Skip to content
ccmods.app

safe-keys

v1.0.0

Catches API keys you paste into the prompt, stores them outside the conversation and shows them as names like $OPENROUTER_API_KEY.

by @markfulton1Updated Broad accessGitHub

Installation

  1. 1. Clone the repository

    $ git clone https://github.com/markfulton/safe-keys.git

  2. 2. Start Claude Code with the mod loaded for this session

    $ claude --plugin-dir ./safe-keys

The repository has no marketplace file yet, so this loads the mod for one session. Needs Claude Code 2.1.287 or later, in a terminal. Full install guide

What does safe-keys do?

  • Replaces a pasted key with a name before it is queued, drawn or sent to the model
  • Bash and PowerShell get the key as an environment variable; other tools get it substituted at run time
  • Scrubs stored keys from tool output and from the transcript file on disk
  • /keys lists stored names; /keys scan and /keys clean find and overwrite keys in old transcripts
  • Detects 38 known key formats plus labeled values and UUIDs near words like key or token

What do you need?

  • Claude Code 2.1.287 or later (terminal)
  • node on PATH for the on-disk transcript pass

What can this mod access?

Read from the mod's code with claude plugin validate on Claude Code 2.1.296, synced Oct 12, 2026. This is a capability list, not a security audit. Mods run with your permissions, so install only from authors you trust.

Broad access
  • Runs programs on your machine
  • Writes files
  • Can approve tool calls or change settings
  • Intercepts or rewrites tool calls
  • Reads or rewrites your prompts
  • Reads files
  • Reads environment variables or settings
Hooks and engine calls (10 + 13)

hooks

  • classic.SessionStart
  • command.run{command=safe-keys|keys}
  • prompt.edit
  • prompt.submit
  • session.append
  • session.end
  • session.start
  • tool.call
  • turn.complete
  • ui.render

calls

  • $.clock.after
  • $.command.register
  • $.env.get
  • $.env.set
  • $.fs.read
  • $.fs.stat
  • $.fs.write
  • $.process.run
  • $.session.cwd
  • $.session.id
  • $.ui.invalidate
  • $.ui.log
  • $.ui.toast

Do you maintain safe-keys?

Add this badge to your README so users can jump to this page for the install command and access report.

Listed on ccmods.app
[![Listed on ccmods.app](https://ccmods.app/badge.svg)](https://ccmods.app/mods/safe-keys)

Related mods

dotnet-pilot

zdanovichnick/dotnet-pilot

5

.NET helper with Roslyn checks, plus a session pressure meter, a test-loosening guard and an optional pixel-art band.

UIPromptToolsModerate access
$ claude plugin install dotnet-pilot --marketplace zdanovichnick/dotnet-pilot

blast-radius

anthropics/claude-code-playground

210

Anthropic's sample mod that holds a risky shell command like rm -rf or a force push and shows what it would change.

Anthropic sampleUIToolsBroad access
$ claude plugin install blast-radius --marketplace ./claude-code-playground/claude-code/mods

temper

galando/temper

17

Gates AI coding into Intent, Plan, Build, Review and Check phases, refusing writes outside the current phase until you approve.

UIPromptToolsBroad access
$ claude plugin install temper --marketplace galando/temper