ashlrai/phantom-secrets
One command. AI uses your API keys safely. Open-source Rust CLI with MCP server for Claude Code.
Platform-specific configuration:
{
"mcpServers": {
"phantom-secrets": {
"command": "npx",
"args": [
"-y",
"phantom-secrets"
]
}
}
}Add the config above to .claude/settings.json under the mcpServers key.
AI uses your keys. Safely.
[](https://github.com/ashlrai/phantom-secrets/stargazers) [](https://github.com/ashlrai/phantom-secrets/actions/workflows/ci.yml) [](https://www.npmjs.com/package/phantom-secrets) [](LICENSE) [](https://phm.dev)
AI coding agents read your .env files, putting API keys into LLM context windows where they leak via prompt injection, session logs, malicious MCP servers, or training data. GitGuardian reports AI-assisted commits leak secrets at 2x the baseline rate.
Phantom replaces real secrets with inert tokens. A local proxy swaps them back at the network layer. The AI never sees a real key.
$ npx phantom-secrets init
# Auto-detects .env, .env.local, or .env in subdirectories
# Stores real secrets in OS keychain, rewrites .env with phantom tokens
# Auto-configures Claude Code MCP server if detected
$ phantom exec -- claude
# Proxy running on 127.0.0.1:54321 — AI sees phantom tokens, proxy injects real keys .env file (safe to leak) OS Keychain / Vault
+--------------------------+ +---------------------+
| OPENAI_API_KEY=phm_a7f3 | ---> | sk-real-secret-key |
| STRIPE_KEY=phm_c9d1... | | sk_live_real-key... |
+--------------------------+ +---------------------+
| |
v v
AI Agent (Claude, Cursor) Phantom Proxy (127.0.0.1)
+--------------------------+ +------------------------------+
| Reads .env | | Intercepts HTTP requests |
| Sees only phm_ tokens | ---> | ReplaceLoading reviews...