Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/ashlrai/phantom-secrets/agents-mdgit clone --depth 1 https://github.com/ashlrai/phantom-secretsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ashlrai/phantom-secrets/agents-md)<a href="https://agentmods.dev/instructions/ashlrai/phantom-secrets/agents-md"><img src="https://agentmods.dev/badge/instructions/ashlrai/phantom-secrets/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02201 | $0.02201 |
| Opus 5 | $0.01100 | $0.01100 |
| Sonnet 5 | $0.00440 | $0.00440 |
| Haiku 4.5 | $0.00220 | $0.00220 |
Grade B, and why
phantom-secrets AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
phantom setup --client codex # ~/.codex/config.toml How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phantom — AI Agent Instructions
Phantom is an open-source CLI that lets AI coding agents use real API keys safely. It replaces secrets with worthless phantom tokens and injects real credentials via a local HTTP proxy.
MCP Server — Let AI manage secrets directly
Phantom includes an MCP server with 25 tools. Works with Claude Code, Cursor, Windsurf, Codex, and any MCP-compatible tool.
Setup by IDE
One command per client — Phantom writes the right config file for each:
phantom setup --client claude # .claude/settings.local.json (project)
phantom setup --client cursor # ~/.cursor/mcp.json
phantom setup --client windsurf # ~/.codeium/windsurf/mcp_config.json
phantom setup --client codex # ~/.codex/config.toml
phantom setup --client claude --print # snippet to stdout for any client
If phantom-mcp isn't on PATH, the writer falls back to npx -y phantom-secrets-mcp so the config still works on a fresh machine.
GitHub Copilot: MCP via VS Code settings. Project instructions in .github/copilot-instructions.md. Use phantom setup --client claude --print to copy a snippet.
Available MCP Tools (25 total)
| Tool | Description | Parameters |
|---|---|---|
phantom_init |
Protect .env secrets — stores real values in vault, rewrites .env with phm_ tokens | directory (optional) |
phantom_list_secrets |
List all protected secret names (never shows values) | — |
phantom_status |
Show project status, vault backend, secret count, service mappings | — |
phantom_doctor |
Diagnose configuration and vault health (read-only) | — |
phantom_why |
Explain why a key is or is not protected (detection heuristics) | name |
phantom_check |
Scan repo for unprotected secrets (pre-commit-style) | staged (bool) |
phantom_env |
List environment variables and their protection status (no values) | — |
phantom_sync |
Preview/perform deployment-platform sync (Vercel, Railway) | platform (optional) |
phantom_add_secret |
Deprecated — refuses plaintext via MCP to prevent secrets entering AI context. Use phantom_add_secret_interactive (terminal-side prompt) instead |
name, value |
phantom_add_secret_interactive |
Prompt the user for a value on the terminal and store it in the vault. Safe — value never crosses the MCP wire | name |
phantom_remove_secret |
Remove a secret from the vault | name, confirm |
phantom_rotate |
Regenerate all phantom tokens. Old tokens become invalid | confirm |
phantom_copy_secret |
Copy a secret from this project to another project's vault | name, target, confirm |
phantom_wrap |
Wrap a plaintext .env value into a vaulted phm_ token | name |
phantom_unwrap |
Reverse a wrap (restore plaintext to .env from vault) | name, confirm |
phantom_cloud_push |
Push encrypted vault to Phantom Cloud (E2E encrypted) | confirm |
phantom_cloud_pull |
Pull vault from Phantom Cloud | force (bool), confirm |
phantom_cloud_status |
Check cloud auth and sync status | — |
phantom_team_list |
List teams the authenticated user belongs to | — |
phantom_team_create |
Create a new team. Pro plan required. Caller becomes owner | name, confirm |
phantom_team_members |
List members of a team (GitHub login + role) | team_id |
phantom_team_invite |
Invite someone to a team by GitHub username | team_id, github_login, role, confirm |
phantom_team_key_publish |
Register the caller's X25519 public key on a team. Required once per team before pushing/pulling vaults. Private key stays in OS keychain | team_id |
phantom_team_vault_push |
Push the current project's vault to a shared team vault, encrypted client-side (X25519 + ChaCha20-Poly1305) to every member with a registered public key | team_id, confirm |
phantom_team_vault_pull |
Pull the current project's team vault into the local vault. Decrypts the per-member key share locally | team_id, confirm |
phantom_rotate_with_candidate / phantom_rotate_promote / phantom_rotate_provider |
Stage, promote, or provider-rotate credentials without returning values. For phantom_rotate_provider, provider is optional (resolved from the secret's rotation_provider config) and the bootstrap credential is sourced from the server environment or the vault — never the MCP wire |
name, provider (optional), confirm |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 133 lines · 2,201 tokens per session scan B c73c7e4d6c02
phantom-secrets AGENTS.md is an instructions file published in the GitHub repository ashlrai/phantom-secrets (16 stars, last pushed 15d ago), licensed MIT. It adds 2,201 tokens to every session, about $0.0110 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
dsh-auto-review AGENTS.md
AGENTS.md instructions for PerryLink/dsh-auto-review, covering agents.md, layout, hard rules applied here, build and docs.
orloj AGENTS.md
Instructions for OrlojHQ/orloj, covering orloj agent instructions, must-follow sync rules and working style.
nuclear-grade-context-engineering AGENTS.md
Instructions for FlyFission/nuclear-grade-context-engineering, covering agent guidance, default behavior, verification routing, authority boundaries and skill loading rule.
agent47 CLAUDE.md
Instructions for bmdhodl/agent47, covering claude.md, read first, repo boundary, claude repo contract and what claude should optimize for here.
sysknife CLAUDE.md
Instructions for lacs-project/sysknife, covering sysknife operating notes, current focus — ubuntu; gui paused, pre-commit gate, repository workflow and worktree convention.
selectools AGENTS.md
Instructions for johnnichev/selectools, covering selectools -- agent instructions, commands, test (must pass before any commit), type check and security (must pass before release tags).