Claude Code mod

secchain-mask

Hides SecChain's secret values in prompts, tool results and instructions before the model reads them, through secchain mask.

Guard & safety modsValidates on Claude Code 2.1.316 Source

Install

From source
git clone https://github.com/bannzai/SecChain.git
claude --plugin-dir ./SecChain/skills/secchain/hooks/mods

The repo has no marketplace file, so load the plugin folder directly with --plugin-dir.

What it can access

Reach
L2Writes or runs: runs processes, reads files, reads env vars, draws
Sees
every prompt, every tool call, the system prompt
Hooks
prompt.submittool.callprompt.sectionprompt.contextprompt.attachment

From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.

How Claude Code mods work

  • A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
  • It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
  • Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
  • Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Claude Code docs

Details

Repository
bannzai/SecChain
Folder
skills/secchain/hooks/mods
Author
bannzai
Type
Guard & safety mods
License
MIT
Last updated
26 October 2026
Listed in
awesome-claude-code-mods

FAQ

What is secchain-mask?

Hides SecChain's secret values in prompts, tool results and instructions before the model reads them, through secchain mask. It is a mod for Claude Code, from bannzai/SecChain on GitHub.

What can the secchain-mask mod access?

Its widest reach is "writes or runs" (runs processes, reads files, reads env vars, draws). It sees every prompt, every tool call, the system prompt. Like any mod, it runs with your permissions.

How do I install secchain-mask?

Clone bannzai/SecChain and start Claude Code with --plugin-dir pointing at the mod's folder (skills/secchain/hooks/mods).

More guard & safety mods

seatbelt

aayanrehman/crew-hq

Blocks destructive commands (rm -rf, force push, reset --hard, DROP TABLE) and .env edits before they run

Guard & safety mods/plugin install

secret-guard

0xGondarxyz/claude-code-mods

Masks API keys and tokens in tool results before Claude reads them, and blocks a git push that would leak secrets or home paths to a public repo.

Guard & safety mods/plugin install

sdd-analyze-gate

fib1618agent/claude-mod-speckit

SDD capability 04: semantic Analyze findings, read-only run guard (best effort), Analyze result state. Execution is delegated through the Review Gate.

Guard & safety mods/plugin install

secret-guard

davidho27941/cockpit

Keeps API keys, cloud credentials and other secrets out of what is sent to the model: every text that enters the conversation is scanned and each match is replaced with a meaningful placeholder such as <google api key>.

Guard & safety mods/plugin install

script-gate

ABDUAZIZX/script-gate

Claude Code mod: blocks running scripts straight from the internet (download-and-execute pipes, encoded PowerShell, LOLBin downloads)

Guard & safety mods/plugin install

secret-guard

hagaybar/claude-secret-guard

Keeps API keys, tokens and passwords out of the transcript, tool output, files, commits, PRs and issues.

Guard & safety mods/plugin install

Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.