Block credentials from AI context windows. Store secrets in encrypted backends. Protect MCP server configs. One command to set up, zero dependencies.
$ npx secretless-ai init
Secretless v0.12.5
Keeping secrets out of AI
Detected:
+ Claude Code
+ Cursor
Configured:
* Claude Code
* Cursor
Created:
+ .claude/hooks/secretless-guard.sh
+ CLAUDE.md
Modified:
~ .claude/settings.json
~ .cursorrules
Done. Secrets are now blocked from AI context..env files with API keysSecretless auto-detects your AI tools, blocks secret access, stores credentials in encrypted backends, and injects them at runtime.
Scans your project for AI tool config files. Finds .claude/, .cursorrules, .aider.conf.yml, and more.
Installs tool-specific protections. Hooks for Claude Code, instruction files for Cursor and Copilot, ignore patterns for Aider.
Secrets go into encrypted backends: local AES-256-GCM, OS keychain, 1Password, Vault, or GCP Secret Manager. Never in .env files or shell profiles.
At runtime, secrets are injected into process memory as environment variables. AI sees the output but never the secret values.
Choose where secrets are stored. All backends encrypt at rest. Secrets exist only in the backend and get injected into process memory at runtime.
AES-256-GCM encrypted file on disk. No external dependencies. Works everywhere Node.js runs.
macOS Keychain or Linux Secret Service. Hardware-backed encryption on Apple Silicon. OS login auth.
Dedicated vault via the op CLI. Biometric unlock (Touch ID). Service accounts for CI/CD. Cross-device sync.
KV v2 secrets engine. Cross-device and cross-cluster sync. Vault token authentication. Namespace isolation.
Google Cloud Secret Manager with IAM integration. Auto-versioned. Native to Cloud Run, GKE, and Cloud Functions.
$ npx secretless-ai backend set 1password
Backend set to 1password
$ npx secretless-ai migrate --from local --to 1password
Migrating 4 secrets from local to 1password...
Done. All secrets migrated.Store, list, and inject secrets without exposing them to AI tools. Import from .env files or set them individually.
$ npx secretless-ai secret set STRIPE_KEY=sk_live_...
Stored STRIPE_KEY
$ npx secretless-ai secret list
ANTHROPIC_API_KEY
OPENAI_API_KEY
STRIPE_KEY
DATABASE_URL# Inject all secrets into a command
$ npx secretless-ai run -- npm test
# Inject only specific keys
$ npx secretless-ai run --only STRIPE_KEY -- npm start
# Import from existing .env files
$ npx secretless-ai import --detect
Found .env (4 secrets)
Found .env.local (2 secrets)
Imported 6 secrets.Every MCP server config has plaintext API keys in JSON files. The LLM sees them. Secretless encrypts them.
$ npx secretless-ai protect-mcp
Secretless MCP Protection
Scanned 1 client(s)
+ claude-desktop/browserbase
BROWSERBASE_API_KEY (encrypted)
+ claude-desktop/github
GITHUB_PERSONAL_ACCESS_TOKEN (encrypted)
+ claude-desktop/stripe
STRIPE_SECRET_KEY (encrypted)
3 secret(s) encrypted across 3 server(s).{
"mcpServers": {
"stripe": {
"command": "npx",
"args": ["-y", "@stripe/mcp"],
"env": {
"STRIPE_SECRET_KEY": "sk_live_51Hx..."
}
}
}
}{
"mcpServers": {
"stripe": {
"command": "secretless-mcp",
"args": ["npx", "-y", "@stripe/mcp"],
"env": {}
}
}
}Define organization-specific patterns to block. Company env vars, internal config files, proprietary CLI tools. The rules file contains patterns, not secrets — safe to commit to version control.
# Block org-specific environment variables
env:
- ACME_*
- INTERNAL_DB_*
# Block proprietary config files
files:
- "*.corp-secret"
- "internal-config.*"
# Block commands that access internal systems
bash:
- "curl*internal.corp.com*"
- "vault read*"$ npx secretless-ai rules initPreview what deny rules a pattern generates before applying. List active rules to audit coverage.
$ npx secretless-ai rules test "ACME_*"
$ npx secretless-ai rules listWhen an AI tool tries to read a secret value, secretless detects the non-interactive context and blocks output.
$ npx secretless-ai secret get STRIPE_KEY
secretless: Blocked
Secret values cannot be read in non-interactive contexts.
AI tools capture stdout, which would expose the
secret in their context.
To inject secrets into a command:
npx secretless-ai run -- <command>Direct terminal access (human) works normally. The guard detects non-interactive execution — which is how AI tools run commands — and refuses to output secret values.
Credential permissions change over time as platforms evolve. Scope discovery detects when a credential's effective permissions expand beyond its baseline, catching privilege escalation before it becomes a breach.
# Discover current permissions, save baseline
$ npx secretless-ai scope discover MY_GCP_KEY
# Compare current permissions to saved baseline
$ npx secretless-ai scope check MY_GCP_KEY
# List all stored baselines
$ npx secretless-ai scope list
# Clear a baseline to re-discover
$ npx secretless-ai scope reset MY_GCP_KEYtestIamPermissionscapabilities-selfAll providers use self-inspection APIs. No additional permissions required.
Add scopeCheck: true to any broker policy rule. The broker blocks credential access if the scope has expanded beyond its saved baseline.
Runtime credential access control and AI transcript scanning. Detect leaked credentials in shell history and conversation logs. Available standalone or through the OpenA2A CLI.
secretless-ai brokerIdentity-aware credential access control daemon. Enforces deny-all policies so each credential is only accessible to authorized agents. Supports AIM identity verification, trust score constraints, and rate limiting.
$ npx secretless-ai broker start
$ npx secretless-ai broker status
$ npx secretless-ai broker stopsecretless-ai scan / clean / watchScan AI tool transcripts, shell history, and conversation logs for leaked credentials. Redact findings in place or preview with dry-run. Set up real-time monitoring to catch leaks as they happen.
# Scan shell history for credentials
$ npx secretless-ai scan --history
# Redact credentials in shell history
$ npx secretless-ai clean-history
# Scan and redact AI transcripts
$ npx secretless-ai clean
$ npx secretless-ai clean --last
# Start real-time transcript monitoring
$ npx secretless-ai watch start| Tool | Protection Method | Strength |
|---|---|---|
| Claude Code | PreToolUse hook + deny rules + instructions | Strongest |
| Cursor | .cursorrules instructions | Good |
| GitHub Copilot | .github/copilot-instructions.md | Good |
| Windsurf | .windsurfrules instructions | Good |
| Cline | .clinerules instructions | Good |
| Aider | .aiderignore patterns | Good |
Claude Code gets the strongest protection because it supports hooks — a shell script runs before every file read and blocks access at the tool level.
.env, .env.*, .env.local, .env.production*.key, *.pem, *.p12, *.pfx, *.crt.aws/credentials, .ssh/*, .docker/config.json.npmrc, .pypirc, .git-credentials*.tfstate, *.tfvarssecrets/, credentials/Pre-commit hook scans staged files for secrets before they enter git history. Catches what .gitignore misses.
$ npx secretless-ai hook install
Installed pre-commit hook.
$ npx secretless-ai hook status
Pre-commit hook: installed
Patterns: 49 credential patterns active