Your AI agent uses your API keys without the keys landing in its context.
Secrets stay in macOS Keychain. Claude Code gets back ok or failed, nothing else. EnvSecure is a Claude Code mod from Syncoders Labs.
A Claude Code plugin for macOS.
Get EnvSecure1. You save a key in the pane. It goes to Keychain. MY_API_KEY •••••••• billing sandbox key 2. The agent writes a command. You read it and approve. curl -H "Authorization: Bearer $MY_API_KEY" https://api.example.com/v1/ping [ Approve ] [ Deny ] 3. The agent sees one line. envsecure: ok
What the AI sees, and what it does not
The agent sees
- The name of each secret and your description of it.
envsecure: okorenvsecure: failedafter a run.- Output with the value redacted, only if you switch "AI can see" on for that secret. It resets every session.
The agent does not see
- The secret value, in normal use.
- The command output, the exact exit code or its size.
- The full run log. You read it in the pane.
What it does not do
EnvSecure stops accidental leaks into chat, transcripts and logs. It is not a cage for a hostile model, and we say so.
- Your approval is the real barrier. An approved command holds the secret. It can write a transformed copy into your project, or copy it with
pbcopy. Read every command before you approve it. - A standing approval has no rerun limit. Once you approve a command, it runs again each time the agent sends it. Use Forget approvals to take it back.
- Allowed hosts can receive the secret. The proxy limits where a command connects, not what it sends.
- Never click "Always Allow" on an EnvSecure Keychain prompt. Click Allow only right after you unlock, save, or approve a command that uses a secret.
- Side channels remain. ok or failed is one bit per run, and a test command can guess a value one approved run at a time.
Install
After you buy, your receipt email carries a zip file. Unzip it, then run two commands in a terminal, and finish in the pane.
claude plugin marketplace add <folder> claude plugin install envsecure@syncoders-lab
Replace <folder> with the unzipped folder. Then paste your license key in the EnvSecure pane. macOS only. Claude Code only.
Pricing
One key works on up to 5 of your Macs. Cancel anytime.
License key by email, 5 Macs per key.
The licence runs while your subscription is paid. You accept the License and Terms at checkout.
Questions
Can I cancel?
Cancel anytime.