Claude Code mod

env-protect

Asks the user before Claude reads secret files (.env, private keys, .netrc, .npmrc, .aws/credentials, keychains…) with Read, Grep, Glob or Bash

Guard & safety modsValidates on Claude Code 2.1.316 Source

Install

From source
git clone https://github.com/vincentlauriat/ModsTools.git
claude --plugin-dir ./ModsTools/mods/env-protect

The repo has no marketplace file, so load the plugin folder directly with --plugin-dir.

What it can access

Reach
L1Reads: reads mod state, draws
Hooks
session.startcommand.runtool.check

From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.

How Claude Code mods work

  • A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
  • It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
  • Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
  • Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Claude Code docs

Details

Repository
vincentlauriat/ModsTools
Folder
mods/env-protect
Author
Vincent Lauriat
Type
Guard & safety mods
License
MIT
Last updated
5 October 2026
Listed in
awesome-claude-code-mods

FAQ

What is env-protect?

Asks the user before Claude reads secret files (.env, private keys, .netrc, .npmrc, .aws/credentials, keychains…) with Read, Grep, Glob or Bash It is a mod for Claude Code, from vincentlauriat/ModsTools on GitHub.

What can the env-protect mod access?

Its widest reach is "reads" (reads mod state, draws). Like any mod, it runs with your permissions.

How do I install env-protect?

Clone vincentlauriat/ModsTools and start Claude Code with --plugin-dir pointing at the mod's folder (mods/env-protect).

More guard & safety mods

guardian

3

Plagemes/claude-mods

One security policy for every guard mod — permissive, standard or strict — plus a project safety score.

Guard & safety mods/plugin install

secret-redactor

oleksandrkodua/qa-mods

Masks API keys, tokens, private keys and password assignments in tool results before the model sees them.

Guard & safety mods/plugin install

oracle-paging-guard

1

MatheusChiodi/cockpit

Refuses an edit that adds FETCH FIRST, OFFSET ROWS or LIMIT to SQL, which Oracle 11g cannot run, and names the ROWNUM form

Guard & safety mods

reply-size

1

MatheusChiodi/cockpit

Under a long reply block, shows its word count and how many code blocks it holds, so you can decide whether to read it now

Guard & safety mods

env-guard

3

seanrobertwright/claude-mods

Asks you before Claude reads a .env or key file, and refuses when no one is there to answer.

Guard & safety mods/plugin install

debug-flag-guard

1

MatheusChiodi/cockpit

Asks before an edit leaves a debug flag on, exposes every actuator endpoint or sets development mode in a production file

Guard & safety mods/plugin install

Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.