Block credentials from AI context windows. Store secrets in encrypted backends. Protect MCP server configs. One command to set up, zero dependencies.
$ npx secretless-ai init
Secretless v0.8.0
Keeping secrets out of AI
Detected:
+ Claude Code
+ Cursor
Configured:
* Claude Code
* Cursor
Created:
+ .claude/hooks/secretless-guard.sh
+ CLAUDE.md
Modified:
~ .claude/settings.json
~ .cursorrules
Done. Secrets are now blocked from AI context..env files with API keysSecretless auto-detects your AI tools, blocks secret access, stores credentials in encrypted backends, and injects them at runtime.
Scans your project for AI tool config files. Finds .claude/, .cursorrules, .aider.conf.yml, and more.
Installs tool-specific protections. Hooks for Claude Code, instruction files for Cursor and Copilot, ignore patterns for Aider.
Secrets go into encrypted backends: local AES-256-GCM, OS keychain, or 1Password. Never in .env files or shell profiles.
At runtime, secrets are injected into process memory as environment variables. AI sees the output but never the secret values.
Choose where secrets are stored. All backends encrypt at rest. Secrets exist only in the backend and get injected into process memory at runtime.
AES-256-GCM encrypted file on disk. No external dependencies. Works everywhere Node.js runs.
macOS Keychain or Linux Secret Service. Hardware-backed encryption on Apple Silicon. OS login auth.
Dedicated vault via the op CLI. Biometric unlock (Touch ID). Service accounts for CI/CD. Cross-device sync.
$ npx secretless-ai backend set 1password
Backend set to 1password
$ npx secretless-ai migrate --from local --to 1password
Migrating 4 secrets from local to 1password...
Done. All secrets migrated.Store, list, and inject secrets without exposing them to AI tools. Import from .env files or set them individually.
$ npx secretless-ai secret set STRIPE_KEY=sk_live_...
Stored STRIPE_KEY
$ npx secretless-ai secret list
ANTHROPIC_API_KEY
OPENAI_API_KEY
STRIPE_KEY
DATABASE_URL# Inject all secrets into a command
$ npx secretless-ai run -- npm test
# Inject only specific keys
$ npx secretless-ai run --only STRIPE_KEY -- npm start
# Import from existing .env files
$ npx secretless-ai import --detect
Found .env (4 secrets)
Found .env.local (2 secrets)
Imported 6 secrets.Every MCP server config has plaintext API keys in JSON files. The LLM sees them. Secretless encrypts them.
$ npx secretless-ai protect-mcp
Secretless MCP Protection
Scanned 1 client(s)
+ claude-desktop/browserbase
BROWSERBASE_API_KEY (encrypted)
+ claude-desktop/github
GITHUB_PERSONAL_ACCESS_TOKEN (encrypted)
+ claude-desktop/stripe
STRIPE_SECRET_KEY (encrypted)
3 secret(s) encrypted across 3 server(s).{
"mcpServers": {
"stripe": {
"command": "npx",
"args": ["-y", "@stripe/mcp"],
"env": {
"STRIPE_SECRET_KEY": "sk_live_51Hx..."
}
}
}
}{
"mcpServers": {
"stripe": {
"command": "secretless-mcp",
"args": ["npx", "-y", "@stripe/mcp"],
"env": {}
}
}
}When an AI tool tries to read a secret value, secretless detects the non-interactive context and blocks output.
$ npx secretless-ai secret get STRIPE_KEY
secretless: Blocked
Secret values cannot be read in non-interactive contexts.
AI tools capture stdout, which would expose the
secret in their context.
To inject secrets into a command:
npx secretless-ai run -- <command>Direct terminal access (human) works normally. The guard detects non-interactive execution — which is how AI tools run commands — and refuses to output secret values.
| Tool | Protection Method | Strength |
|---|---|---|
| Claude Code | PreToolUse hook + deny rules + instructions | Strongest |
| Cursor | .cursorrules instructions | Good |
| GitHub Copilot | .github/copilot-instructions.md | Good |
| Windsurf | .windsurfrules instructions | Good |
| Cline | .clinerules instructions | Good |
| Aider | .aiderignore patterns | Good |
Claude Code gets the strongest protection because it supports hooks — a shell script runs before every file read and blocks access at the tool level.
.env, .env.*, .env.local, .env.production*.key, *.pem, *.p12, *.pfx, *.crt.aws/credentials, .ssh/*, .docker/config.json.npmrc, .pypirc, .git-credentials*.tfstate, *.tfvarssecrets/, credentials/Pre-commit hook scans staged files for secrets before they enter git history. Catches what .gitignore misses.
$ npx secretless-ai hook install
Installed pre-commit hook.
$ npx secretless-ai hook status
Pre-commit hook: installed
Patterns: 49 credential patterns active