phantom-secrets

AI coding agents read your.envfiles. Once a real API key enters an LLM's context window, it leaks — via prompt injection, session logs, malicious MCP servers, or training data. GitGuardian reports AI-assisted commits leak secrets at2× the baseline rate.

Every other secrets manager protects keysat restandin transit. Phantom protects themin context:

- 🔒Real keys never enter the LLM—.envcontains onlyphm_tokens; the proxy swaps them at the network edge.
- ⚡10-second setup—npx phantom-secrets initand you're protected. No accounts, no DNS, no MITM cert dance.
- 🧰Works with every AI tool— Claude Code, Cursor, Windsurf, Codex, GitHub Copilot. Anything that reads.env.
- 🦀Open source, local-first, MIT— your secrets live in your OS keychain. The optional cloud sync is end-to-end encrypted; the server only ever sees ciphertext.

Used by developers who don't want to choose betweendelegating to AIandnot pasting their Stripe key into a chat window.

$ npx phantom-secrets init # Auto-detects .env, .env.local, or .env in subdirectories # Stores real secrets in OS keychain, rewrites .env with phantom tokens # Auto-configures Claude Code MCP server if detected $ phantom agent doctor # One human-readable readiness check for AI-agent safety $ phantom exec -- claude # Authenticated proxy running on 127.0.0.1:54321 # AI sees phantom tokens; proxy injects real keys

The same commands work on Windows.npx phantom-secrets initinstalls via npm as on macOS/Linux.

Afterphantom start --daemon, the CLI detects your shell and prints the matching env-var syntax. For reference:

$env:OPENAI_BASE_URL = "http://127.0.0.1:PORT/openai/_phantom/TOKEN/" $env:PHANTOM_PROXY_PORT = "PORT" $env:PHANTOM_PROXY_TOKEN = "TOKEN"

set OPENAI_BASE_URL=http://127.0.0.1:PORT/openai/_phantom/TOKEN/ set PHANTOM_PROXY_PORT=PORT set PHANTOM_PROXY_TOKEN=TOKEN

Git Bash / WSL:use theexport X=Ysyntax from the main quick-start.

.env file (safe to leak) OS Keychain / Vault +--------------------------+ +---------------------+ | OPENAI_API_KEY=phm_a7f3 | ---> | sk-real-secret-key | | STRIPE_KEY=phm_c9d1... | | sk_live_real-key... | +--------------------------+ +---------------------+ | | v v AI Agent (Claude, Cursor) Phantom Proxy (127.0.0.1) +--------------------------+ +------------------------------+ | Reads .env | | Intercepts HTTP requests | | Sees only phm_ tokens | ---> | Replaces phm_ with real keys | | Makes API calls to proxy | | Forwards over TLS to real API| +--------------------------+ +------------------------------+

- phantom initreads.env, stores real secrets in the OS keychain, rewrites.envwithphm_tokens
- phantom exec -- claudestarts a local reverse proxy, sets SDK-compatible service base URLs such asOPENAI_BASE_URL=http://127.0.0.1:PORT/openai/_phantom/TOKEN/, exposesPHANTOM_PROXY_TOKENto the child process, and launches the command
- API calls hit the proxy, which authenticates the local session, removes the local auth token before forwarding, replaces phantom tokens with real secrets, and forwards over TLS
- When the session ends, the proxy shuts down and the proxy session token is invalid. Phantom tokens remain worthless placeholders outside an authenticated proxy session.

MCP Integration (Claude Code, Cursor, Windsurf, Codex)

Phantom ships an MCP server so AI coding tools can manage secrets directly -- without ever seeing real values.

- Vault—phantom_list_secrets,phantom_status,phantom_init,phantom_add_secret_interactive,phantom_add_secret(deprecated; refuses plaintext),phantom_remove_secret,phantom_rotate,phantom_copy_secret
- Detection + diagnostics—phantom_doctor,phantom_why,phantom_check,phantom_env
- Local-to-cloud—phantom_wrap,phantom_unwrap,phantom_sync,phantom_cloud_push,phantom_cloud_pull,phantom_cloud_status
- Teams—phantom_team_list,phantom_team_create,phantom_team_members,phantom_team_invite,phantom_team_key_publish,phantom_team_vault_push,phantom_team_vault_pull

Mutating tools require an explicitconfirm: trueparameter so a prompt-injected agent can't silently mutate state. Real secret values are never accepted as MCP tool arguments; new secrets are entered out-of-band in a trusted terminal.

One command per AI client — Phantom writes the right config file in the right place:

phantom setup --client claude # .claude/settings.local.json (project) phantom setup --client cursor # ~/.cursor/mcp.json phantom setup --client windsurf # ~/.codeium/windsurf/mcp_config.json phantom setup --client codex # ~/.codex/config.toml phantom setup --client claude --print # snippet to stdout for any other client

Ifphantom-mcpisn't on PATH, Phantom falls back tonpx -y phantom-secrets-mcpso the config still works on a fresh machine. Restart the AI tool after runningphantom setupso it picks up the new config.