Secret Safe Env
Let a human type API keys into .env through a masked Windows dialog so the agent never sees or logs the secret.
Overview
secret-safe-env is a MCP server for the Ship phase that writes secrets into .env via a masked Windows dialog so the agent never receives the plaintext value.
What is this MCP server?
- Writes .env entries without exposing values to the LLM
- Windows masked input dialog with Traditional Chinese (繁中) UI
- stdio npm package secret-safe-env v0.1.2
- Reduces paste-in-chat leakage for local agent development
- Package version 0.1.2; npm identifier secret-safe-env
- Documented behavior: agent does not receive secret values—human-only masked entry
What problem does it solve?
Pasting secrets into agent chats risks leaks in history, support exports, and shared sessions when you only wanted a local .env line.
Who is it for?
Windows-based solo builders using MCP who configure many third-party API keys during Ship and security hardening.
Skip if: macOS/Linux-only workflows, team-wide vault rotation, or production KMS-style secret management.
What do I get? / Deliverables
After installing secret-safe-env, you fill keys through the masked dialog and your agent can reference env var names without ever reading the secret.
- Updated .env entries written without agent-visible plaintext
- Repeatable MCP workflow for rotating keys locally
- Lower risk of accidental secret exposure in chat logs
Recommended MCP Servers
Journey fit
How it compares
Local masked .env writer MCP, not a hosted secrets platform or generic code-review skill.
Common Questions / FAQ
Who is secret-safe-env for?
Solo developers on Windows who use AI coding agents and want API keys in .env without exposing values to the model.
When should I use secret-safe-env?
Use it during Ship/security setup whenever you add or rotate keys and want to avoid typing secrets directly into the agent conversation.
How do I add secret-safe-env to my agent?
Install the npm package secret-safe-env, add it as a stdio MCP server in Claude Code or Cursor, and invoke its tools so the masked dialog writes your .env entries.