maisecrets / Where it works
Where it works: Claude Code, Codex and more
maisecrets works where the client runs plugin hooks. This table says what is proven, what the vendor documents, and where no plugin can help.
Choose your client
In short: use Claude Code (in the terminal or the desktop app) or Codex. There maisecrets guards all three paths. Other clients lack a hook it needs, and a chat app has none.
What the marks mean
The three columns are the three guards. Prompt: maisecrets blocks or rewrites a prompt that carries a value. Real call: it puts the real value into a command or a tool call. Tool output: it masks what a tool returns before the model reads it. A mod is an add-on of Claude Code 2.1.287 and later that lets maisecrets rewrite a prompt instead of blocking it.
All clients
| Client | Prompt | Real call | Tool output | Status |
|---|---|---|---|---|
| Claude Code CLI | ✅ | ✅ | ✅ | Built and proven by the test harness. From 0.6: with mods (2.1.287+) the prompt is rewritten, not blocked. On Windows without Git Bash the shell tool is PowerShell, and a placeholder in a PowerShell command is refused. |
| Claude desktop app, Code tab | ✅ | ✅ | ✅ | Same hooks. Seen live, not in the harness. From 0.6 the mod rewrites the prompt (seen with Claude Code 2.1.288). |
| Cowork | ✅ | ✅ | ✅ | Same hooks as the desktop app. Whether the mod loads there is not measured, so count on the block. |
| Codex CLI | ✅ | ✅ | ✅ | Built and proven by the test harness. Trust the hooks in /hooks, and from Codex 0.164 again after each update. |
| Codex in the ChatGPT desktop app | ✅ | ✅ | ✅ | Seen live, not in the harness. Trust the hooks under Settings > Hooks, again after each update; the list appears only with a project open. |
| Codex IDE extension | ☑️ | ☑️ | ☑️ | Same plugin runtime. Not measured. |
| Cursor | ☑️ | ☑️ | ⚠️ | Waits for a shell-output hook. |
| Copilot CLI | ⚠️ | ☑️ | ☑️ | Waits for a prompt hook. |
| Chat apps, web, mobile | ❌ | ❌ | ❌ | No hooks. The plugin cannot help here. |
✅ proven by the harness in the repository, or seen live where the row says so · ☑️ possible per the vendor's hook documentation, not measured · ⚠️ partly · ❌ no hook. A client without a prompt or an output guard cannot be made safe by a plugin. We do not ship an adapter that would look protected and leak.
The marks follow the client table of the README, which names the client versions that were measured. “Proven” means the test harness of the repository runs the real client against a fake server, or the behaviour was seen live where the row says so.