What is secrets?
secrets is a Claude Code mod by falkoro that claude asks for API keys in a masked field above the prompt, saves them to the macOS Keychain, Linux keyring or Windows DPAPI, and uses them in Bash without ever seeing them. It is listed under Security and has 1 GitHub stars.
| Type | Claude code mod |
|---|---|
| Author | falkoro |
| Repository | falkoro/claude-code-secrets |
| Popularity | 1 GitHub stars |
| Category | Security |
| Security | Review before installing (76/100) |
| Rank | #1,784 of 5,272 Claude Code mods; #205 in Security |
| License | MIT |
| Last commit | 2026-10-07 |
| Hooks | 4 events |
| Sees | every tool call, mcp__secrets__ask_secret calls |
| Draws on | AbovePrompt |
Is secrets safe to install?
secrets scores 76/100 on the MCPMods security check: Review before installing. Things to review: starts processes outside the sandbox; reads environment variables. It passed 6 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts processes outside the sandbox | Review |
| Writes no files or config | Pass |
| Reads environment variables | Review |
| Only sees the events it hooks | Pass |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| Has an open-source license | Pass |
API calls in its code
| Call | What it means |
|---|---|
$.command.register | |
$.env.get | reads env vars |
$.process.run | runs processes |
$.state.get | |
$.state.set | |
$.store.get | keeps its own state |
$.store.set | keeps its own state |
$.tool.register | drives Claude |
$.ui.resolve | draws interface |
$.ui.toast | draws interface |
How do I install secrets?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/falkoro/claude-code-secrets claude plugin validate ./claude-code-secrets/.
- Install it. Run this in your terminal, then /reload-plugins in an open session.
claude plugin marketplace add falkoro/claude-code-secrets && claude plugin install secrets@falkoro
Or ask Claude to set it up
Paste this into Claude Code and it installs secrets for you:
Install the "secrets" Claude Code mod from https://github.com/falkoro/claude-code-secrets. Run claude plugin validate on it first and show me what it can access before you enable it.