What is secret-mask?
secret-mask is a Claude Code mod by mashabek that masks secrets (API keys, tokens, passwords, .env values) in tool output and prompts before Claude reads them. It is listed under Security and has no public popularity data yet.
| Type | Claude code mod |
|---|---|
| Author | mashabek |
| Repository | mashabek/claude-mods |
| Popularity | no public popularity data yet |
| Category | Security |
| Security | Review before installing (76/100) |
| Rank | #3,920 of 5,272 Claude Code mods; #411 in Security |
| License | MIT |
| Last commit | 2026-10-04 |
| Hooks | 4 events |
| Sees | only the events it hooks |
| Draws on | nothing |
Is secret-mask safe to install?
secret-mask scores 76/100 on the MCPMods security check: Review before installing. Things to review: starts processes outside the sandbox; reads environment variables. It passed 6 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts processes outside the sandbox | Review |
| Writes no files or config | Pass |
| Reads environment variables | Review |
| Only sees the events it hooks | Pass |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| Has an open-source license | Pass |
API calls in its code
| Call | What it means |
|---|---|
$.command.register | |
$.env.get | reads env vars |
$.fs.read | reads files |
$.process.run | runs processes |
$.session.cwd | |
$.store.get | keeps its own state |
$.store.set | keeps its own state |
$.ui.status | draws interface |
How do I install secret-mask?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/mashabek/claude-mods claude plugin validate ./claude-mods/plugins/secret-mask
- Install it. Run this in your terminal, then /reload-plugins in an open session.
claude plugin marketplace add mashabek/claude-mods && claude plugin install secret-mask@claude-mods
Or ask Claude to set it up
Paste this into Claude Code and it installs secret-mask for you:
Install the "secret-mask" Claude Code mod from https://github.com/mashabek/claude-mods/tree/main/plugins/secret-mask. Run claude plugin validate on it first and show me what it can access before you enable it.