Claude Code mod
secret-guard
Keeps API keys and tokens out of Claude's context, your files and your commits: hides them in tool output, and asks before a write, commit or push adds one.
Install
/plugin marketplace add hamzafer/claude-code-mods
/plugin install secret-guard@claude-code-modsMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, reads files, reads env vars, draws
- Sees
- Write calls, Edit calls, NotebookEdit calls, Bash calls, every tool call
- Hooks
session.startcommand.runtool.call
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- hamzafer/claude-code-mods
- Folder
mods/secret-guard- Marketplace
claude-code-mods- Author
- Hamza Zafar
- License
- MIT
- Last updated
- 5 November 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is secret-guard?
Keeps API keys and tokens out of Claude's context, your files and your commits: hides them in tool output, and asks before a write, commit or push adds one. It is a mod for Claude Code, from hamzafer/claude-code-mods on GitHub.
What can the secret-guard mod access?
Its widest reach is "writes or runs" (runs processes, reads files, reads env vars, draws). It sees Write calls, Edit calls, NotebookEdit calls, Bash calls, every tool call. Like any mod, it runs with your permissions.
How do I install secret-guard?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add hamzafer/claude-code-mods and then /plugin install secret-guard@claude-code-mods.
Is secret-guard popular?
hamzafer/claude-code-mods has 449 GitHub stars and 0 forks, and is included in 1 curated Claude Code list. It was last updated on 5 November 2026.
More guard & safety mods
vibeship
2wag-me/vibeship
Vibeship: a 3D spaceship where your Claude Code agents work in crew uniforms. Pick the deck, furnish the stations, chat with the agents and approve permissions. Command: /vibeship
bash-guardrails
ruihe774/cc-bash-guardrails
Tool-call guard rules (parser-based), written in CEL; add your own in ~/.claude/bash-guardrails.json or .claude/bash-guardrails.json. On by default: blocks malformed bash and find rooted at /. Opt-in: Monitor, find without -xdev, pgrep/pkill pitfalls, until-grep loops, sudo, run0 confirmation, and pointing cat/head/sed/awk, heredoc writes, sed -i and Python rewrites to the Read, Write and Edit tools
vanguard
2XXX1694/Vanguard
Command center for Claude Code: a live pane for your squad of subagents, limits and context, an orchestrator that fans work out to specialist agents, bundled MCP servers and skills, and a lifetime profile with levels and achievements.
lemo-guard
63lemomo-ai/lemo-mod
限时：Claude 单轮工作超时自动中止 · 等你确认的时间不计 · 默认关闭，在「安全」页开启 / Time limit: stops Claude when a turn runs over time · time waiting for you does not count · off by default, switch on in Safety
tamirs-superpowers-guard
2Tamircohen28/tamirs-superpowers
In-process guard for tamirs-superpowers: holds a destructive shell command (force push, rm -rf, git reset --hard, ...) until you answer Proceed or Cancel, and refuses a file write in the main checkout while an orchestration objective is active. Companion to the core plugin; Claude Code and Claude Desktop only.
blast-guard
1satyamk4517/claude-mods
Holds risky shell commands for a yes/no with a dry-run report, blocks Python heredocs carrying backslash escapes, and caps concurrent subagents at 4.
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.