Phantom Secrets

Overview

Phantom Secrets is an MCP server that protects AI coding agents from accidentally leaking API keys and secrets. It works as a local proxy that intercepts sensitive credentials and replaces them with safe phm_ tokens, preventing exposure in code generation and logs.

The server runs entirely on your machine via the npm package phantom-secrets-mcp, installed with npx -y phantom-secrets-mcp. No authentication or external credentials are required — it operates out of the box using stdio communication. Version v0.6.0 is released under the MIT license, with source code available at ashlrai/phantom-secrets on GitHub.

Phantom Secrets fits the Development category on mcp.site and works with MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others. If you maintain this project, claim your listing to verify ownership and keep information accurate.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "phantom_secrets": {
      "command": "npx",
      "args": [
        "-y",
        "phantom-secrets-mcp"
      ]
    }
  }
}