Claude Code mod
secrets
Hand Claude an API token without it reading the value: you type it into a field above the prompt, Claude uses it in Bash as $NAME, and it is redacted from every tool result.
Install
/plugin marketplace add crockalet/claude-mods
/plugin install secrets@claude-modsMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, drives Claude, reads mod state, draws
- Sees
- subagent spawns, every prompt, mcp__secrets__request_secret calls, every tool call
- Draws in
AbovePrompt- Hooks
session.startsession.endprompt.composeagent.spawnprompt.editsession.appendprompt.submittool.callturn.completetool.checkcommand.runui.render
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- crockalet/claude-mods
- Folder
plugins/secrets- Marketplace
claude-mods- Author
- crockalet
- Last updated
- 12 October 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is secrets?
Hand Claude an API token without it reading the value: you type it into a field above the prompt, Claude uses it in Bash as $NAME, and it is redacted from every tool result. It is a mod for Claude Code, from crockalet/claude-mods on GitHub.
What can the secrets mod access?
Its widest reach is "writes or runs" (runs processes, drives Claude, reads mod state, draws). It sees subagent spawns, every prompt, mcp__secrets__request_secret calls, every tool call. It draws in AbovePrompt. Like any mod, it runs with your permissions.
How do I install secrets?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add crockalet/claude-mods and then /plugin install secrets@claude-mods.
Is secrets popular?
crockalet/claude-mods has 1 GitHub stars and 0 forks, and is included in 1 curated Claude Code list. It was last updated on 12 October 2026.
More guard & safety mods
secret-mask
1Fazzani/claude-mods
Masks secrets (API keys, tokens, passwords, private keys) in the transcript; hover a masked value to reveal it.
secrets
1falkoro/claude-code-secrets
Claude asks for API keys in a masked field above the prompt, saves them to the macOS Keychain, Linux keyring or Windows DPAPI, and uses them in Bash without ever seeing them
secret-guard
1legostin/claude-code-secret-guard
Keeps secrets out of Claude's context: gitleaks scans every tool output, prompt and attachment before the model reads it, and you decide what the model sees.
smartworkbench
1nathak/smart-workbench
SmartWorkbench for Claude Code: set the task contract, pin context, guard tool calls and verify the result
scope-cop
1candygoogy/notary
Claude stays inside the scope you set, and asks before leaving it. Edits outside it are flagged, or blocked if you want.
test-guard
1Justmalhar/awesome-claude-mods
Blocks edits that make tests pass by weakening them: new skip/only markers, fewer assertions, a gutted test file, or deleting a test file.
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.