Secure Coding Agents
Stop API Keys and Secrets Leaking to Claude Code and Other Coding Agents
A coding agent doesn't wait for someone to paste. It runs cat .env to understand the config, reads a database dump to debug a query, and fetches a README that says to print your keys. Each of those reads can become part of the next request to the model, and no developer reviewed it.
Maskflare's desktop agent installs hooks into Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode and keeps them in place. The hooks check prompts and tool calls against your masking rules and mask secrets and personal data in tool calls. What a hook can do depends on what each coding agent lets it do, and where it can't mask something, we say so.
What the developer pastes
Why does this fail?
OPENAI_API_KEY=sk-proj-7Hq2…Xv9
DATABASE_URL=postgres://app:S3cr3t!pw@db
customer: ada@example.com
What the coding agent sends
Why does this fail?
OPENAI_API_KEY=mf_mask_c03a
DATABASE_URL=postgres://app:mf_mask_88b1@db
customer: mf_mask_5e1d
Why the usual approach falls short
CI secret scanners run after the commit. Chat filters never see what an agent reads. Hooks check the agent's own prompts and tool calls.
The Maskflare approach
Start in monitor mode: the hooks run on every developer machine and Maskflare counts the secrets and personal data they see, changing nothing. Then switch to enforce. In Claude Code a prompt that carries a secret is blocked, and secrets in Bash, file and MCP tool calls are masked on the way in and on the way out. OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode get the protections their hook APIs allow: for example Cursor cannot mask shell output, Codex has no file-read hook, and Copilot cannot stop a prompt. The capability matrix on the coding agents page states each of these limits. For the MCP servers an agent uses, the gateway adds access control per group and screens tool results and tool descriptions for injected instructions. That screening runs on MCP traffic only, not in the hooks and not on chat prompts.
Benefits
Hooks in five coding agents
Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode, installed by the desktop agent for every local user and restored if removed.
Secrets masked in tool calls
232 credential formats plus personal data, masked in tool input and output, with block rules for private keys and cloud credentials.
Monitor first
Count what the hooks see before you change anything, then move to enforce, per device group if you want.
MCP tools governed
Access control per group, destructive tools denied by default on new servers, access requests with approval, and an audit trail without content.
Built on
Related pages
Frequently asked questions
How do you stop API keys leaking to coding agents?
The desktop agent installs a hook in each coding agent. The hook checks the prompt and the input and output of tools against your masking rules. A key in a tool call is masked, and a block rule refuses the call or withholds the output. A key in a prompt is blocked, or masked for the model in GitHub Copilot, because that is what each agent's hook API allows.
What can't the hooks do?
Cursor does not let a hook change shell output, so a secret printed by a command still reaches the model and Maskflare only tells the model what it holds. Codex has no file-read hook, so a file is covered only when read through a shell command. Cursor refuses a sensitive file instead of masking it. Copilot cannot stop a prompt. The coding agent's own local history keeps what was typed or read.
Does it stop prompt injection in a coding agent?
Only for MCP servers whose traffic goes through the Maskflare gateway: tool results and tool descriptions are checked for hidden text, instruction overrides, encoded payloads, tool poisoning and exfiltration links. The hooks do not run those checks, chat prompts are never read for injection, and jailbreaks are not detected.
How is this different from the secrets in prompts page?
Secrets in prompts covers secrets pasted into any AI channel: chat boxes, browsers, API calls. This page is about coding agents that read files and run commands on their own, where the secret never gets pasted and the hook sits inside the agent.
Can developers turn the hooks off?
They can edit their own files, but the desktop agent checks the entries every minute and puts back any that were removed or changed, and reports the repair as a tamper event.
Does this replace secret scanning in CI or key rotation?
No. It reduces new leaks to AI providers through coding agents. Keys that already went to a provider should still be rotated, and CI scanning still catches commits.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →