maisecrets / Check a value

Check a value before you send it

You are not sure whether maisecrets knows a password or a token. Type it in ms:(…) as your whole prompt: maisecrets gives you its verdict, and the prompt never goes to the model.

What you see

Claude Code — a value of a known format

ms:(the-token-you-want-to-check)
✓ maisecrets masks this as a secret (⟦SECRET_…⟧). maisecrets knows this format, so it masks it wherever it appears, also alone.

This prompt was not sent. The value did not reach the AI.

Claude Code — a value after its label

ms:(password: the-password-you-mean)
✓ maisecrets masks this as a secret (⟦SECRET_…⟧). maisecrets found it by the label in front of it (`password:`). A value like this without such a label is not found. This value is now stored, so it is masked wherever it appears for 1 day (each use extends it).

This prompt was not sent. The value did not reach the AI.

Claude Code — a value it did not catch

ms:(a-value-it-did-not-know)
⚠ maisecrets did not catch this value. maisecrets stored it as ⟦SECRET_c4⟧. For 1 day after each use it is masked wherever it stands as a word of its own.

This prompt was not sent. The value did not reach the AI.

Claude Code — ordinary text

ms:(two words)
⚠ maisecrets did not catch this value. It looks like ordinary text, so it was not stored. If it is a secret, store it with /maisecrets:put.

This prompt was not sent. The value did not reach the AI.

How it works

Never sent. A prompt that starts with ms:( is always stopped, in Claude Code and in Codex, also when the closing bracket is missing. Only you see the verdict. maisecrets removes the prompt from the session transcript on disk.
The same verdict as a normal prompt. maisecrets uses its rules, your own rules, your terms, the values already stored and your allow list. The answer names the type and how maisecrets found the value (its format, the label in front of it, or the words around it), never the value. It names a rule only when the rule is one of your own.
A value it would miss is stored if it looks like a password: no blanks, 8 characters or more, a mix of letters, digits and signs. It is masked for 1 day after its last use (the default time to live; each use extends it), and for at most 30 days after it was stored. You can change the time to live with /maisecrets:settings. A value that looks like ordinary text is not stored; use /maisecrets:put for it.
Several values: ms:(first) ms:(second). Each value gets its own verdict.
Report a format it missed. If maisecrets did not know a value with a fixed start, such as sb_pat_, the answer offers a short issue link. The link holds the shape of the value only, such as sb_pat_[A-Za-z0-9]{32}, never the value. Read the shape before you open the link. If the start is part of your secret, do not send it. With report_url set to null, there is no link.

Limits

In Remote Control, the client does not show the verdict. The value is still not sent.
The client's own list of earlier prompts (the up arrow) can keep the prompt as you typed it. That is not measured.
A stored value is found again as a word of its own. Glued to other letters, it is not found.

The full rules are in the README.