Safe Keys
You are working with Claude Code. A service emails you a new API key. You paste it into the chat and say "set this". That key is now in the conversation, in the transcript file on your disk, on your screen, and in the model's context. It stays in that transcript for as long as the file exists.
Safe Keys is a Claude Code mod that catches the key the moment you submit it, stores it outside the conversation, and shows it everywhere as a name instead: $OPENROUTER_API_KEY, $BRIGHTDATA_API_KEY, $SAFE_KEY_1. When a tool needs the real value, it gets it, for that one command, and the output that comes back is cleaned before the model reads it.
A mod is a plugin whose code runs inside Claude Code itself, on events such as a submitted prompt, a tool call, or a row being drawn. That is what lets Safe Keys act before the key reaches the transcript, which no settings hook, skill or MCP server can do.
I built it after pasting a Bright Data key into my own session and watching the redactor I had at the time miss it. The miss is explained in docs/DETAILS.md, and the fix is the context rule in lib/detect.js.
Created by Mark Fulton of Reinventing.AI, founder of Vibe Coding is Life (340,000+ members).
Install
One line, at the prompt of a Claude Code session:
/plugin install safe-keys --marketplace markfulton/safe-keys
Claude Code asks once whether to add the marketplace (y), then which scope to install at. Choose Install for you. The mod is active in that session from then on, and in every session after it.
From a shell, with no session open:
claude plugin install safe-keys --marketplace markfulton/safe-keys
In the Claude desktop app, where /plugin does not run: click + next to the prompt box, then Plugins, Add marketplace with markfulton/safe-keys, then Add plugin and pick Safe Keys.
To check it loaded, run /plugin. The dim line under the tabs reads 1 mod active · safe-keys. Then paste a key and watch the row change to a name.
You need Claude Code 2.1.287 or newer in the terminal, or the desktop app from 2.1.286 (/status shows the version). Git fetches the marketplace. node on the PATH is needed for the on-disk pass; the in-memory layers run without it. If you set CLAUDE_CODE_ENABLE_FUNCTION_HOOKS during the early access period, remove it: mods are on by default now and the setting does nothing.
Other ways to load it:
- One session, from a clone:
claude --plugin-dir /path/to/safe-keys
- Every session, without a marketplace:
git clone https://github.com/markfulton/safe-keys ~/.claude/skills/safe-keys. Claude Code loads any plugin folder it finds there.
- Update:
claude plugin update safe-keys@safe-keys, then /reload-plugins or a new session.
What it does on your machine, before you install it
A mod runs with your permissions, so read this part. claude plugin validate lists what Safe Keys hooks and calls without running it; this is what it reports and why:
| It does | Why |
|---|
Hooks prompt.edit, prompt.submit, session.append, tool.call, ui.render, turn.complete, session.start, session.end | The places a key could land, listed under How it works |
Writes environment variables under 69 fixed names (OPENAI_API_KEY, GITHUB_TOKEN, SAFE_KEY_1 and the rest) | So a Bash or PowerShell command can use $NAME as a real variable and the value never enters the command text |
Reads and writes files under ~/.claude only | The diag log, the inbox file, and the transcript file it scrubs in place |
Runs node with its own scripts/scrub.mjs | The on-disk pass over the two records that are not rows |
Registers /keys (and /safe-keys where that name is free) | Status, scan, clean, forget |
It makes no network request, calls no model, and writes nothing to the plugin store. Every stored value lives in the mod's memory for the length of the session and in the process environment under its name, and nowhere else.
How it works
One paste, five places it would normally land, one place it actually does.
| Where a key could land | What Safe Keys does |
|---|
| The prompt box, on paste | Replaced before the text is queued or drawn |
| The message the model reads | Replaced before it enters the session |
| The transcript file on disk | Every stored row is rewritten before it is written. The two records that are not rows are overwritten in place a few seconds later |
| Bash and PowerShell commands | $NAME is a real environment variable, so the shell expands it and the command never carries the value |
| Every other tool | The value is substituted into the arguments at the moment the tool runs |
| Tool output coming back | Stored values become names again. A key a tool prints, from a cat .env say, is stored and named too |
| The screen | Every drawn row is scrubbed on the terminal, the desktop app, VS Code and mobile |
The detector knows 38 key shapes by name (OpenAI, Anthropic, GitHub, Stripe, Supabase, AWS and the rest), reads labels like BRIGHTDATA_API_KEY= and Authorization: Bearer, and catches a bare UUID when a word like "key" or "token" sits near it, which is the case every entropy test misses. It leaves dates, versions, git SHAs, file paths and URLs alone.
Where it runs
| Where you run Claude Code | Safe Keys |
|---|
claude in a terminal, including an editor's terminal | Yes |
| The Code tab of the Claude desktop app | Yes |
| The VS Code extension | Yes |
claude -p and the Agent SDK | Yes, the hooks run; nothing is drawn |
| Cowork and claude.ai chat | No. Mods run in Claude Code only |
Using it
Paste a key the way you always did. The session confirms the name in one line, and the model uses the name:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
