maisecrets menu

maisecrets / Values in your prompt

Just type: the value becomes a placeholder

Sometimes the agent needs a password for the job, or you paste a customer’s e-mail address. Type it as you would anyway. The model gets a placeholder, and only the real call gets the value.

You type a prompt with a password, a token or an e-mail address maisecrets before the prompt leaves rewrites it Claude Code 2.1.287 and later or blocks it directory version, Codex Sent at once with the placeholder Blocked you paste it and send The model ⟦SECRET_c4⟧
Either way the model sees only the placeholder. When the agent later uses it in a command, maisecrets puts the real value in on your computer, for that one call.

In Claude Code 2.1.287 and later (in the desktop app’s Code tab 2.1.286 and later), the prompt goes out at once with the placeholder. There is no block and no copy and paste. The agent does the task with the placeholder, and the value goes only into the real login.

Where the rewrite is not available (Codex, older Claude Code versions, mods off, or an error), maisecrets blocks the prompt before it leaves your machine, as before. It keeps the rewritten prompt for you: send it with /maisecrets:send (or /ms after /maisecrets:shortcut), or paste it from the clipboard. On an error, maisecrets blocks the prompt instead of sending it. To keep the block in Claude Code too, set "rewrite_prompts": false in ~/.maisecrets/config.json.

Three ways to hand over a value

With a label

password:, passwort:, DB_PASSWORD=, "secret": "…": any spelling in English, German and Spanish, even with the value on the next line. The value needs 8 characters or more and must not be a placeholder or a dictionary word, so password: yes stays text.

With /maisecrets:put

Copy the value and run /maisecrets:put in Claude Code. The placeholder replaces the value in your clipboard. Paste it where the agent needs the value.

Check it first with ms:(…)

Type ms:(your value) as your whole prompt. maisecrets tells you whether it would mask the value, and the prompt is never sent. A value that it would miss and that looks like a password is stored, so it is masked from then on. How it works.

A token, a key or an IBAN needs no label: its shape is enough. What it detects, and what not.