You Just Shared Your API Key With an AI. You Didn’t Even Notice.

Описание и применение

Конечный пользователь хранит ключи API в зашифрованном локальном хранилище, используя инструмент concealer, который позволяет ИИ‑ассистенту запрашивать имена секретов и выполнять команды с их безопасным внедрением, не раскрывая значения.

Задача

AI coding assistants can inadvertently expose API keys and other secrets stored in .env files, leading to leaks via chat transcripts, logs, or accidental commits.

Результат

By encrypting secrets locally and exposing only names to AI assistants, concealer prevents accidental leakage of API keys while still allowing assistants to perform tasks that require secrets.

Рабочий процесс

• 1. Install concealer (single Python script).
• 2. Encrypt existing .env secrets with concealer, creating a local encrypted vault.
• 3. Configure AI assistant to use concealer’s MCP server for secret access.
• 4. When the assistant needs a secret, it requests the secret name via MCP; concealer returns the name only.
• 5. Assistant calls concealer to run a command with the secret injected; concealer decrypts, sets env vars for the child process, runs the command, redacts secret values from stdout/stderr, and returns sanitized output.
• 6. All interactions are logged with audit trail, but secret values never leave the local machine or the assistant’s context.

Доказательства

Coding assistants read your repository to be useful; the moment an API key lands in a .env file, it can end up in a chat transcript, a log, or a bug report.

Источник

concealer ships with an MCP server so AI agents can use secrets safely without ever seeing them.

Источник

The plaintext never enters the agent’s context. Not on the way in, not on the way out.

Источник