What is secret-guard?
secret-guard is a Claude Code mod by arasovic that keeps secrets out of the conversation: hides API keys and private keys before the model or the transcript sees them, and blocks reads of credential files and commands that print secrets. It is listed under Security and has 6 GitHub stars.
| Type | Claude code mod |
|---|---|
| Author | arasovic |
| Repository | arasovic/claude-code-mods |
| Popularity | 6 GitHub stars |
| Category | Security |
| Security | Low risk (88/100) |
| Rank | #619 of 5,272 Claude Code mods; #81 in Security |
| License | MIT |
| Last commit | 2026-10-17 |
| Hooks | 3 events |
| Sees | every tool call |
| Draws on | nothing |
Is secret-guard safe to install?
secret-guard scores 88/100 on the MCPMods security check: Low risk. Things to review: reads environment variables. It passed 7 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts no processes | Pass |
| Writes no files or config | Pass |
| Reads environment variables | Review |
| Only sees the events it hooks | Pass |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| Has an open-source license | Pass |
API calls in its code
| Call | What it means |
|---|---|
$.env.get | reads env vars |
$.fs.stat | reads files |
$.ui.status | draws interface |
How do I install secret-guard?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/arasovic/claude-code-mods claude plugin validate ./claude-code-mods/secret-guard
- Install it. Run this in your terminal, then /reload-plugins in an open session.
claude plugin marketplace add arasovic/claude-code-mods && claude plugin install secret-guard@claude-code-mods
Or ask Claude to set it up
Paste this into Claude Code and it installs secret-guard for you:
Install the "secret-guard" Claude Code mod from https://github.com/arasovic/claude-code-mods/tree/main/secret-guard. Run claude plugin validate on it first and show me what it can access before you enable it.
More from arasovic/claude-code-mods
This repository has at least 9 Claude Code mods on MCPMods.
- cache-timer: Counts down to when the prompt cache expires, so you can send the next message before the whole conversation has to be c (Low risk)
- change-ledger: Lists the files this session edited in a pane (/changes), with line counts and who edited them, beside the git working t (Low risk)
- ci-watch: Watches GitHub Actions in a band above the prompt after Claude pushes, opens a PR or pushes a tag: a progress bar per ru (Review before installing)
- compact-keeper: Saves each compaction's summary, with the files edited before it, to ~/.claude/handoffs so the context before /compact c (Review before installing)
- guardrails: Blocks shell commands you pick in /config: Cloudflare cf writes, attribution lines in commits and PRs, claude/ branch na (Low risk)
- image-peek: Shows the images you paste: thumbnails above the prompt, and larger pictures under each sent message in the chat; needs (Review before installing)
- loop-guard: Tells the model, out of the user's sight, to stop when the same call fails twice with the same error (Low risk)
- pin-board: Pins standing notes with /pin that Claude keeps following after /compact and /clear; shows them in one row above the pro (Low risk)