Skip to content
Conduit

skill

env-phantom

Zero-knowledge .env proxy: phantom tokens in process.env, real secrets only at TLS edge for allowlisted hosts

kanchingyg/env-phantomcommunitylistedunreviewed
Use skill

Set up

Skills are installed by placing their folder where your agent loads skills.

Download ZIP from GitHub Open the repository

The download comes from github.com/kanchingyg/env-phantom itself, not from our server, so what you get is exactly what its author published.

Install instructions come from the README

Skills do not use an MCP config. Follow the steps in the README below.

README

synced Oct 28, 2026

env-phantom

ci npm JSR JSR Score Runtime license

One line: npx env-phantom mask .env --allow-write && npx env-phantom run -- node app.js

Child processes and coding agents see format-preserving phantom_* tokens in process.env. Real secrets are swapped in only inside the local edge HTTP proxy when the outbound Host matches your allowlist; everything else gets 403 Blocked by env-phantom. HTTPS_PROXY uses HTTP CONNECT (tunnel or local TLS MITM for rewrite hosts). The vault is encrypted at rest (AES-256-GCM); set ENV_PHANTOM_VAULT_KEY or use the machine-derived fallback. mask --allow-write backs up .env to .env.bak first.

Why not dotenvx / 1Password / Infisical?

Those tools decrypt secrets directly into the child process environment. Any dependency, coding agent, or postinstall script can read process.env and exfiltrate the real key. env-phantom never places the real secret value in the child environment.

Install

Bun / npm:

bunx env-phantom mask .env --dry-run
npx env-phantom mask .env --dry-run

# or install in your project / globally
bun add -d env-phantom
npm i -D env-phantom

JSR:

bunx jsr add @kanchingyg/env-phantom
npx jsr add @kanchingyg/env-phantom

CLI

CommandPurpose
mask .envPrint masked env (--dry-run / --allow-write to persist + vault)
run -- <cmd>Run command with phantom env + local proxy
auditPrint blocked exfiltration attempts
--mcpStart MCP server over stdio

Ollama (optional)

For explain_exfil_attempt, run Ollama on port 11434. Cloud OpenAI-compatible endpoints used for embeddings can sit behind the same phantom vault pattern via HTTP_PROXY.

MCP Tools Reference

ToolMutatesDescription
list_phantom_keysfalseList phantom env keys and merged allowlisted hosts (no secret values).
run_sandboxedtrueRun argv under phantom env + edge proxy (--allow-write; optional cwd under sandbox root).
explain_exfil_attemptfalseSummarize a blocked exfiltration log entry (logId; optional local model).

Masking .env is CLI-only (mask); use npx env-phantom audit for blocked outbound attempts.

Editor and Agent Integration

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "env-phantom": {
      "command": "npx",
      "args": ["-y", "env-phantom", "--mcp"]
    }
  }
}

Claude Code CLI

claude mcp add env-phantom -- npx -y env-phantom --mcp

Programmatic Usage (JSR / TypeScript)

import * as bridge from "jsr:@kanchingyg/env-phantom/bridge";

Runtime Safety and Guardrails

  • Stdio frame isolation: --mcp keeps JSON-RPC on stdout clean (logs go to stderr).
  • Read-only default: run_sandboxed needs --allow-write; --dry-run blocks mutating tools.
  • Loop breaker: Identical MCP tool calls halt after three repeats.
  • Path containment: mask and MCP cwd must stay under the process working directory.
  • Edge proxy: Non-allowlisted hosts get 403 when a request carries a phantom token.

License

MIT

↑↓ navigate openesc close