That is where a coding agent actually reads them — the .env file — so the fix is to make what it reads worthless and do the substitution below the agent, at the proxy. The MCP surface follows the same idea: mutating tools need an explicit confirmation flag, and the server refuses to take a real secret value as an argument at all.
A local-first secrets manager built for AI coding agents. Real values live in your OS keychain, the .env file carries phm_ tokens, and a local reverse proxy substitutes the real key on outbound requests.
- Vault management from the client: phantom_list_secrets, phantom_status, phantom_init, phantom_add_secret_interactive, phantom_remove_secret, phantom_rotate, phantom_copy_secret
- Diagnostics: phantom_doctor, phantom_why, phantom_check, phantom_env
- Local-to-cloud: phantom_wrap, phantom_unwrap, phantom_sync, phantom_cloud_push, phantom_cloud_pull, phantom_cloud_status
- Teams: phantom_team_list, phantom_team_create, phantom_team_members, phantom_team_invite, phantom_team_key_publish, phantom_team_vault_push, phantom_team_vault_pull
- Mutating tools require an explicit confirm parameter, so a prompt-injected agent cannot silently change state
- Real secret values are never accepted as tool arguments — new secrets are entered in a trusted terminal
- Optional cloud sync is end-to-end encrypted; the server only ever holds ciphertext
Npx phantom-secrets init detects your .env, moves the real values into the OS keychain and rewrites the file with phantom tokens. phantom setup --client claude writes the MCP config in the right place — cursor, windsurf and codex are also supported — falling back to npx -y phantom-secrets-mcp when phantom-mcp is not on PATH.
One command — npx phantom-secrets init