maisecrets menu

maisecrets / With mcpgate

maisecrets and mcpgate, together

mcpgate is the gateway between your AI and your company's tools: it pseudonymizes personal data in their results. maisecrets runs on your computer and guards what never passes the gateway. Vault references join the two.

The model placeholders and tokens only YOUR COMPUTER You prompt, .env, files AI client Claude Code, Codex maisecrets masks secrets and PII in prompts and output puts real values back Local files, commands get the real value mcpgate pseudonymizes PII in tool results policy hooks, audit log resolve endpoint Company tools Jira, Slack, CRM, mail ⟦SECRET_c1⟧, ⟦EMAIL_1⟧ prompts and results, by hooks call with ⟦EMAIL_1⟧ result, tokens real value data real value vault reference key → value
Orange is the real value. It goes to a company tool through mcpgate, and into a local file or command through maisecrets. The model gets two kinds of stand-in: a placeholder with a c in its key (SECRET_c1) is maisecrets’ own, kept in your local vault; a token without it (EMAIL_1) is mcpgate’s, kept in the gateway.

Who protects what

The valueWhere it goesWho protects it
A password you type, a key in .env, a token in command outputstays on your computermaisecrets: the model gets a placeholder, your command the real value
A customer’s address in a Jira ticket or a CRM recordcomes from a company toolmcpgate: the model gets a token
That address in a reply the AI posts back to the toolgoes to a company toolmcpgate puts the real value into the call
That address in a letter the AI writes into a local filegoes to your diskmaisecrets asks mcpgate for the value (Sensitive Reference in Claude Code, or vault reference)

Why both

A gateway protects what goes through it. We counted our own Claude Code sessions: 185 real credentials across 3,254 sessions, and 80% of them never passed the gateway. They came from files and commands on the laptop. maisecrets covers that part, and vault references let a local file get a value that only mcpgate knows.

Each one works alone. maisecrets is free and does not need mcpgate. mcpgate does not need maisecrets.

Set it up

  1. Run mcpgate and connect your tools.
  2. Install maisecrets in Claude Code or Codex.
  3. For vault references, the operator of mcpgate turns on “Let local vaults read values”. The steps and the states: Vault references. The protocol: Local vaults.
  4. For Sensitive References, the administrator of your gateway turns them on for an allow list of users, and each user approves a program each time it signs in. The feature is experimental.