You Just Shared Your API Key With an AI. You Didn’t Even Notice.

Description and use

Users store API keys in a locally encrypted vault via concealer, enabling AI assistants to request secret names and run commands with secrets injected, without exposing the values.

Problem

AI coding assistants can inadvertently expose API keys and other secrets stored in .env files, leading to leaks via chat transcripts, logs, or accidental commits.

Outcome

By encrypting secrets locally and exposing only names to AI assistants, concealer prevents accidental leakage of API keys while still allowing assistants to perform tasks that require secrets.

Workflow

• 1. Install concealer (single Python script).
• 2. Encrypt existing .env secrets with concealer, creating a local encrypted vault.
• 3. Configure AI assistant to use concealer’s MCP server for secret access.
• 4. When the assistant needs a secret, it requests the secret name via MCP; concealer returns the name only.
• 5. Assistant calls concealer to run a command with the secret injected; concealer decrypts, sets env vars for the child process, runs the command, redacts secret values from stdout/stderr, and returns sanitized output.
• 6. All interactions are logged with audit trail, but secret values never leave the local machine or the assistant’s context.

Evidence

Coding assistants read your repository to be useful; the moment an API key lands in a .env file, it can end up in a chat transcript, a log, or a bug report.

Source

concealer ships with an MCP server so AI agents can use secrets safely without ever seeing them.

Source

The plaintext never enters the agent’s context. Not on the way in, not on the way out.

Source