Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do I Keep API Keys Out of Claude Code's Context Window?

Deny the files and environment variables that hold keys in sandbox.credentials and mask the ones the agent must use, and remember that the Read tool, MCP servers, hooks, WebFetch and WebSearch run outside the sandbox and can still surface a key. Context hygiene is three settings and one list of exceptions.

A credential reference travels from a browser record through a bounded route to a separate API destination.

For anyone running Claude Code with live keys, the settings that bear on credentials sit in different places in the documentation, and a key escapes through the gaps between them. Some stop a command from reading a file, some replace a value with a sentinel, and some strip variables from child processes. None covers every route, so keeping a key out of context takes a combination and an honest list of the gaps. A key reaches an agent's context window by being read: from a file, from an environment variable, from the output of a command, from a tool's response. Each path has a different control, and the sandbox covers some and not others. This page works from Claude Code's sandboxing documentation, using one record type as its example, a key denied, one masked and one surfaced by an MCP server. Deny and mask settings close the file and variable paths, and the tools that run outside the sandbox are the paths a team still has to account for. What Is Render-Layer Tokenization? supplies the framing. The vendor pages cited here were read on October 20, 2026, and each section says which statements come from them.

Key findings

  • Claude Code's sandboxing documentation describes sandbox.credentials settings that deny or mask a credential, and an injectHosts list naming where a masked value may be substituted (Anthropic, Sandboxing, 2026).
  • The same documentation places MCP servers, hooks and WebFetch outside the sandbox, so a key can still surface through them even when files and environment variables are denied (Anthropic, Sandboxing, 2026).
  • GitGuardian's data, as reported, counted 24,008 unique credentials in MCP configuration files and found Claude Code co-authored commits leaked credentials at roughly double the baseline rate (Help Net Security, 2025).
  • Swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques," which supports working on placeholders without losing the task (Serenari and Lee, 2025).
  • A governed environment that replaces values with consistent tokens before any model reads the screen keeps keys out of the context window on rendered pages, which no file or environment setting reaches (What Is Render-Layer Tokenization?).
  • Real values resolve only at the approved destination, so the real key exists where the call is made and not in the model's context (How Do You Let an AI Agent Manage API Keys Without Reading Them?).

What puts an API key into Claude Code's context window?

Anything the agent reads. A key in a .env file enters the context if the agent reads the file. If a command prints an environment variable, the key in that variable enters too, and a command's output enters by definition. An MCP server puts a key in as the tool's response, and a page fetched with WebFetch carries one in as page content. The context window is where the model reads, and anything that lands there can be repeated, logged or coerced out.

The record type is three keys with three fates. One key is denied: the file or variable that holds it is blocked from the sandboxed commands. One is masked: sandboxed commands see a sentinel and a proxy supplies the real value for listed hosts. One is surfaced by an MCP server: the server returns it in a response, and the sandbox settings do not apply because MCP runs outside the sandbox.

Scope note: the settings discussed concern what the sandbox covers. What an agent reads and does on a rendered page is the scope of the governed browser environment discussed at the end. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. Does Claude Code Read My .env File? takes the file question directly, and Can Claude Code Read My SSH Keys? takes the key-file case.

What do the vendors themselves say?

Anthropic's Claude Code sandboxing documentation describes credentials that can be denied or masked under sandbox.credentials, with a sentinel shown to sandboxed commands for masked values and an injectHosts list naming the hosts for which a local proxy substitutes the real value. It places MCP servers, hooks and WebFetch outside the sandbox (Anthropic, Sandboxing, 2026). An approver and a record of what the model read are not described in the pages reviewed.

Anthropic's engineering post on sandboxing says "effective sandboxing requires both filesystem and network isolation" and that sandboxing "safely reduces permission prompts by 84%" (Anthropic Engineering, 2025). The first statement is the design principle behind denying files and limiting hosts. The second is a usability result, and it does not measure how often keys reach the context.

Coder's own guidance is that "LLMs and agents can be dangerous if not run with proper boundaries," with separate identities with limited scope advised for autonomous work (Coder, 2026). It governs the identity an agent runs as and does not describe context hygiene.

Source What it documents What the pages reviewed do not describe
Claude Code sandboxing Deny, mask, injectHosts; MCP, hooks, WebFetch outside the sandbox An approver; what the model read
Anthropic engineering post Filesystem and network isolation; 84% fewer permission prompts Frequency of keys reaching the context
Coder Separate, limited identities Context hygiene

What do deny, mask and injectHosts each do?

Three settings, each with a different job. Deny blocks the sandboxed commands from reading the file or variable that holds a key, so the key never enters the context through a command. Mask shows sandboxed commands a sentinel for a key they must use, so a command can make the request and a proxy supplies the real value. injectHosts names the hosts for which the proxy may substitute, so a masked key cannot be spent anywhere else.

Setting Use it for What it leaves open
Deny Keys the agent should never read Paths outside the sandbox
Mask Keys the agent must use Calls to listed hosts carry the key's full scope
injectHosts Limiting where a masked key is substituted Hosts on the list

Together they are context hygiene: nothing the agent does not need, a placeholder for what it must use, and a short list of places the placeholder resolves. The settings are a configuration, not a guarantee. A key denied in one file can still be present in another file nobody listed, and a mask is only as narrow as the host list. How Do You Let an AI Agent Manage API Keys Without Reading Them? covers the key-handling side, and Is It Safe to Give Claude Code My GitHub Token? walks the GitHub token case.

Which paths still surface a key?

More than three, by the documentation's own account: the Read tool, MCP servers, hooks, WebFetch and WebSearch all run outside the sandbox, so the deny and mask settings do not govern what they return. Read is the one to check first, because a denied .env file still opens in full through it unless a permission rule blocks it. An MCP server that returns a key in a response puts it into the context. A hook that prints a variable does the same. A WebFetch of a page that shows a key makes it page content.

The leak record points at the MCP path in particular. GitGuardian's data, as reported, counted "24,008 unique secrets exposed in MCP configuration files" (Help Net Security, 2025). The count describes public repositories, and it shows that MCP configuration is a place where keys are put. Whether an MCP server returns a key in a response depends on the server, and the sandboxing page does not say.

Adaptive attackers bypassed 12 published prompt injection defenses with attack success rates above 90% for most (Nasr et al., 2025), so a list of exceptions should be treated as a list of places to remove keys from, not a list of places to trust the model. The practical rule is to keep keys out of MCP configuration and out of hooks, and to review what each MCP server can return. How Do You Isolate AI Agents From Sensitive Company Systems? describes the session properties that limit what a misdirected agent can reach.

Can an agent do its work with placeholders in the context?

Research suggests yes. A study on swapping identifiers for consistent pseudonyms and restoring them afterward found it "reduces semantic utility errors by a factor of 5 compared to baseline techniques" (Serenari and Lee, 2025). The finding concerns identifiers in conversational services, not API keys, and it supports the design idea behind masking: a model can work with a stable stand-in as well as with the value, provided the stand-in is consistent.

The counterpoint is that placeholders protect only the values they replace. Web agents "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025), so masking one key leaves every other value on a page as readable as before. The seven risk categories Harvard's security office lists for AI-enabled systems include Sensitive Data Exposure and Context and Memory Leakage (Harvard University Information Security and Data Privacy, 2026). A key in the context sits in both.

For the example record, the denied key stayed out of command output, and out of the context only because no tool read its file; the masked key entered command output as a sentinel; and the key surfaced by the MCP server entered as itself. The three outcomes show why the settings and the exceptions list belong on the same page. What Is the PII Wall? describes the wider gap between agent experiments and agents at scale.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this question it covers the pages. If the agent works in a browser on a key-management or settings page, a key shown there is replaced with a placeholder before the model reads it, so it does not enter the context through the rendered page. The sandbox settings cover commands, and the governed environment covers rendered pages. OWASP names the failure class as sensitive information disclosure, where a model's context or outputs reveal data that should not be revealed (OWASP, 2025).

Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so the MCP, hook and WebFetch exceptions on this page are not closed by it. They are closed by keeping keys out of those paths.

Methodology and limitations

This page rests on Anthropic's Claude Code sandboxing documentation and engineering post, Coder's documentation, OWASP guidance, three research papers, a press report of GitGuardian data, Harvard University guidance and existing RedactSure research pages. Sources were read between October 16, 2026 and October 20, 2026. Quoted facts are cited to the page that states them, and the press figures are cited as reported, not as independently measured. The page is a reading of public documents and should be read with Anthropic's current documentation open, since Claude Code changes frequently.

RedactSure did not test Claude Code hands-on. "Not described in the pages reviewed" means the pages reviewed and nothing broader, and in particular what any given MCP server returns is not described. The settings table is a summary of the documentation as read and not a configuration guide. The pseudonym study concerns identifiers in conversational services, not API keys, and is cited for the design principle only. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. Examples describe record types, such as a key denied, one masked and one surfaced by an MCP server, and not organizations.

Determinations about whether a configuration meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a review of the organization's own Claude Code settings, MCP servers and key inventory, and a team should repeat that review whenever it adds a server or a hook, since each addition changes which paths can return a key.

What the record shows

For the owner who signs off on Claude Code, the documentation gives a short list of settings and a short list of exceptions. Deny the files and variables that hold keys, mask the ones the agent must use, and name the hosts the mask may resolve for. Then remember that the Read tool, MCP servers, hooks, WebFetch and WebSearch run outside the sandbox and can still surface a key. The leak record shows why MCP configuration is the exception worth checking first, and the research record shows that working with consistent placeholders costs little in task quality. None of the pages reviewed describes what the model read or who approved an action. One test case worked through end to end will show the gaps: name one agent and one key, ask whether it is denied, masked or neither, and list every MCP server, hook and fetch that could return it.

Frequently asked questions

How do I keep API keys out of Claude Code's context window?

Use three settings and keep one list. Deny the files and environment variables that hold keys in sandbox.credentials, mask the keys the agent must use so sandboxed commands see a sentinel, and name the hosts in injectHosts. Then list the exceptions: the Read tool, MCP servers, hooks, WebFetch and WebSearch run outside the sandbox, so keep keys out of files and paths those can reach and add a Read(...) deny permission rule for the files that hold them. Review the list when a server or hook is added.

What is the difference between deny and mask?

Deny blocks sandboxed commands from reading the file or variable that holds a key. It does not stop the Read tool, so pair it with a Read(...) deny permission rule or move the file. Mask is for a key the commands must use: they see a sentinel and a proxy supplies the real value for listed hosts. Calls to a listed host still carry the key's full scope, so keep the host list narrow and review it when the work changes.

Why can an MCP server still surface a key?

Because the sandboxing documentation places MCP servers outside the sandbox, so the deny and mask settings do not govern what a server returns. If a server's response includes a key, it enters the context as the tool's output. What any particular server returns depends on the server, so a team should review each server, keep keys out of MCP configuration, and check what the server returns when a call fails, since error responses are a common place for values to appear.

Do hooks and WebFetch have the same problem?

Yes, by the same documentation. Hooks and WebFetch run outside the sandbox, so a hook that prints a variable or a fetched page that shows a key puts the value into the context regardless of the credential settings. The fix is the same as for MCP: keep keys out of those paths, and review what each hook and fetch can reach before enabling them. A short written inventory of enabled hooks and fetch targets makes that review repeatable.

Does masking help on a key-management page in a browser?

Not by itself. Masking and denying govern the sandbox. If the agent works a key-management page in a browser, the model reads whatever the page shows, so the page needs a separate control that replaces the key with a placeholder before the model reads it. A governed browser environment does that, and it does not cover a terminal, an IDE or MCP, so it complements the sandbox settings and does not replace them for command-line work.

What should a security team ask for in writing?

Ask which keys are denied, which are masked, which hosts the mask may resolve for, and which MCP servers, hooks and fetches are enabled. Ask what each could return and who approves a consequential use of a key. Treat anything the vendor does not document as unanswered, and ask for a dated answer that names the workspace and the configuration, so the answer can be checked again after the next release. The answer should name the host list for the mask, because a mask that resolves everywhere hides nothing.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Displayed Key Out of the Context Window

A key enters the context window by being read, and deny and mask rules cover only sandboxed command reads, leaving rendered key pages outside them.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent opens the key-management page to confirm which key is active, and the live key enters the context in full, like the one the MCP server returned. Inside the governed environment: the page renders KEY_001, the agent completes the check, and the real key resolves only where a named person approves the call that uses it.

RedactSure is deploying now with enterprise and government customers. Consistent pseudonyms reduced semantic utility errors by a factor of 5 against baseline techniques.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A key on a management page reaches the context window as surely as one read from a file. Bring a Claude Code task that checks which key is active and see, with test values, what the model reads. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.