# AI agents and secrets: keep .env values and API keys out of command output

> AI agents print API keys from .env files and logs into their context. Tokenade masks the credentials it recognises in tool output, on your computer.

Source: https://tokenade.net/en/solutions/infrastructure-security/secrets-security · Updated: 2026-10-15

You told your AI agent never to read `.env`. Then it ran a `grep` to find a broken line, and the API key landed in the transcript anyway. Now you rotate it. Tokenade masks the credentials it recognises in tool output before the agent reads them. It is one layer, not a guarantee, and this page says exactly where it stops.

## What you deal with every day

### Rules the agent reads, then breaks

Instructions in `CLAUDE.md` or memory are advice to the model, not a lock. In one public bug report, a project's `.env` was correctly ignored by git, and the user had written a rule against printing secrets. The agent still ran `Get-Content` on the file "with the stated intent of 'checking whether KIS env vars are present'", printing four live credentials ([anthropics/claude-code#59094](https://github.com/anthropics/claude-code/issues/59094), incident of 2026-05-14).

### Leaks you only see afterwards

Another report describes the timing problem. The agent ran `grep -n curl .dev.vars` to find a malformed line, and the token was written to the transcript. The reporter's diagnosis: "The model's safety reflex fires on output it has already produced, not on commands it is about to run" ([anthropics/claude-code#44868](https://github.com/anthropics/claude-code/issues/44868), opened 2026-04-07). By then, rotation is the only remedy.

### Ignore and deny rules with gaps

Filename rules help, and they keep improving. They were still found wanting earlier this year: Claude Code "continues to read passwords and API keys, even when your secrets file is supposed to be blocked" ([The Register, 2026-01-28](https://www.theregister.com/software/2026/01/28/claude-code-ignores-ignore-rules-meant-to-block-secrets/4336684)). And a rule on a filename cannot see a key that arrives some other way.

### Secrets that never came from a file

Most leaks in day-to-day work come through output. A security guide lists the route: "A database error dumps the connection string with the password. The `.env` file was never opened, but the secrets are now in context anyway, courtesy of your own application's logs" ([strongly.ai, 2026-04-12](https://www.strongly.ai/blog/stop-leaking-secrets-claude-code.html)). Test runs, `env`, `docker inspect`, a verbose `curl`: any of them can print a key.

## What Tokenade changes

Tokenade is a local CLI between the AI agent and its tools. It already folds verbose output to save tokens; masking runs in the same pass.

- **Masking before the agent reads.** Before tool output reaches the agent, Tokenade replaces credentials it recognises with `<redacted>`: cloud keys, tokens, private keys, card numbers, and high-entropy strings that look like unknown token formats ([what Tokenade sends and stores](https://tokenade.net/en/docs/privacy-telemetry#secrets)).
- **On the output route, not the filename.** It checks everything it hands back to the agent, whatever the command was. A `grep`, a stack trace, a debug log or a wrapped MCP result goes through the same pass.
- **Before anything is stored.** Redaction happens before Tokenade writes its own stash or caches ([how compaction works](https://tokenade.net/en/docs/compaction)).
- **Independent of your plan.** Without an active license, Tokenade stops rewriting shell commands, but secret redaction keeps running ([hooks](https://tokenade.net/en/docs/hooks)).
- **Optional personal data pass.** E-mail addresses, phone numbers, IP and MAC addresses are masked only if you set `TOKENADE_REDACT_PII=1` ([environment variables](https://tokenade.net/en/docs/environment-variables)).
- **Clean-up commands.** `tokenade scrub-secret <substring>` purges an exact string from every Tokenade file; `tokenade scrub-cache` re-applies the patterns to the stash.

The same install also folds noisy output, which made long sessions [39% cheaper in our public THOL benchmark](https://tokenade.net/en/thol).

## What it does not do

Be clear about the limits before you rely on it:

- **It is not a secret scanner or DLP.** It masks what its patterns recognise. A credential in a format it does not recognise, with low entropy, can pass.
- **It does not block file access.** The agent can still open `.env`. Tokenade acts on the output it handles, so keep your deny rules.
- **It only sees tool output it intercepts.** A key you paste into a prompt, or content the agent receives by another route, is outside its reach.
- **It fails open.** If Tokenade itself crashes, its hooks exit cleanly and the tool call proceeds without it. That keeps your work running; it also means masking is not guaranteed.
- **It does not hide people or client data.** Names, hostnames and business content pass through unchanged.

Keep the usual controls: secrets in a manager rather than plaintext files, deny rules, pre-commit scanning, and rotation when in doubt. Tokenade narrows one route; it does not close the others.

## What stays on your computer

Masking and folding run on the computer where the agent runs. Tool output, code, file contents and command arguments are never sent to Tokenade's servers. Tokenade sends one usage row per compaction (token counts, compactor, agent, model, program name) to meter your plan. The full field list is in [What Tokenade sends and stores](https://tokenade.net/en/docs/privacy-telemetry).

> Add a layer between your AI agent and your secrets: Tokenade masks the credentials it recognises in tool output, on your computer.
>
> Install: `npm install -g @tokenade/cli && tokenade install && tokenade login` — or let your agent do it: https://tokenade.net/install.md

## Setting it up

1. **Install.** Follow [Install Tokenade](https://tokenade.net/en/docs/install). Masking is on by default.
2. **Wire your agents.** `tokenade install` covers Claude Code, Codex, Cursor, Copilot CLI and 15+ others; the [compatibility matrix](https://tokenade.net/en/docs/compatibility) shows secret redaction per agent.
3. **Tune if needed.** Set `TOKENADE_REDACT_PII=1` to mask contact and network identifiers too.

## FAQ

### Does Tokenade stop my AI agent from reading .env?

No. It does not block file access. When the agent runs a command or a tool that Tokenade covers, Tokenade masks the credentials it recognises in the result. Keep deny rules on `.env` and secret files as your first barrier.

### Which secrets does it recognise?

Cloud keys, API tokens, private keys, card numbers, and high-entropy strings that look like unknown token formats. E-mails, phone numbers, IP and MAC addresses are masked only with `TOKENADE_REDACT_PII=1`.

### Can a secret still reach the model?

Yes, in some cases: a format the patterns miss, a key you paste into the prompt, or a moment when Tokenade is not running. Treat it as a useful layer, not as a guarantee, and rotate any key you suspect was exposed.

### Is my output sent to Tokenade to be scanned?

No. Masking runs on your computer. Only usage counts reach tokenade.net, never the output, file names or command arguments.

## Further reading

- [Claude Code hooks: which ones add tokens, which cut them](https://tokenade.net/en/articles/claude-code-hooks)
- [Token-efficient MCP tool use](https://tokenade.net/en/articles/token-efficient-mcp-tool-use)