maisecrets menu

maisecrets / What it does not protect

What it does not protect

A plugin can only guard what passes its hooks. These are the limits, measured or documented.

AROUND THE HOOKS A chat app, the web, mobile no plugin hooks An image you paste or an image from an MCP tool Output over 50,000 characters Claude Code writes it to a file THROUGH THE HOOKS, NOT RECOGNISED “Kowalski called back” a name without a label “use Sommer2026 to log in” a password in a sentence a value over two lines or encoded by a command maisecrets rules, your terms, your values no shape, no label: it passes The model no hook sees it as it is Your own processes can read the vault the guards stand in front of the agent, not in front of you
Red reaches the model. The upper three pass around the hooks; the lower three pass through them because nothing in the text marks them. The list below says what you do about each.

Around the hooks

  • No hook, no protection. Chat apps, the web and the mobile apps run no plugin hooks. Use Claude Code or Codex for work with secrets.
  • Codex after an update. From Codex 0.164, Codex runs no maisecrets hook after a maisecrets update until you trust the hooks again in /hooks. Until then, every prompt and tool call goes through unchecked. /maisecrets:status shows it.

Not recognised

  • By default, a name without a label is not detected, unless it is on your term list. Detection is regex with validators, by design. A name after a label is masked in a tool result, not in a typed prompt. Put the names you care about on your term list, or turn on the opt-in NER service. With the local service, from 0.8.7, a name in a typed prompt becomes a placeholder in Claude Code; Codex prompts keep the rules alone. The service also misses names: a name in lower case mostly stays text, and a product word can be taken for a person (from 0.8.9, 26 known product and model names alone stay text).
  • A transformed value can pass. A value split across lines, or encoded by a command, is not recognised. If you know the value, store it once with /maisecrets:put: its exact form is then masked in every later text.
  • A 9-digit number in an EDIFACT segment can be masked as a US passport number.

Where the real value does not go

  • A placeholder stays text in WebFetch and in a subagent prompt. maisecrets puts a stored value back into Bash, the file tools and MCP tool arguments, nowhere else.
  • A token of an MCP server (a vault reference) goes into Write, Edit and Bash calls only, not into the arguments of an MCP call, and on Windows not into a Bash command.

PDFs and images

  • PDFs and images go to the model as they are unless you choose ask, block or convert. An image you paste into the prompt or an image from an MCP tool passes in every case.

Your own processes

  • Your own processes can read the vault. The guards stand in front of the agent, not in front of you.

Large tool output

  • Tool output above 50,000 characters is written to a file by Claude Code and is not rewritten.
  • A very large tool result takes time and memory. 1 MB of tool text takes about 12 to 13 seconds of CPU time on our reference server with 8 vCPU (release gate). The scan of 1 MB held up to 330 MB of memory, against about 24 MB for a prompt (resources.md).

The full list, the threat model and three security reviews are in the repository.