Claude Code mod
secret-guard
Blocks API keys, tokens and private keys from being written to disk, put on a command line, or committed to git by Claude.
Install
/plugin marketplace add verastack-labs/secret-guard
/plugin install secret-guard@secret-guardMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, reads mod state, draws
- Sees
- Write calls, Edit calls, NotebookEdit calls, Bash calls, PowerShell calls
- Hooks
session.startcommand.runtool.call
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- verastack-labs/secret-guard
- Folder
.- Marketplace
secret-guard- Author
- VeraStack Labs
- License
- Apache-2.0
- Last updated
- 14 October 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is secret-guard?
Blocks API keys, tokens and private keys from being written to disk, put on a command line, or committed to git by Claude. It is a mod for Claude Code, from verastack-labs/secret-guard on GitHub.
What can the secret-guard mod access?
Its widest reach is "writes or runs" (runs processes, reads mod state, draws). It sees Write calls, Edit calls, NotebookEdit calls, Bash calls, PowerShell calls. Like any mod, it runs with your permissions.
How do I install secret-guard?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add verastack-labs/secret-guard and then /plugin install secret-guard@secret-guard.
More guard & safety mods
secret-guard
tksunw/secret-guard
Blocks git commit and git push from Claude when the change carries a secret file or a credential-shaped line, and flags secret files that are not gitignored
secret-mask
mashabek/claude-mods
Masks secrets (API keys, tokens, passwords, .env values) in tool output and prompts before Claude reads them
secret-guard
Sajid-Rahman0126/claude-studio-mods
Stops Claude from reading or editing .env files, private keys and credential files, including through symlinks and shell commands
secret-mod
zyx1121/secret-mod
Ask for credentials in a form, keep them in the macOS keychain, and run commands with them without showing the values to Claude
secret-guard
nicolas-fer/secret-guard
Bloqueia prompts e saídas de ferramentas que contenham chaves/segredos antes de chegarem ao modelo
secret-redactor
jidhra/claude-mods
Keeps secrets, email addresses and IP addresses out of the session transcript: swaps each one for a stable placeholder on the way in, and puts the real value back on the way into a tool call
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.