A free tool replaces API keys with placeholders before a coding agent reads them

A coding agent can often work with the name of a secret without needing to read the secret itself. Cloakroom builds around that distinction: the agent sees a placeholder, while a local mapping supplies the real value when a supported operation actually needs it. The key can stay off the guest list while the door still opens.

The free, open-source tool uses hooks around supported tool calls. According to its README, detection happens locally and the placeholder mapping lives in an encrypted vault. A stable placeholder gives the agent something it can refer to consistently without copying the credential into every explanation it generates.

The documentation says it “holds it instead of letting it through” when a check cannot complete. That refusal is the first behavior to check during setup. A privacy tool that steps aside at the inconvenient moment can turn its reassuring name into the most expensive part of the setup.

Its coverage table also marks gaps for some long-running commands and web-search paths. Those limits deserve the same prominence as the successful demonstrations. A protected file-read path doesn’t establish that every possible route to the file has been closed. The distinction gets less exciting in a product pitch and considerably more exciting during an incident.

Begin with a fake credential in a scratch project. The useful trial follows it through a read, an attempted write and a command, then inspects the outputs and logs. That tells the owner whether the exact tools they rely on see the placeholder and whether the application still receives the intended value. Real keys make poor confetti for an installation celebration.

The same trial should include failure. If detection isn’t ready, or a required component stops working, the caller should stop with an understandable reason. A green status message after setup doesn’t answer that question. Refusing the unsafe operation is the part that earns trust, even when the refusal is mildly annoying (usually at the worst time).

The exposure-scanning feature offers another route to investigate older transcripts, but discovering an old secret and preventing a new disclosure are separate jobs. Review any findings without treating a clean scan as proof that a credential never reached somewhere else. Search coverage always has boundaries, including the places nobody remembered to look.

Local substitution is useful when its scope stays visible. The practical question is which path handles the real key at the exact moment the next operation runs.

Check the cloak’s seams, too.