secret-redactor
secret-redactor · by claude-code-templates
Redacts API keys, JWTs, private keys and DB strings from tool results before the model reads them; blocks placeholder reuse in Bash.
❯ /plugin marketplace add SeongGwangJu/k-mods ❯ /plugin install secret-redactor@k-mods
$ claude plugin marketplace add SeongGwangJu/k-mods $ claude plugin install secret-redactor@k-mods
Run /reload-plugins to apply it to an open session. Needs Claude Code 2.1.287 or later.
Notes
- Unlike k-mods' streamer-mode, which only hides values on screen, it erases the real values before the model receives them. However, it only covers tool results, so it cannot hide secrets in a prompt you type yourself.
- The tool.call hook has no .catch (a validate warning, gatingHooks hasCatch:false). Whether it fails open or fails closed on error is engine-internal behavior, so it cannot be determined from the code alone.
- In managed settings (organization-managed settings), it must be set to run first, so that values are hidden before other plugins can see the originals (the author's recommendation).
What it can do on your machine
Mods run unsandboxed with your permissions. These labels come from static analysis.
Can hold/answer tool calls
Static analysis
Events handled
