SCHEMAS
Known keys come with their checks, and a link to the page where you make them. Pick one, and change its key.
From the registry · pick one
Keep secrets
off the prompt.
Agents need API keys. Paste one into the chat and it lives in the transcript for good. offprompt opens a page in your browser instead, and the value goes straight into the file.
npx offprompt init- MIT licensed
- Works in cloud sandboxes too
- Works with any MCP client
Tested with
- Claude Code
- Codex
- Cursor
- Pi
Twenty seconds,
start to finish.
The agent pauses, you paste, it continues. Only the key names pass through the transcript, so there's nothing to redact later.
Try it in the playgroundThe agent needs a secret
The agent names the keys it needs and the file they go in, then waits.
User inputs via browser
A page opens in your browser. It says who is asking, why, and where it writes, and checks each value as you type.
Secrets are safely written to file
The same four emoji on your page and in the agent's reply: the file holds what you typed.
Rich fields.
Every secret comes with an intention: the agent says why it needs it, and the page shows that before you type. Checks are optional, for the keys and formats offprompt knows, and a key the file already holds is flagged before it's replaced.
OVERWRITES
Orange when the file already has a value, before anything is replaced
GENERATED SECRETS
Random values like JWT_SECRET are made right on the page. Press Regenerate for another.
From your browser
to the file.
On your machine, the page is served from 127.0.0.1 and nothing leaves it. When the agent runs in a cloud sandbox, the page reaches you through a Cloudflare tunnel, and your browser encrypts the values first, to a key only the sandbox holds.
Runs beside the agent
One process on 127.0.0.1 wherever the agent runs, started by Claude Code, Cursor, Codex or anything else that speaks MCP.
Sealed over tunnels
The page loads nothing from the network. From a sandbox, the tunnel only ever carries ciphertext.
Nothing kept
Values go into your file and nowhere else. The page holds nothing once the tab closes.
Open source
MIT licensed. Every line is on GitHub, and the package is on npm.
Keep secrets off
the prompt.
One command. Then forget it's there.
npx offprompt initIt adds offprompt to every agent it finds: Claude Code, Codex, Cursor and Pi.