Store the key once
macOS: security add-generic-password -a "$USER" -s NAME -w · Windows: Set-Secret -Name NAME · Linux: secret-tool store --label=NAME service NAME. Each asks for the value.
AI coding agents · Risk · CWE-798 · OWASP LLM02
Your AI agent can read your API keys
Keys pasted into an MCP config, a .env file a skill loads, a folder like ~/.aws the agent may open: each is one read away from the agent, and from anything that steers it.
.mcp.json (Claude Code) −key in the file+key from your keychain{ "mcpServers": { "github": {− "env": { "GITHUB_TOKEN": "ghp_••••••••••••" }+ "env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" } } } }
Why it matters
An agent reads files to do its job. A key in a file it can read can end up in a prompt, a log, a commit or a request to a server, and an instruction hidden in a README or a web page can ask for exactly that. A key in your keychain is read only by the program you start with it.
Where NeuroShield finds keys
| Place | What it looks like |
|---|---|
| An MCP server's config | A token in env, in the server's arguments, in its URL or in a header. |
| A .env file a skill or script loads | source .env, or a grep / cut of one line out of somebody else's .env. |
| Folders full of keys | Read rules that open ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, .npmrc or .netrc to the agent. |
| A loose key file | A file with keys in an agent's folder that nothing reads any more. |
How to fix it
Read it back where it's needed
In your shell profile or the script: export NAME="$(security find-generic-password -a "$USER" -s NAME -w)", then put a reference in the config where the key was: ${NAME} in Claude Code, ${env:NAME} in VS Code and Cursor. For Claude Desktop, start the server from a small script that reads the key from your keychain.
Close the folders
Delete read rules that open key folders, or narrow them to the one folder the agent needs; it then asks before reading keys.
Fix It for Me
On a Mac, NeuroShield can move a key from a skill's .env into Keychain and rewrite the line itself, with a backup and Undo.
NeuroShield shows each key by name, never its value
It reads every agent's settings, MCP configs, skills and the .env files they load, and names the key, the file and the line. The value never leaves the file.
Questions
Isn't a .env file in .gitignore safe enough?
It keeps the key out of git, not out of the agent's reach. The agent reads files on your disk, ignored or not.
Does NeuroShield send my keys anywhere?
No. It reads locally and shows key names only.
See your own agents
The check is free: how many agents you have and what they can do. Details and fixes come with Shields.