Motus — AI skill for Claude Code

Stop your AI coding agent from leaking your API keys.

An agent that runs `env`, `cat .env` or [`forge -vvvv`](https://book.getfoundry.sh/forge/) sends every value it prints to the model provider. In [pi](https://github.com/earendil-works/pi) it also lands in the session files, where memory tools copy it again. motus loads your secrets at session start and replaces each exact value with `[REDACTED:NAME]` before output leaves the tool. It also blocks the commands and files that print secrets in the first place.

• pi: redaction plus blocks. Covers tool results, saved messages, prompts, ! shell commands and the provider request.
• Claude Code: blocks only, through a PreToolUse hook. Claude Code ignores output rewrites for Bash, so there is nothing to redact with.
• Five sources: env, command, `mise`, `pa` and `1password`. One TOML file configures all of it.
• Web3 safe: no entropy or hex rules, so tx hashes, addresses and storage slots pass through untouched.
• Fail closed: a required source that fails where it applies blocks tools until you accept partial protection.

It stops accidental leaks only. A hostile or prompt-injected agent can exfiltrate a secret before any output is redacted. Use a sandbox for that.

Status: 1.0 is not published to npm yet, and the end-to-end smoke test in [pi](https://github.com/earendil-works/pi) is still open ([`meta/plan.md`](meta/plan.md)).

Install

pi

Install globally and load motus before every other extension:

pi install npm:@espadat/motus

`pi install` appends motus to the end of `packages` in `~/.pi/agent/settings.json`. Move it to the top:

{
  "packages": [
    "npm:@espadat/motus",
    "npm:other-extension"
  ]
}

• Global, never --local: subagent [pi](https:/