Privacy

Last updated: 9 October 2026

The short form

The maisecrets plugin collects no data. It sends nothing to mcpgate or to anybody else. It has no telemetry, no account and no licence check.

What the plugin stores, and where

Everything stays on your machine:

Detected values go into a local vault: the macOS login keychain, the Windows Credential Locker, or an encrypted file on Linux. Each value has a time to live. When it expires, the plugin deletes the value.
An index in ~/.maisecrets/index.json holds metadata and keyed fingerprints, never a value.
An event log and an audit log in ~/.maisecrets/ record which rule matched and which placeholder was resolved, never a value.
A record of destinations notes the hosts that each stored secret was sent to. It stays on your machine and goes when the value expires. /maisecrets:settings secret_destinations off stops it.
The client's own transcript file on your disk: the plugin masks a detected value in it, in place.
The clipboard receives the rewritten prompt when the plugin blocks a prompt.

You can read and delete all of it. /maisecrets:list shows the entries, and /maisecrets:forget deletes one.

What leaves your machine

No telemetry and no download. The plugin sends nothing to a server of its own, and mcpgate receives no data from it. A connection starts only from a command you run:

Your own ssh command in the Claude Code sandbox goes through Claude Code's local sandbox proxy to the host you named. Before an ssh command that carries a value, a check tries a few direct connections that the sandbox must refuse. The check sends no data.
/maisecrets:report opens the prefilled issue page in your browser, or prints the link. See "Reports you send" below.
The Windows Credential Locker can roam through a Microsoft account on a machine that is not domain-joined. If that matters, choose the encrypted-file store.

The public repository holds every file the plugin runs, so you can check this list.

Reports you send

The command /maisecrets:report opens a prefilled issue on GitHub in your browser. You decide whether to send it. The report contains the rule name and the plugin version, never the detected value. GitHub processes the issue under its own privacy statement.

This website

This page is part of mcpgate.de. The website sets no cookies and runs no analytics. The privacy policy of mcpgate.de covers the server logs of the website and names the controller.

Contact

For questions about privacy, see the Impressum.