[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"readme:claude-secrets":3},"\u003Cdiv align=\"center\">\u003Cp>\u003Cimg src=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fvaultry\u002Fclaude-secrets\u002FHEAD\u002Fdocs\u002Fclaude-input.gif?v=2\" alt=\"Claude Secrets\" \u002F>\u003C\u002Fp>\n\u003Ch1>@vaultry\u002Fclaude-secrets\u003C\u002Fh1>\n\u003Cp>\u003Cstrong>Encrypted token store for Claude Code sessions and your shell\u002Fapps.\u003C\u002Fstrong>\nmacOS Keychain backed · MCP server · CLI · \u003Ccode>.env\u003C\u002Fcode> placeholder expansion.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@vaultry\u002Fclaude-secrets\" rel=\"nofollow ugc noopener\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fnpm\u002Fv\u002F@vaultry\u002Fclaude-secrets.svg?style=flat-square&color=blue\" alt=\"npm version\" \u002F>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@vaultry\u002Fclaude-secrets\" rel=\"nofollow ugc noopener\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fnpm\u002Fdm\u002F@vaultry\u002Fclaude-secrets.svg?style=flat-square&color=green\" alt=\"npm downloads\" \u002F>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fvaultry\u002Fclaude-secrets\u002Fblob\u002FHEAD\u002FLICENSE.md\" rel=\"nofollow ugc noopener\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-Source--available-orange.svg?style=flat-square\" alt=\"license\" \u002F>\u003C\u002Fa>\n\u003Ca href=\"#requirements\" rel=\"nofollow ugc noopener\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fplatform-macOS-lightgrey.svg?style=flat-square\" alt=\"platform\" \u002F>\u003C\u002Fa>\n\u003Ca href=\"#requirements\" rel=\"nofollow ugc noopener\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fnode-%E2%89%A518-brightgreen.svg?style=flat-square\" alt=\"node\" \u002F>\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fdiv>\u003Cblockquote>\n\u003Cp>\u003Cstrong>Stop pasting tokens into every new Claude session.\u003C\u002Fstrong> Store them once, reference them everywhere — including commit-safe \u003Ccode>.env\u003C\u002Fcode> files.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Chr \u002F>\n\u003Ch2>Quick install (one line)\u003C\u002Fh2>\n\u003Cpre>\u003Ccode class=\"language-bash\">curl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002Fvaultry\u002Fclaude-secrets\u002Fmain\u002Finstall.sh | bash\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Or via npm:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\">npm install -g @vaultry\u002Fclaude-secrets\nclaude-secrets-setup\nclaude mcp add claude-secrets --scope user -- claude-secrets-mcp\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Chr \u002F>\n\u003Ch2>Three interfaces\u003C\u002Fh2>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Interface\u003C\u002Fth>\n\u003Cth>Who uses it\u003C\u002Fth>\n\u003Cth>Policy-gated\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>\u003Cstrong>MCP server\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Claude Code sessions\u003C\u002Ftd>\n\u003Ctd>Yes (per-project allowlist)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>CLI \u003Ccode>claude-secrets\u003C\u002Fcode>\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Your shell, apps, scripts\u003C\u002Ftd>\n\u003Ctd>No (user has Keychain access)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>\u003Ccode>.env\u003C\u002Fcode> placeholders\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Any tool that reads .env\u003C\u002Ftd>\n\u003Ctd>Via CLI\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\n\u003Chr \u002F>\n\u003Ch2>Store secrets\u003C\u002Fh2>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fvaultry\u002Fclaude-secrets\u002FHEAD\u002Fdocs\u002Fstore.gif\" alt=\"Store demo\" \u002F>\u003C\u002Fp>\n\u003Cp>Pipe from stdin (keeps the value out of shell history):\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\">echo \"ghp_xxxxx\" | claude-secrets set GITHUB_TOKEN\nop read \"op:\u002F\u002FPrivate\u002FGitea\u002Ftoken\" | claude-secrets set GITEA_TOKEN\nclaude-secrets set DB_PASSWORD              # interactive — type, Ctrl-D\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Encrypted with AES-256-GCM, master key stored in macOS Keychain (syncs between Macs via iCloud Keychain).\u003C\u002Fp>\n\u003Chr \u002F>\n\u003Ch2>Commit-safe \u003Ccode>.env\u003C\u002Fcode> files\u003C\u002Fh2>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fvaultry\u002Fclaude-secrets\u002FHEAD\u002Fdocs\u002Fdotenv.gif\" alt=\"dotenv demo\" \u002F>\u003C\u002Fp>\n\u003Cp>Replace real values with \u003Ccode>secret:\u002F\u002FNAME\u003C\u002Fcode> references. The \u003Ccode>.env\u003C\u002Fcode> file can now be committed to git safely — it contains only names, no credentials.\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\"># .env\nAPI_KEY=secret:\u002F\u002FGITHUB_TOKEN\nDB_URL=postgres:\u002F\u002Fapp:secret:\u002F\u002FDB_PASSWORD@db.local\u002Fapp\nPORT=3000\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Placeholder syntax: \u003Ccode>secret:\u002F\u002FNAME\u003C\u002Fcode> — URI-style, avoids bash parameter-expansion collisions. Names can contain \u003Ccode>A-Z\u003C\u002Fcode>, \u003Ccode>0-9\u003C\u002Fcode>, \u003Ccode>_\u003C\u002Fcode>, \u003Ccode>.\u003C\u002Fcode>, \u003Ccode>-\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Chr \u002F>\n\u003Ch2>Expand placeholders\u003C\u002Fh2>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fvaultry\u002Fclaude-secrets\u002FHEAD\u002Fdocs\u002Fexport.gif\" alt=\"export demo\" \u002F>\u003C\u002Fp>\n\u003Cp>Resolve placeholders to real values at runtime:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\">eval \"$(claude-secrets export)\"                    # into current shell\nclaude-secrets export --format json > resolved.json\nclaude-secrets export --format dotenv > .env.resolved\n\nclaude-secrets export --file .env.staging         # different file\nclaude-secrets export --on-missing empty          # empty for missing refs\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003Ccode>--on-missing\u003C\u002Fcode>\u003C\u002Fth>\n\u003Cth>Behavior\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>\u003Ccode>throw\u003C\u002Fcode> (default)\u003C\u002Ftd>\n\u003Ctd>Exit 1 with list of missing names\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Ccode>empty\u003C\u002Fcode>\u003C\u002Ftd>\n\u003Ctd>Placeholder becomes empty string\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Ccode>keep\u003C\u002Fcode>\u003C\u002Ftd>\n\u003Ctd>Placeholder left literal (\u003Ccode>secret:\u002F\u002FNAME\u003C\u002Fcode>)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\n\u003Chr \u002F>\n\u003Ch2>Run a command with secrets\u003C\u002Fh2>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fvaultry\u002Fclaude-secrets\u002FHEAD\u002Fdocs\u002Fexec.gif\" alt=\"exec demo\" \u002F>\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\">claude-secrets exec -- pnpm dev                    # inject then run\nclaude-secrets exec -- node build.js\nclaude-secrets exec --file .env.prod -- npm run deploy\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Secrets live only in the child process — not in the parent shell's environment, history, or \u003Ccode>ps\u003C\u002Fcode> output.\u003C\u002Fp>\n\u003Cp>\u003Ccode>package.json\u003C\u002Fcode> scripts work seamlessly:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  \"scripts\": {\n    \"dev\": \"claude-secrets exec -- ts-node src\u002Findex.ts\",\n    \"test\": \"claude-secrets exec --file .env.test -- vitest\",\n    \"deploy\": \"claude-secrets exec --file .env.prod -- node deploy.js\"\n  }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Chr \u002F>\n\u003Ch2>MCP server (for Claude Code)\u003C\u002Fh2>\n\u003Cp>After registering with \u003Ccode>claude mcp add\u003C\u002Fcode>, Claude Code gets 6 tools under \u003Ccode>mcp__claude-secrets__*\u003C\u002Fcode>:\u003C\u002Fp>\n\u003Cp>| Tool | Policy \u003C\u002Fp>\n",1784308501981]