maisecrets menu

maisecrets / Install

Install maisecrets

Install it from our marketplace: it has the current release, for one computer or for a company. maisecrets needs Python 3.9 or newer, and nothing else.

Claude Code: from our marketplace (recommended)

Claude Code 
claude plugin marketplace add Mcpgate-de/maisecrets
claude plugin install maisecrets@maisecrets

This installs maisecrets 0.8.29, the current release. Then start a new session.

New in 0.8.29

  • A checksum next to a file name, such as secrets.tar.gz, is no longer masked as a secret.

All changes: the changelog.

Claude Code: from the Claude plugin directory

Claude Code 
/plugin
Discover → search “maisecrets” → Install

Codex

Codex 
codex plugin marketplace add https://github.com/Mcpgate-de/maisecrets.git
codex plugin add maisecrets@maisecrets

Codex runs no hook until you trust the maisecrets entries: /hooks in the Codex CLI, Settings > Hooks in the ChatGPT desktop app (the list appears only with a project open).

Trust them again after each update. From Codex 0.164, the trust covers the contents of the plugin folder. After a maisecrets update, Codex shows the hooks as failed and lets every prompt and tool call through until you trust them again. /maisecrets:status tells you whether Codex runs the hooks of the installed version.

Optional: names from a NER service

By default, maisecrets finds names only after a label or on your term list. maisecrets from 0.8.6 can also ask a NER service, which finds names in running text. It is off until you turn it on. What it finds, and what it costs.

  1. Install Docker Desktop, OrbStack or Podman, if none is there.
  2. Type /maisecrets:ner local in Claude Code. The AI asks you before it downloads the image mcpgate/ner (about 690 MB).
  3. /maisecrets:status shows that the service answers.
Claude Code 
/maisecrets:ner local

What the service gets:

  • Tool results. Before the text goes out, maisecrets replaces the values that the rules found, and your stored values, with filler.
  • Your typed prompts, from 0.8.7, in Claude Code only, and only from the local service. A name in the prompt becomes a placeholder before the model sees it. Nothing is blocked. In a tool call, the placeholder becomes the name again. /maisecrets:ner prompts off keeps your prompts away from the service, and /maisecrets:ner prompts on turns this on again. Codex prompts are not covered.

A tool result waits up to 300 ms for the service. With maisecrets from 0.8.8, a typed prompt waits up to 1 s. Without an answer, the rules mask alone. When the service did not check a prompt, maisecrets says so once per session, with the reason. After a restart of your computer, maisecrets starts the stopped local container again at the session start. It never downloads the image by itself.

The service has limits. A name in lower case mostly stays text, because the model reads capital letters; a name on your term list is masked in every case. The model sometimes takes a product word for a person. With maisecrets from 0.8.9, 26 known product and model names alone stay text; another product word can still become a placeholder.

A service of your team works too: /maisecrets:ner url URL. It gets tool results only, never a prompt. maisecrets uses plain http only on a private network; a public address needs https. /maisecrets:ner fallback url URL names a second service for tool results, used only while the local container is not running. On Windows, the fallback takes over only with a longer timeout_ms, such as 3000. /maisecrets:ner off turns the service and the fallback off. The model D3 (Davlan/distilbert-base-multilingual-cased-ner-hrl, AFL-3.0) and its base model (distilbert-base-multilingual-cased, Apache-2.0) have their notices in the image under /licenses.

Requirements

  • Python 3.9 or newer on the PATH of the client. The stock python3 of macOS is enough. Without it, the plugin blocks every prompt and names the missing piece.
  • Windows: install Python for all users, as an administrator: winget install --id Python.Python.3.12 --exact --scope machine. Codex on Windows runs commands as a sandbox user, which cannot start a Python installed for one person.

Check that it runs

Every session starts with one line, maisecrets X.Y.Z is on. If it is missing, the plugin did not load. /maisecrets:status shows what runs and which version.

For a company

An admin can make maisecrets available, installed by default or required for everyone in the organisation, in the claude.ai organisation settings. The steps: For your company.

All install paths, updates and the uninstall: README.