Your agent never sees the secret.

A local proxy hands your agent a fake DSN, never the real credential. The real one swaps in only on the way out, loaded from your OS keychain, and never lands in context or logs.

View on GitHub (opens in a new tab)Get started free
install with Homebrew
$ brew install hoophq/tap/cloak
# then move your secrets to the keychain:
$ cloak import .env

Same query, one line apart.

The agent runs the same connection both times. Switch the log and watch the only line that changes.

The real password sits in plaintext, in every prompt, log line, and trace the agent produces.

agent.log, without CloakExposed
$ connecting to database...
DATABASE_URL=
postgres://admin:Xk29!zRq@prod-db:5432/app
$ query executed → 10 rows

Three steps, all local.

Works today for PostgreSQL and for HTTP APIs that take a bearer token or an API-key header.

  1. A fake local DSN

    Instead of a real connection string, your agent gets a DSN or token pointing at localhost, the address of the local proxy.

    cloak:a8f2c9e1@localhost:5433

  2. Agent connects

    The agent dials localhost exactly like it would dial the real database or service. Cloak is the only thing listening there.

    connect(DATABASE_URL)

  3. Swapped on egress

    Cloak opens the actual connection to the destination and substitutes the real credential, never touching agent context or logs.

Built for isolation, not policy.

One import moves the real secrets to your keychain and rewrites the .env to fakes that only resolve through Cloak.

point cloak at your .env
$ cloak import .env
→ DATABASE_URL (line 1): upstream "database-url" on 127.0.0.1:5433, credential moves to the OS keychain
→ OPENAI_API_KEY (line 2): upstream "openai-api-key" on 127.0.0.1:5434, credential moves to the OS keychain
Rewrite .env? [y/N] y
imported 2 credential(s); .env rewritten (original backed up)
# wire it into Claude Code, once
$ cloak init

  • No infrastructure dependency

    Cloak runs alongside your agent process. No service to deploy, no infrastructure to stand up.

  • Zero secrets in context or logs

    The real DSN and credential never enter the agent’s prompt, memory, or logs. Only the local proxy ever holds them.

  • Isolation, not policy

    Cloak keeps the credential out of the agent’s reach. It doesn’t enforce access rules or audit what runs; that’s a separate concern.

More from hoop Labs.

Each tool solves one problem, runs locally and needs no signup to try.

See every labs tool

Enforce it across the fleet.

hoop is the same credential-isolation proxy, running centrally, with access policy, data masking, and full audit logs across every agent and every protocol.

Get started freeView on GitHub (opens in a new tab)

Ask an assistant what hoop.dev does: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.

install and wire it in
$ brew install hoophq/tap/cloak
$ cloak import .env
$ cloak init