maisecrets menu

maisecrets / For your company

maisecrets for your whole company

One person installs it with two commands. For a team, you roll it out once, set a machine policy that users cannot loosen, and share your rules and names in a repository.

One person installing a plugin protects one laptop. An admin can make it the default for everyone who uses Claude or Codex at work, so the protection does not depend on each person remembering it.

The rollout in six steps

  1. Pick the source. Create a private marketplace repository whose .claude-plugin/marketplace.json lists maisecrets with its GitHub repository as the source, or mirror the repository and review each release before your members get it. The organisation sync accepts no public repository.
  2. Distribute it. claude.ai: organisation settings, add the marketplace, set maisecrets to required. ChatGPT workspace: Admin > Plugins > Add > Import marketplace. Codex CLI: managed hooks through requirements.toml and your MDM, so policy trusts them.
  3. Set the policy. A machine policy file wins over each user’s settings: /Library/Application Support/maisecrets/policy.json (macOS), %ProgramData%\maisecrets\policy.json (Windows), /etc/maisecrets/policy.json (Linux). Every user must be able to read it. Make it owned by an administrator and not writable for users: it wins over a user’s settings, but not over somebody with administrator rights, who can change it or remove the plugin.
  4. Share rules and names. List your team’s rule folder in rule_dirs of the policy (see below).
  5. Check that it runs. Every session starts with one line maisecrets X.Y.Z is on., and /maisecrets:status names the keys that come from the policy. A new version reaches a member at the next session start.
  6. Own the updates. With a mirror that you control, a release reaches your members only after you take it into the mirror. To go back, put the previous release back. Name who does this.

Rules and names for the whole team

Keep detection rules for your company's token formats in a repository. maisecrets rules init creates one, with CI that checks each change. The machine policy lists the folder in rule_dirs, and users cannot remove it. A *.terms file in that folder masks the names of your customers or cases for the whole team. maisecrets reads local folders only. Rule folders in detail.