Claude Code mod
secret-guard
Hides every secret value in tool output as <hidden:NAME> before the agent reads it, MCP and subagent output included, and writes the real value back when the agent puts the placeholder into a .env or secrets file.
Install
/plugin marketplace add joaosavi/cockpit
/plugin install secret-guard@cockpitMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, writes files, reads files, reads env vars
- Sees
- every tool call
- Hooks
session.starttool.callsession.end
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- joaosavi/cockpit
- Folder
secret-guard- Marketplace
cockpit- Author
- João Savi
- License
- MIT
- Last updated
- 5 November 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is secret-guard?
Hides every secret value in tool output as <hidden:NAME> before the agent reads it, MCP and subagent output included, and writes the real value back when the agent puts the placeholder into a .env or secrets file. It is a mod for Claude Code, from joaosavi/cockpit on GitHub.
What can the secret-guard mod access?
Its widest reach is "writes or runs" (runs processes, writes files, reads files, reads env vars). It sees every tool call. Like any mod, it runs with your permissions.
How do I install secret-guard?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add joaosavi/cockpit and then /plugin install secret-guard@cockpit.
More guard & safety mods
sandbox-guard
oleksandrkodua/qa-mods
Denies Edit/Write/Bash writes to Claude config paths the sandbox cannot write (settings, skills, plugins, hooks, projects, ...) and tells Claude to hand the user a ready Terminal command instead of trying workarounds.
security-guard
UsamaSadiq/claude-mods
Checks git commit and PR commands against the rules in your own and the project's CLAUDE.md files
rm-guard
vincentlauriat/ModsTools
Asks the user before destructive Bash commands run: rm -rf, git reset --hard, git clean -f, discarding all changes, SQL DROP/TRUNCATE, find -delete, mkfs, dd onto a device
transcript-fx
LegendSilvia/claude-code-mods
Gold tool blocks, teal prompt panels, an animated spinner bar and a rainbow turn footer in the transcript
read-only-lock
blackironj/claude-mods
After a look-only prompt (English or Korean), block edits and mutating commands until you unlock
mem-guard
3schreibse/claude-code-mods
Bash memory rules: Node commands run in claude-cmd.slice, and runs that would starve the machine are refused
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.