Let Claude use your secrets,
not see them.

WHAT CLAULOCK IS

A local socket between Claude and your secrets.

Five guarantees that hold by the shape of the system, not by promise.

• ■ Never-reveal invariant. The MCP surface exposes no tool that returns a plaintext value. Exfiltration isn't unlikely — it's structurally impossible by API shape.
• ■ MCP-native. Drop-in for Claude Code, Cursor, Continue — anything that speaks MCP. One install registers the server, the hooks, and the daemon.
• ■ Local-first. Daemon + Unix socket + ~/.clsec/vault.clsec on your machine. No cloud account, no telemetry, no update server that phones home.
• ■ Auditable crypto. XChaCha20-Poly1305 + Argon2id (256 MiB, t=3, p=4), AAD-bound per record. Apache-2.0 licensed so auditors read the code first.
• ■ Signed binaries. macOS notarized, Linux + Windows minisign + cosign with reproducible builds and a CycloneDX SBOM in every release.

HOW IT WORKS

Three hooks, one socket, zero leaks.

The invariant — Claude references a secret by name, never by value — is enforced at three layers. All three must hold. We test the invariant in CI on every push.

# Claude generates this command:
curl -H "Authorization: Bearer {{GITHUB_TOKEN}}" api.github.com/user

# PreToolUse hook rewrites to:
clsec-exec -- curl -H "Authorization: Bearer {{GITHUB_TOKEN}}" api.github.com/user

# Tools the MCP server exposes:
secret_list   secret_describe   secret_rotate   secret_tag   secret_audit_log

# Tools that don't exist (by API shape — not removed, never built):
secret_reveal   secret_read   secret_export_plaintext

# Raw output from a curl that printed the token:
Authenticated as octocat (token: ghp_live_AbCd1234EfGh5678…)

# Scrubbed before Claude's tool result returns:
Authenticated as octocat (token: [REDACTED:GITHUB_TOKEN])

MCP SERVER

ClauLock speaks MCP natively.

ClauLock ships an MCP server so Claude can list, describe, and rotate your secrets — but never read their plaintext. Drop it into your claude_desktop_config.json and your existing MCP-aware clients pick it up automatically. The clsec install command does this for you on the supported platforms.

{
  "mcpServers": {
    "claulock": {
      "command": "clsec-mcp",
      "args": []
    }
  }
}

What every shortcut actually leaks

Where your secrets actually go

Five common patterns, four leak surfaces. The boxes you can't repaint after the fact are the ones in red.

The problem isn't where you keep the secret. It's the moment it crosses into the model's view. ClauLock makes that crossing optional.

What Claude sees vs what runs

Same command, five layers. The plaintext appears on exactly one line — inside the child process that actually needs it, for the lifetime of that one execve.

Only the fourth line ever contains the real value. See how this differs from Vault, Composio, Doppler, and .env.

I WANT CLAUDE TO…

Every workflow you've already given Claude, safely

These are the credentials that quietly accumulate in your transcripts today. With ClauLock, each one becomes a placeholder Claude can reference but not read.

• ■ push commits to my private repo. GITHUB_TOKEN Claude calls `git push` with `Authorization: Bearer {{GITHUB_TOKEN}}`. The token never appears in the diff, the message, or the transcript.
• ■ deploy to Vercel. VERCEL_TOKEN `vercel deploy --token {{VERCEL_TOKEN}}` runs from inside `clsec-exec`. The model sees the placeholder, the deploy sees the real value, the audit log sees both events.
• ■ run a Supabase migration. DATABASE_URL · SUPABASE_SERVICE_KEY Two secrets, one popup each — only on first use. After that, `clsec migrate up` works for every future session without re-asking.
• ■ fine-tune an OpenAI model. OPENAI_API_KEY The most expensive paste-and-forget mistake. ClauLock keeps the key in your local vault; usage shows up in `clsec audit` with byte counts and exit codes.
• ■ send a Slack message to my team. SLACK_WEBHOOK_URL Claude posts release notes via `curl -d ... {{SLACK_WEBHOOK}}`. The webhook URL stays out of every Claude window — past, present, future.
• ■ rotate my keys when something feels off. any name `clsec rotate {{NAME}}` re-prompts you, encrypts the new value, and marks the old as superseded in the audit log. No grep through history.

Total visibility

Every time Claude touched your tokens

Locally written, locally readable. Tamper-evident hash chain so a compromised tool call can't quietly edit history. Run `clsec audit --since 24h` whenever you want a copy.

read = secret resolved into a child process · revealed-blocked = scrubber caught a leak attempt · rotated = you replaced the value