What is secret-scrub?
secret-scrub is a Claude Code mod by pradyb that catches API keys, tokens and private keys in the prompt you are about to send, and masks or blocks them before they reach the model. It is listed under Security and has no public popularity data yet.
| Type | Claude code mod |
|---|---|
| Author | pradyb |
| Repository | pradyb/claude-mods |
| Popularity | no public popularity data yet |
| Category | Security |
| Security | Low risk (88/100) |
| Rank | #4,325 of 5,272 Claude Code mods; #452 in Security |
| License | MIT |
| Last commit | 2026-10-16 |
| Hooks | 1 events |
| Sees | every prompt |
| Draws on | nothing |
Is secret-scrub safe to install?
secret-scrub scores 88/100 on the MCPMods security check: Low risk. Things to review: watches every prompt or event. It passed 7 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts no processes | Pass |
| Writes no files or config | Pass |
| Doesn't read environment variables | Pass |
| Watches every prompt or event | Review |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| Has an open-source license | Pass |
API calls in its code
| Call | What it means |
|---|---|
$.ui.toast | draws interface |
How do I install secret-scrub?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/pradyb/claude-mods claude plugin validate ./claude-mods/secret-scrub
- Install it. Run this in your terminal, then /reload-plugins in an open session.
claude plugin marketplace add pradyb/claude-mods && claude plugin install secret-scrub@pradyb-mods
Or ask Claude to set it up
Paste this into Claude Code and it installs secret-scrub for you:
Install the "secret-scrub" Claude Code mod from https://github.com/pradyb/claude-mods/tree/main/secret-scrub. Run claude plugin validate on it first and show me what it can access before you enable it.
More from pradyb/claude-mods
This repository has 8 Claude Code mods on MCPMods.
- focus-panel: After each response, a panel above the prompt with what needs you, errors, the next action (with its task id), open to-d (Low risk)
- handover: /handover writes a handover note from the conversation (served from the prompt cache), saves it under ~/.claude/projects (Review before installing)
- notify-router: Rules for Claude Code alerts: when one is worth sending (done, blocked, error, usage limits) and where it goes (chime, m (Review before installing)
- read-budget: Stops Claude from re-reading the same large, unchanged file in full again and again in one session: past a limit it is p (Low risk)
- safety-guard: Blocks destructive shell commands and access to secret files (.env, SSH keys, cloud credentials). (Low risk)
- status-bar: A status bar above the prompt with folder, git branch and state, 5-hour and 7-day usage bars, context with tokens, promp (Review before installing)
- worktree-hints: In a worktree session, tells Claude up front which commands the worktree guard refuses (heredoc and inline-script edits, (Low risk)