Cloak your secrets

An agent that can read your .env can paste its values into a prompt, a transcript or an upstream API call. Cloak keeps the real values out of the model's context: the agent works with placeholders like @@SECRET:STRIPE_SECRET_KEY@@, and Prismor swaps in the real value only when the command runs on your machine. In this guide you import a .env, watch an agent use a key it never sees, and see what happens to a secret pasted into chat. Takes about five minutes.

You'll need

  • prismor installed, with Claude Code on the same machine.
  • A project with a .env. This guide's project has a Stripe key, an OpenAI key and a database URL in it.

1. Install the cloak hooks

From the project directory:

prismor cloak install
prismor install-hooks --agent claude --mode enforce

cloak install adds the hooks that swap placeholders for real values and scrub them back out of command output. The enforce-mode hooks stop an agent from simply opening the vault files directly. Run both: each covers a gap in the other.

2. Import your .env

prismor cloak add --env-file .env
prismor cloak list

Every KEY=VALUE line becomes its own placeholder, @@SECRET:KEY@@. Prismor prints names and byte counts only, never values. cloak list shows the same: what's registered, never what it holds.

To register one secret by hand, prismor cloak add <name> reads the value from stdin, so it never lands in your shell history.

3. Let the agent use a key it can't see

Until a .env is imported, Prismor denies any agent read of it, and the deny message names the fix: prismor cloak add --env-file. Here the agent is asked to call a staging API with the Stripe key, gets blocked reading .env, and stops. Told to run the import, it does, then makes the call with the placeholder:

The agent can run the import itself, because it prints names and byte counts only. Run it as a command of its own: the guard doesn't exempt cloak add when its output is piped into another command.

  • The command that actually runs on your machine carries the real value.
  • Its output is scrubbed before Claude Code records it, so even a response that echoes the key back shows the placeholder.
  • The model, the session transcript and every request to the LLM provider see only @@SECRET:…@@.

4. Pasted secrets are caught too

Paste a live key into the chat and Prismor vaults it, blocks the prompt once, and stashes a sanitised copy. Send any follow-up (go is enough) and the sanitised prompt goes through, with the key replaced by @@SECRET:auto_…@@.

The same happens if the model writes a raw secret into a command, a file or an MCP call: the call is denied, the value is vaulted, and the model is told to use the placeholder.

Troubleshooting

SymptomFix
The agent is denied reading .envExpected until its entries are imported. Run prismor cloak add --env-file .env.
A placeholder reaches the command unchangedThe cloak hooks aren't installed for this agent. Check prismor cloak status.
You use CodexCodex hooks can block but not rewrite. Run commands through prismor cloak run -- <command>.
A key in your org's own format isn't caught when pastedAdd its shape: prismor cloak pattern add 'mycorp_[0-9a-f]{32}'.
You want to discuss a key format without it being vaultedStart the prompt with !!allow .
The model saw a raw value before cloak was onRun /clear. Hooks can't take back what's already in context.

Next