maisecrets / Vault references

Real values in your files, tokens for the model

An MCP server such as mcpgate masks personal data in its results with a token. Without help, a file that the AI writes from such a result holds the token. With maisecrets and a server that supports vault references, the file holds the real value, and the model still sees only the token.

The vault hook in your AI client asks the server for the value of a token, and puts it into the local call. No line goes from the hook to the model: the model still sees only the token.

What the model sees

The model writes

To: ⟦EMAIL_1:ma•••@example.com⟧
Subject: Your order

The file on your disk

To: max@example.com
Subject: Your order

maisecrets asks the server for the value when the AI writes the token into a file or a command. It gets all values of the call or none. If the server refuses, maisecrets denies the call and names the reason.

Turn it on

The server must offer vault references. In mcpgate, the operator turns on “Let local vaults read values”.
Add the server yourself, at user scope, with an https URL. A server in a project’s .mcp.json starts nothing.
Use the server once. With its first token, maisecrets reads the metadata of the server, makes a key and adds a header to your entry for that server. You see a notice once, with one step.
Do that step: in Claude Code, type /mcp reconnect <server name> (or start Claude Code again). In Codex, start Codex again.
Activate the link. A link from a login you already had waits a day. To use it at once, activate it on the server’s connections page, or sign in to the server again in the browser.

The states, and what you do

/maisecrets:status shows the state of each server and the time of the last answer. At a session start, one line tells you when a state changed. The reason of a refused call uses the same words.

State	What you do in Claude Code	In Codex
not used yet	nothing	nothing
header written	type `/mcp reconnect <server name>` (or start Claude Code again)	start Codex again
waiting for activation until a time	activate it on the server’s connections page, or sign in to the server again in the browser	the same
active	nothing	nothing
quarantined (used by two accounts) or revoked	nothing: maisecrets makes a new key at the next start, and you see the header step again	the same, then start Codex again
the operator switch is off	ask the server’s operator	the same

/maisecrets:settings client_header false turns vault references off and removes the header.

In Codex

A repository can bring its own .codex/config.toml and point your server entry at another URL. A fixed header would then go to that URL. So maisecrets adds a small helper to your entry, and the helper prints the header only when the folder you work in names no MCP servers of its own. In Codex this needs Python 3.11 or later, and it is off on Windows in this version.

Limits

Only tokens from a server that you added yourself count. A token in a file, a web page or a Bash output stays a token.
On Windows, a Bash command gets no server value.
A value written into a file is plain text there.
An AI agent that runs as your user can read the key, as it can read any stored value. The server’s cap, its audit and the revoke bound that.

An open design for every MCP server. Vault references are one implementation of a wider idea: a server gives the model a reference instead of a sensitive value. Sensitive References for MCP explores this as an independent pre-SEP design (repository).

The protocol, the steps on the server side and the answer codes: Local vaults. The client rules: README.