Use case · Protect
My agent can read my .env file. Protect refuses the read.
Your agent asks to cat .env. Protect refuses the call before it runs, so the model gets a refusal, not your keys. The secrets pack covers .env, your credential files and the environment, in the shell and in the agent's own file tools. Limits →
The agent wants to check your token.
.env and .env.*. Examples and templates are allowed.
⛔ context-mode Protect blocked this command, so it was NOT executed: Blocked by your team’s policy: Read environment files. .env files hold secrets. … Tell the user it was blocked and continue with other work.
The model reads this refusal, not your keys.
Not a shell command: the agent's own Read tool.
File rules cover the agent's own Read, Edit, Grep and Glob tools too, not only the shell.
A Read call is rewritten into the same refusal.
The same read, inside a substitution.
Protect works out the substitution and reads it as cat .env.
cat $(echo .env)
cat `echo .env`
cat $(echo .e)nv
all read as: cat .envNo file at all: the agent dumps the environment.
env, printenv, export -p, a bare set, /proc/<pid>/environ, and commands that read stored secrets.
Keys outside the repo.
~/.ssh, ~/.aws, ~/.kube, ~/.npmrc, ~/.git-credentials, *.pem, *.key and more.
The template the agent needs to set up the app.
.env.example, .env.sample and .env.template hold no secrets, so they run.
One read sends your keys. You do not see it happen.
That is why it is fast. A cat .env to "check the token" looks like normal work.
The file's text becomes a tool result, and the agent sends it to the model with the rest of the conversation.
The shell, the agent's own Read tool, a read inside a substitution, or printenv. A check on one tool name misses the rest.
Checked on the gateway. Refused before it runs.
- 01Turn on the secrets pack
Open Protect in the console and pick Balanced or Locked down. Both include Protect secrets and also turn on Core protections.
- 02Protect reads each call
It reads what the call does, through wrappers such as
sudoandsh -c, in the shell and in the agent's file tools. - 03The client runs a refusal instead
The gateway turns a blocked call into an echo of the refusal. The model reads the rule and why, and the agent carries on with other work.
cat .env to check a token.- Matches "Read environment files"
- Turns the call into an echo of the refusal
- Writes the block to the decision log, with no file contents
Tested on production. Tried in real sessions.
cat $(echo .env).env read and never showed the token, on Claude Opus 5.5 and Claude Haiku 4.5What the secrets pack blocks
| Rule | Blocks | Still runs |
|---|---|---|
| Read environment files | .env and .env.* | .env.example, .env.sample, .env.template |
| Read credential files | ~/.ssh, ~/.aws, ~/.kube, ~/.npmrc, ~/.git-credentials, *.pem, *.key and more | Other files in your home folder |
| Dump the environment | env, printenv, export -p, a bare set, and commands that read stored secrets | env FOO=1 npm test |
| Upload files | curl -F, -T, -d @file; wget --post-file; gh gist create and more | curl -d '{}' to an API |
| Known paste and drop sites | 19 hosts, such as pastebin.com and webhook.site | Other sites, unless you block them |
The live runs are prompt 2 of the Protect docs' 5-minute trial, run on 2026-10-02 and 2026-10-04 in real sessions through the gateway. Limits: without "block other sites", the pack slows a leak and does not stop it. A program that picks its destination at run time, or a script file Protect cannot read, can get past it. Method and sources →
What this uses.
Rules for every tool call, checked before your client runs it. In every plan; off until you turn it on.
Every rule in the secrets pack, the refusal text, and the limits.
How we tried to get past the rules, and the 126 checks.
Start free. On Team, one policy covers every member, and an agent cannot loosen it.
Related: Secure coding agents · For security teams
Keep your keys out of the model.
npx @context-mode/cli connects your agents. 1,000 requests free, no card.