What is Safe Keys for Claude Code?

Safe Keys is an open source Claude Code plugin. When you paste an API key, token or password into the chat, it stores the value outside the conversation and shows it everywhere as a name such as sk-or-v1-0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef. The chat, the transcript file on disk, the screen and the model all see the name. Bash and PowerShell get the name as a real environment variable, every other tool gets the value substituted at the moment it runs, and anything a tool prints back is cleaned before the model reads it.

Where does Claude Code keep what I paste?

In a transcript file under ~/.claude/projects, one JSONL file per session, for as long as the file exists. Your prompt is stored as typed, the model reads it as typed, and the screen draws it as typed. Safe Keys changes all three before any of them happen.

Does the model ever see the real key?

No. The message the model reads carries the name. When a tool needs the value, the plugin resolves it on the way into the tool, and the output that comes back is cleaned before the model reads it. The one note the model gets is which names are stored and how to use them.

How do my tools use a key they cannot see?

By name. In a Bash or PowerShell command, sk-or-v1-0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef is a real environment variable the plugin exported, so the shell expands it and the command never carries the value. In any other tool, the value is substituted into the arguments at the moment the tool runs.

What about keys I pasted before I installed it?

They are still in those transcript files. /keys scan counts them without changing anything, and /keys clean overwrites each one in place with a same-length marker, so the files stay valid and sessions still resume. Then rotate the keys it found: a record removed is not an exposure undone.

Is Safe Keys open source?

Yes, MIT, at github.com/markfulton/safe-keys. Read every line before you load it. The detector has a unit test for every rule and every exclusion, and the hooks are tested against Claude Code itself with claude plugin test.

Does it send anything anywhere?

No. Values live in the plugin's memory for the length of the session and in the engine process environment under the names it exported. Nothing is written to a store, a file or the network. The diagnostic log records which hooks fired and never a value.

Which keys does it recognise?

Thirty-eight shapes by name: Anthropic, OpenAI, OpenRouter, GitHub, GitLab, AWS, Google, Slack, Stripe, Resend, Supabase, Apify, Hugging Face, npm, DigitalOcean, Linear, Notion, Groq, Perplexity, Replicate, Fly, SendGrid, Mailgun, Twilio, Telegram, Doppler, PyPI, Vercel, JWTs, PEM private keys and connection strings with a password. Then any value after a label like BRIGHTDATA_API_KEY= or Bearer, any token near a word like key or token (which is how it catches UUID-shaped keys), and any bare high-entropy token in something you typed.

Why a free account for the clean-up kit?

So the prompts reach your inbox and stay with your account, next to the other free tools in the Agent Ops Club. The plugin itself is public and needs no account.

Safe Keys, a free Claude Code plugin

Paste an API key into Claude Code. Nothing keeps it.

Not the chat, not the transcript on your disk, not the screen, not the model. The key becomes a name the moment you press Enter, and your tools still get to use it.

Install it, two steps View the source on GitHub

A brass key dissolving into a stream of blue characters that form a tag, drifting toward a laptop

How it works

You paste a key once. Everything else sees a name.

I built it the day I pasted a Bright Data key into my own session and watched the redactor I had at the time miss it. The miss is written up in the repository, and the fix is tested against that exact shape.

Where a key could land	What Safe Keys does
The prompt box, on paste	Replaced before the text is queued or drawn.
The message the model reads	Replaced before it enters the session.
The transcript file on disk	Every stored row is rewritten before it is written. The two records that are not rows are overwritten in place a few seconds later.
Bash and PowerShell commands	$NAME is a real environment variable, so the shell expands it and the command never carries the value.
Every other tool	The value is substituted into the arguments at the moment the tool runs.
Tool output coming back	Stored values become names again. A key a tool prints, from a cat .env say, is stored and named too.
The screen	Every drawn row is scrubbed on the terminal, the desktop app, VS Code and mobile.

Real values live in the plugin's memory for the length of the session, and nowhere else. Nothing is written to a store, a file or the network.

Install in two steps

One setting, one clone, and the next session is covered.

The easy way

Let Claude Code install it.

Paste this into any Claude Code session and it does both steps, checks the plugin loads, and tells you to open a new session.

Say to Claude Code

Install the Safe Keys plugin for me. Add "CLAUDE_CODE_ENABLE_FUNCTION_HOOKS": "1" to the env block of ~/.claude/settings.json (create the block if it is missing, keep every other setting). Then clone https://github.com/markfulton/safe-keys into ~/.claude/skills/safe-keys. Run claude plugin validate on that folder and show me the result. Do not paste any real key during this; use the synthetic value in the repo's docs/LIVE-CHECKS.md if you want to test it. When it validates, tell me to open a new session.

It stops once if your settings file has something it does not want to overwrite. Everything else it does on its own.

Step 1 of 2
Turn on function hooks
Safe Keys is a function hook plugin, an early access surface of Claude Code. One line in your settings file switches it on, once.
- Open ~/.claude/settings.json (it is in your home folder) and add the env block. If an env block is already there, add the one key inside it.
  settings.json
  { "env": { "CLAUDE_CODE_ENABLE_FUNCTION_HOOKS": "1" } }
Step 2 of 2
Put the plugin where Claude Code loads skills from
Claude Code loads any plugin that sits in ~/.claude/skills. One clone and the next session has it.
- Run the clone. Claude Code reads the folder on its next start.
  Clone
  git clone https://github.com/markfulton/safe-keys ~/.claude/skills/safe-keys
- Optional, before the first session: ask Claude Code to check that your build reads the plugin.
  Validate
  claude plugin validate ~/.claude/skills/safe-keys
- Open a new session. The first line says Safe Keys is on. Paste a key and watch the row change to a name.

Then, for the keys you already pasted

6 prompts that clean up after the fact.

Paste each one into Claude Code with the plugin installed. None of them prints a value.

Count what is already there
A dry run over every transcript on your machine, by record type. Nothing is changed.
Say to Claude Code
Run /keys scan and read me the result: how many files were touched, how many spans it found, and which record types they sit in. Do not change anything yet.
Overwrite them in place
Same-length markers, so every file stays valid JSONL and every session still resumes.
Work out what to rotate
A list of the services whose keys were in those transcripts, so you rotate the right ones and not everything.
Check the other places keys hide
Shell history, .env files inside synced folders, and notes apps are the usual three.
Test the plugin with a fake key
Proof it is working on your machine before you trust it with a real one.
Store a key without pasting it
The inbox path, for a key you would rather never see in a chat window at all.

The clean-up kit

Find the keys already sitting in your old transcripts.

All 6 prompts, written so no value is ever printed
The scan, the clean and the list of what to rotate, in order
The one prompt install, if you have not done it yet
Everything by email, to keep
New prompts as the plugin grows

A free Agent Ops Club account. No card. The kit is emailed to you too, so it is there the day you need it. Already a member? Log in

Read before you trust it

What it does not do.

A typed key is caught at Enter, not per keystroke.
Pasting is covered in the box. Typing a key character by character is caught the moment you submit.
Single quotes get the value.
No shell expands a variable inside single quotes, so there Safe Keys puts the value itself in. Double quotes are the clean path and what the model is told to use.
Detection is heuristic.
Thirty-eight key shapes by name, labels like KEY= and Bearer, a credential word near a token, and a bare high-entropy token. A short custom secret with none of those is not caught. Use the inbox for it.
Function hooks are early access.
The contract can change between Claude Code releases. claude plugin validate tells you before a session does, and the plugin logs what it could not do.
Rotate anything you already pasted.
The plugin protects the next paste. A key that reached a transcript before the install was exposed from that moment, and the clean-up removes the record, not the exposure.

Built in the same place

8 AI Employees, open source, on the same agent.

Scheduled routines that cover a whole business role, free on every plan. Safe Keys is one of the small tools that came out of running them.

Learn more about the club

Questions

Not sure which job to hand an agent first? Run the free Agent Opportunity Scan.