Transcript Redactor Claude Code mod: a Claude Code transcript redactor

This Claude Code transcript redactor is a community mod by Ray Amjad (ray-amjad), from his claude-code-mods collection. A key that reaches the conversation stays there: it is sent to the model on every later turn, saved in the session file, and replayed into forks and subagents. The mod keeps it out. It replaces each secret with a placeholder like [REDACTED-SECRET-5c1e9a7b], and Claude works with the placeholder.

It scans text at every point where it enters the conversation:

• What you type. A key you paste is swapped before the prompt is sent. A toast says how many values were hidden.
• CLAUDE.md and other blocks sent with the first message, and text the engine adds on its own, such as a diff of a changed file or a queued prompt.
• Tool results. A cat .env shows PORT=3000 and a placeholder for the key. The tool row reads transcript-redactor: hid 1 value(s).
• @-mentioned files. A file that holds a key is refused, and Claude is told to use the Read tool instead, whose result is scrubbed.
• Subagent tasks. The prompt is scrubbed before the subagent starts.

The same value always gets the same placeholder within a session, so Claude can still tell two keys apart. When Claude writes a placeholder into a Bash command or a file, the mod puts the real key back first, so curl -H "Authorization: Bearer [REDACTED-SECRET-5c1e9a7b]" really authenticates.

The install block above adds the author's marketplace and installs the plugin from it. There is nothing to call afterwards: it runs on every turn. Mods only load in a folder you have trusted. Restart Claude Code or run /reload-plugins if you installed from a shell into an open session.

The plugin is one hooks module, hooks/redact.ts, which registers six hooks, and a pure detection file, hooks/detect.ts. A value is hidden when it matches one of about 70 vendor key shapes, a JWT, a private key block, a password in a connection string or after a flag, a long mixed-case token above an entropy floor, or a shorter token right after a name like API_KEY= or "token":. Git SHAs, Stripe object ids and names written in code are kept.

Every hook fails closed. If a scan throws or runs past its budget, the result is withheld rather than passed on. A restored value that contains shell characters is never put into a command. This is from redact.ts:

const SHELL_ACTIVE = /[\s$`"'\\;&|<>()*?[\]{}#~]|[\x00-\x1f\x7f]/

const input = isLocal ? (walk({ ...e }, restoreTracked) as typeof e) : e
if (e.tool === 'Bash' && [...handed].some((v) => SHELL_ACTIVE.test(v))) {
  return {
    deny: `${brand.name}: a secret in this command holds shell characters, so its real value was not put into Bash, where it could run as code. Write it to a file with the Write tool and have the command read that file instead.`,
  }
}
const r = await next(input)

After the tool answers, the result, its text and any attached context are scanned, and anything it printed of a restored value is hidden again. A placeholder-shaped string that a tool read back from a file is turned into a quoted [REDACTED-LITERAL-…] placeholder, so a crafted file cannot make the mod write a real key somewhere.

Set options with /plugin configure transcript-redactor@claude-code-mods, or under pluginConfigs in your user settings. The main ones:

• secrets (default on) and pii (default off, hides emails and public IPs), with hideEmails and redactPrivateIps refining it.
• restoreInToolInputs and restoreTools decide whether and for which tools a placeholder becomes a real value. The default tools are Bash,Write,Edit,MultiEdit,NotebookEdit.
• notify turns the tool-row count and the toast on or off.
• minEntropy (3.6), minLength (24) and contextMinEntropy (3.0) tune the detector. Raise them to hide less.
• allow, allowEmails, allowPrefixes, allowUrlHosts and denyPrefixes mark things to keep or to test anyway. Do not put a host in allowUrlHosts if it carries credentials in the path.

We read the manifest, hooks/hooks.json, hooks/redact.ts and all 1,657 lines of hooks/detect.ts before running anything. The plugin has no package.json, no scripts and no binary. It ships PNG screenshots, HTML sources for them and test files, which the plugin does not load; we did not read the HTML or the extra test/*.mts files. What we found:

• No network and no processes. There is no fetch, socket, child_process or $.process.run. The https:// strings in detect.ts are patterns for recognizing Slack and Discord webhooks and similar.
• File access. $.fs.read and $.fs.exists are used only to check an @-mentioned file for secrets (redact.ts:221, :228). The mod writes no files, and nothing under ~/.claude or shell files. The vault is memory only.
• Gating hooks. prompt.submit, tool.call, prompt.mention and agent.spawn can block or rewrite. That is the purpose of the mod and matches the README. All four have a .catch. If a scan fails, the prompt is dropped, the tool call is denied or its result withheld, or the subagent is not started. A false positive can therefore stop a step, and a workflow agent whose prompt holds a key is refused.
• The real key is handed to local tools by design. A placeholder in a curl command inside Bash is sent as the real key to whatever host the command names. A placeholder written with Write or Edit lands on disk as the key, and in git if you commit that file. Take Bash out of restoreTools if you would rather it never did. The README states that this is not a defence against a model trying to leak a key.
• Secrets, environment, telemetry. It reads no environment variables or credential files and sends nothing anywhere. There is no telemetry.
• Model influence. The only text it injects is its own notices and refusal messages, for example "ask Claude to Read it instead". We found no hidden or zero-width characters and no instructions aimed at the model beyond those.
• No obfuscation. All code is readable TypeScript with no eval or dynamic import.
• License. MIT, with a LICENSE file in the repository root.

claude plugin validate passed with no errors. Its one warning is that the plugin has no icon. claude plugin test ran the author's 37 tests in tests/redact.test.ts on Claude Code 2.1.307, and all passed.

The mod loaded on Claude Code 2.1.307 on macOS. The author's README says it was tested with 2.1.296. It needs hooks modules, so it does not work on older builds that lack them.

• A command was denied. The message says the secret holds shell characters. Write the value to a file with Write and have the command read the file.
• A result was withheld. It was too large to scan in time, or a secret sat in a part it cannot rewrite. Narrow the call with head, grep or an offset.
• Something harmless is hidden. Add the exact string to allow, a prefix to allowPrefixes, or raise minEntropy.
• A key is not hidden. A key with no known shape and no name beside it, such as a plain-word password, is missed.
• A placeholder means nothing. The vault is not kept between sessions, so placeholders from an earlier session are not restored.

To check it, ask Claude to run echo "key=sk-ant-abcdefghijklmnopqrstuvwxyz0123456789" with a made-up value, and look for the placeholder and the count on the tool row.