secretsh

Inject secrets from a .env file into subprocess arguments for AI agents.

Honest summary: secretsh prevents secrets from appearing in LLM context and shell history. It does not encrypt secrets at rest, hide them from the child process, or block filesystem access. If the agent can read the .env file or the child's argv, it can read the secrets.

AI agents write commands with {{PLACEHOLDER}} tokens. secretsh resolves them from a .env file at exec time and scrubs any secrets that leak back through output.

Agent writes:  curl -u admin:{{API_PASS}} https://internal/api
Child runs:    curl -u admin:hunter2 https://internal/api
Agent sees:    curl -u admin:[REDACTED_API_PASS] https://internal/api

Install

CLI (Rust binary)

# Homebrew
brew tap lthoangg/tap && brew install secretsh

# Cargo
cargo install secretsh

Pre-built binaries for x86_64/aarch64 on macOS and Linux: GitHub Releases.

Python package

# pip
pip install secretsh

# uv
uv add secretsh

The Python package wraps the CLI binary — the secretsh binary must be installed separately (see above).

Quick Start

CLI

# Create a .env file
echo 'API_PASS=hunter2' > .env

# Run commands — secrets injected and scrubbed
secretsh --env .env run -- curl -u admin:{{API_PASS}} https://api.example.com

Python

import secretsh

result = secretsh.run(".env", "curl -u admin:{{API_PASS}} https://api.example.com")
print(result.stdout)      # curl output with [REDACTED_API_PASS] in place of the secret
print(result.exit_code)   # child process exit code

Usage

secretsh --env <.env-file> run [flags] -- <command>

Flags

What it does and does NOT

Does

Does NOT

Exit Codes

Documentation

Development

cargo test                    # 187 tests
cargo clippy -- -D warnings  # must be zero warnings
cargo fmt --check

License

MIT · Contributing · Security