secrets stay off the model. Your tools still get the real value.
maisecrets is a free plugin for Claude Code and Codex. It catches passwords, keys and personal data on your machine before they go to the model: in prompts, file reads and command output, wherever the client runs its hooks. The model works with a placeholder. Your API calls, deploys and gateway requests still carry the real value.
- Runs locally
- No telemetry, no account
- No maisecrets server
- Free forever
What maisecrets does, all on your machine
- You work as usual. You type a prompt, or the agent reads a file or runs a command.
- maisecrets finds the secret on your machine and keeps the value in your local vault.
- The model sees a placeholder such as
⟦SECRET_c1⟧. - The real call gets the real value. maisecrets puts it back in, on your machine, when the command runs.
Detection uses fixed rules: the gitleaks ruleset, Microsoft Presidio's PII patterns with their checksums, Yelp detect-secrets, and a few own rules. No model decides what is a secret. A value is put back only in the session where it came in, for one call at a time, under a cap per hour.
Install in Claude Code or Codex
claude plugin marketplace add Mcpgate-de/maisecrets
claude plugin install maisecrets@maisecretscodex plugin marketplace add https://github.com/Mcpgate-de/maisecrets.git
codex plugin add maisecrets@maisecrets- Start a new session after the install.
- Codex runs no hook until you trust the maisecrets entries once:
/hooksin the Codex CLI, Settings > Hooks in the ChatGPT desktop app (the list appears only with a project open). - maisecrets needs Python 3.9 or newer on the PATH of the client. The stock
python3of macOS is enough. Without it, the plugin blocks every prompt and names the missing piece. - Windows: install Python for all users, as an administrator:
winget install --id Python.Python.3.12 --exact --scope machine. Codex on Windows runs commands as a sandbox user, which cannot start a Python installed for one person.
Why mcpgate builds this
mcpgate is a self-hosted MCP gateway for teams. It pseudonymizes PII before the model sees it. Then we counted our own Claude Code sessions: 185 real credentials across 3,254 sessions, May to September 2026. 80% of them never passed through the gateway. They came from files and commands on the laptop.
A gateway protects what goes through it. maisecrets protects what never reaches it. It is free, for one laptop or for a whole company, and it does not need mcpgate.
Learn about the mcpgate gateway →Built to be checked
- Open source, Apache-2.0. Read every file it runs.
- A local vault: the macOS Keychain, the Windows Credential Locker, or an encrypted file on Linux.
- No telemetry, no account, no maisecrets server. mcpgate receives no data from the plugin.
- Public threat model and privacy statement.
What the model sees
You ask the agent to write a deploy script, and it reads your .env.
DB_PASSWORD=example-hunter2-9Qz
STRIPE_KEY=sk_live_example…DB_PASSWORD=⟦SECRET_c1⟧
STRIPE_KEY=⟦SECRET_c2⟧The agent writes the command with the placeholder. You approve it. At execution the value is read once from your keychain, and the output is redacted again on the way back. The password does not appear in the prompt, the transcript or the model's context.
Just type: the password becomes a placeholder
Sometimes the agent needs a password for the job. Type it in your prompt with a label, as you would anyway.
log in to staging and run the migration,
password: correct-horse-battery-9log in to staging and run the migration,
password: ⟦SECRET_c4⟧In Claude Code 2.1.287 and later (in the desktop app’s Code tab 2.1.286 and later), the prompt goes out at once with the placeholder. There is no block and no copy and paste. The agent does the task with the placeholder, and the value goes only into the real login.
Where the rewrite is not available (Codex, older Claude Code versions, mods off, or an error), maisecrets blocks the prompt before it leaves your machine, as before. It keeps the rewritten prompt for you: send it with /maisecrets:send (or /ms after /maisecrets:shortcut), or paste it from the clipboard. On an error, maisecrets blocks the prompt instead of sending it. To keep the block in Claude Code too, set "rewrite_prompts": false in ~/.maisecrets/config.json.
With a label
password:, passwort:, DB_PASSWORD=, "secret": "…": any spelling in English, German and Spanish, even with the value on the next line. The value needs 8 characters or more and must not be a placeholder or a dictionary word, so password: yes stays text.
With /maisecrets:put
Copy the value and run /maisecrets:put in Claude Code. The placeholder replaces the value in your clipboard. Paste it where the agent needs the value.
A token, a key or an IBAN needs no label: its shape is enough. What it detects, and what not.
What it detects
Detection does not depend on the file name. It scans every prompt and every tool result, wherever the text comes from: cat config.yaml, git diff, kubectl get secret, a psql dump. .env is only the example.
Token shapes
Anywhere in the text: the gitleaks rules, prefixes such as glpat- and whsec_, AWS keys, Bearer headers.
Labelled values
A label and a value in any spelling, also across a line break. From 8 characters, never a placeholder or a dictionary word.
Personal data
By shape: email, phone with a country code, IBAN, card, IP, and German identifiers.
Not detected: a password without a label in a sentence, such as "use Sommer2026 for the login". That is the limit of pattern matching, not a setting. Label it, or use /maisecrets:put.
Hidden characters: from 0.6.2, maisecrets removes invisible Unicode characters (tag characters and variation selectors) from every tool result before the model reads it. A web page can hide an instruction in them. This removes one hiding place; it does not detect prompt injection. "strip_hidden_characters": false turns it off.
Where it works: Claude Code, Codex and more
| Client | Prompt | Real call | Tool output | Status |
|---|---|---|---|---|
| Claude Code CLI | ✅ | ✅ | ✅ | Built and proven by the test harness. From 0.6: with mods (2.1.287+) the prompt is rewritten, not blocked. On Windows without Git Bash the shell tool is PowerShell, and a placeholder in a PowerShell command is refused. |
| Claude desktop app, Code tab | ✅ | ✅ | ✅ | Same hooks. Seen live, not in the harness. From 0.6 the mod rewrites the prompt (seen with Claude Code 2.1.288). |
| Cowork | ✅ | ✅ | ✅ | Same hooks as the desktop app. Whether the mod loads there is not measured, so count on the block. |
| Codex CLI | ✅ | ✅ | ✅ | Built and proven by the test harness. Trust the hooks once in /hooks. |
| Codex in the ChatGPT desktop app | ✅ | ✅ | ✅ | Seen live, not in the harness. Trust the hooks once under Settings > Hooks; the list appears only with a project open. |
| Codex IDE extension | ☑️ | ☑️ | ☑️ | Same plugin runtime. Not measured. |
| Cursor | ☑️ | ☑️ | ⚠️ | Waits for a shell-output hook. |
| Copilot CLI | ⚠️ | ☑️ | ☑️ | Waits for a prompt hook. |
| Chat apps, web, mobile | ❌ | ❌ | ❌ | No hooks. The plugin cannot help here. |
✅ proven by the harness in the repository, or seen live where the row says so · ☑️ possible per the vendor's hook documentation, not measured · ⚠️ partly · ❌ no hook. A client without a prompt or an output guard cannot be made safe by a plugin. We do not ship an adapter that would look protected and leak.
Two more guards
See where a secret went
maisecrets notes, on your machine, the network destinations where each stored secret was seen in use. /maisecrets:list shows them. It is a record, not a permission, and it blocks nothing. /maisecrets:settings secret_destinations off stops it.
Ask before a change over ssh
With ssh_consent on, a read over ssh runs and every write asks you first, also behind cd … && or timeout. Your own lab hosts can be autonomous. It is off by default.
What it does not protect
- No hook, no protection. Chat apps, the web and the mobile apps run no plugin hooks.
- Names are not detected. Detection is regex with validators, by design.
- A transformed value passes. Base64, or a value split across lines, is not recognised.
- Your own processes can read the vault. The guards stand in front of the agent, not in front of you.
- Tool output above 50,000 characters is written to a file by Claude Code and is not rewritten.
The full list, the threat model and three security reviews are in the repository.
For your whole company
One person installing a plugin protects one laptop. An admin can make it the default for everyone who uses Claude or Codex at work, so the protection does not depend on each person remembering it.
Claude (organisation)
Add maisecrets from a private or internal marketplace repository in the organisation settings, and set it to required. Every member gets it at session start and needs no access to the repository. Updates arrive the same way.
Codex
Ship the hooks as managed hooks through requirements.toml and your MDM. Policy trusts them, and users cannot turn them off. In a ChatGPT workspace, import the same marketplace under Admin > Plugins.
How you know it runs
Every session starts with one line: maisecrets X.Y.Z is on.. If it is missing, the plugin did not load.
The organisation sync accepts no public repository. Create a private one whose marketplace lists maisecrets with its GitHub repository as the source, or mirror the repository and review each release before your members get it. The administrator guide has the steps.
Questions
Does maisecrets send anything to a server?
No. maisecrets sends no prompt, no value and no telemetry. There is no account, no licence check and no maisecrets server. A connection starts only from a command you run: your own ssh command in the Claude Code sandbox goes through the sandbox proxy, and /maisecrets:report opens an issue page only when you ask. The privacy page lists each case. Everything the plugin runs is readable source: Python with only the standard library, plus one small JavaScript mod for Claude Code.
Where does a value go when it is detected?
Into a local vault on your machine: the macOS login keychain, the Windows Credential Locker, or an encrypted file on Linux. Every entry has a time to live. When it expires, the value is deleted.
Is it really free?
Yes, and it stays free. maisecrets is Apache-2.0. There is no paid tier and no feature held back for one. mcpgate, the self-hosted gateway for teams, is a separate product.
Can we enforce it for the whole company?
Yes. In a claude.ai organisation an admin adds maisecrets from a private marketplace repository and sets it to required, so every member gets it at session start. In Codex an admin ships the hooks as managed hooks through requirements.toml and MDM; policy trusts them, and users cannot turn them off.
Does it replace a secrets manager?
No. It keeps values out of the model. A process that runs as you can still read the vault, like any keychain. The threat model in the repository says exactly where the line is.