Nopeek

nopeek

[](https://viteplus.dev) [](https://vitest.dev)

CLI for reducing accidental secret disclosure in LLM coding sessions. nopeek gives agents a normal workflow for secret-dependent commands without requiring secret values to be pasted into prompts or printed by the loading step.

Quick Start

For Pi and other harnesses where each tool call starts a fresh shell, use `run` so loading and execution happen in one child process:

"use npx nopeek run .env --only DATABASE_URL -- sh -c 'psql \"$DATABASE_URL\" -c \"SELECT count(*) FROM users\"'"

"use npx nopeek run .env --only STRIPE_KEY -- sh -c 'curl -H \"Authorization: Bearer $STRIPE_KEY\" https://api.example.com'"

`run` reports no secret values itself. The child command can still print a secret, so choose commands and flags that do not dump their environment, credentials, or verbose authentication data.

If your harness supports persistent env-file injection, `load` can make selected variables available to later commands:

"use npx nopeek load .env --only DATABASE_URL,API_KEY, then use those variables by name"

How It Works

Shell output visible to an LLM coding agent may be sent to a model provider and retained there. Agents also have a habit of inspecting `.env` files or echoing variables when credentials are needed. nopeek provides a lower-risk path for routine work:

1. It parses the requested secret file locally.
2. run gives selected values only to one child process, or load uses the best environment-loading method available.
3. nopeek's normal status output reports key names and loading state, not values.

This reduces accidental disclosure. It does not make secrets inaccessible to the agent or to the child command that receives them.

**Important:** Your agen