secretctl
Stop pasting API keys into AI chat.
When you paste sk-proj-xxx into Claude Code, that secret is now in your conversation history, Anthropic's logs, and potentially exposed to prompt injection attacks.
secretctl fixes this. Your AI gets command results, never secret values.
The Problem
Every day, developers paste secrets into AI coding assistants:
You: "Help me debug this AWS error"
You: "Here's my config: AWS_ACCESS_KEY_ID=AKIA..."This is a security incident waiting to happen.
- Secrets in conversation history
- Secrets in cloud logs
- Secrets exposed to prompt injection
- No way to rotate or revoke
The Solution
secretctl injects secrets as environment variables. Your AI runs commands and sees results, but never sees the actual credentials.
- Single binary — No servers, no configuration, no subscription
- Local-first — Secrets never leave your machine
- MCP integration — Works with Claude Code out of the box
- Defense in depth — AES-256-GCM + Argon2id + output sanitization
# That's it. You're done.
secretctl init
secretctl set API_KEY
secretctl get API_KEY
