44 pages for mask.

compliance-sessions Claude Developer Platform · in the page manage-claude/compliance-sessions …s, all returned as they were sent apart from size truncation. Nothing masks URLs, credentials, or personal data in that content, so treat transcripts as sensitive. The transcript omits or replaces the… Use Claude Code features in the SDK Claude Code CLI · in the page agent-sdk/claude-code-features …s`](/docs/en/sandboxing#protect-credentials) `deny` entries and file `mask` entries in `~/.claude/settings.json` | When the [command sandbox](/docs/en/sandboxing) runs, Claude Code applies the `deny`… Claude Code changelog Claude Code CLI · in the page changelog …s Application Support * Fixed a freeze of several seconds when secret masking met very long unbroken text * Fixed some permission rules and safety checks not being applied to a tool call after a PreTo… Channels reference Claude Code CLI · in the page channels-reference …fields are unchanged. Clients on Claude Code v2.1.234 or later also mask credentials in `description` and `input_preview`. You receive `[REDACTED]` in place of a recognizable provider credential tok… Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry Claude Code CLI · in the page claude-apps-gateway …ly their `path` or `name` and the mode. * **File entries with [`mode: mask`](/docs/en/sandboxing#mask-credential-files)**: forwarded sentinel-only, as a whole-file mask whose `injectHosts` is the empt… claude-tag Claude Code CLI · in the page claude-tag …over:bg-gray-300" aria-hidden="true" focusable="false" style="-webkit-mask-image:url("https://d3gk2c5xim1je2.cloudfront.net/fontawesome/v7.2.0/solid/magnifying-glass.svg");-webkit-mask-repea… Error reference Claude Code CLI · in the page errors …ox-allow-entries-are-ignored-under-a-managed-lock) | | `Stale sandbox mask files left by a killed session` | [Configuration warnings](#stale-sandbox-mask-files-left-by-a-killed-session) | | Responses… Claude Code GitLab CI/CD Claude Code CLI · in the page gitlab-ci-cd …de patterns * **Simple setup**: Add one job to `.gitlab-ci.yml` and a masked CI/CD variable * **Enterprise-ready**: Choose Claude API, Amazon Bedrock, or Google Cloud's Agent Platform to meet data res… Connect Claude Code to tools via MCP Claude Code CLI · in the page mcp …p's client ID. The `--client-secret` flag prompts for the secret with masked input: ```bash theme={null} claude mcp add --transport http \ --client-id your-client-id --client-secret --callback-port… Monitoring Claude Code CLI · in the page monitoring-usage …tes, `prompt` and [`prompt_text`](#user-prompt-event). If you drop or mask the event's prompt text by attribute name in your collector, name both attributes in the rule This OpenTelemetry Collect… Add components to a plugin Claude Code CLI · in the page plugins/components …it. Set `"sensitive": true` for a token or password. The dialog then masks the input, and the value is stored in secure storage rather than `settings.json`. This manifest asks for an endpoint and a… Plugin manifest reference Claude Code CLI · in the page plugins/manifest-reference …string`, allows an array of strings | | `sensitive` | No | If `true`, masks input and stores the value in secure storage instead of `settings.json` | | `min` / `max` | No | Bounds for `number` | Each… Configure the sandboxed Bash tool Claude Code CLI · in the page sandboxing …n/settings-reference#invalid-credential-entries-in-managed-settings) `mask` entry doesn't lock the key, even when Claude Code [falls back to `deny`](#mask-credential-files) for it at startup. List a p… Deploy self-hosted environments to production Claude Code CLI · in the page self-hosted-environments-deploy …-manually), so the secret never appears in your shell history. Run `(umask 077 && cat > ./environment-secret)`, paste the secret, press Enter, then Ctrl-D. Then create the Secret and delete the file:… Self-hosted environments quickstart Claude Code CLI · in the page self-hosted-environments-quickstart …the value you copied, press Enter, then Ctrl-D, and the subshell's `umask` makes the file readable only by its owner. ```bash theme={null} (umask 077 && cat > /etc/claude/environment-secret) ``` Ch… Test self-hosted environments end to end Claude Code CLI · in the page self-hosted-environments-testing …tial that can register runners into the environment, so store it as a masked CI secret and print only the environment ID. The `-H @-` form that keeps the token out of the process list requires curl 7.… Claude Code settings Claude Code CLI · in the page settings …or `envVars` that still has a valid `path` or `name` and a `mode` of `mask` or `deny`, such as one whose `extract` pattern has no capturing group, is degraded to `mode: "deny"` with a warning, so the… All settings Claude Code CLI · in the page settings-reference …| Managed | | [`sandbox.credentials`](#sandbox-credentials) | Hide or mask credential files and variables inside the [sandbox](/docs/en/sandboxing#protect-credentials) | Sandbox settings | Any file |… Extend Claude with skills Claude Code CLI · in the page skills …ession matters because leftover context from authoring the skill will mask gaps in the written instructions. How you turn the skill off for the second run depends on where it comes from: * **Persona… Use Claude Code in VS Code Claude Code CLI · in the page vs-code …, click the gear icon on the plugin's row. Sensitive text fields are masked, and a secret you saved earlier shows **(unchanged)**. Leave the field blank to keep the saved value. After you save change… Week 32 · August 3–7, 2026 Claude Code CLI · in the page whats-new/2026-w32 …t+F` (`Ctrl+Option+F` on Mac)Sandbox credential files accept [`mode: "mask"`](/docs/en/sandboxing#mask-credential-files) on Linux and WSL2, so sandboxed commands read a sentinel copy while the sandbox… Changelog Claude Documentation · in the page cowork/changelog …, when also present, still wins on `Authorization`. Header values are masked in diagnostics, and both keys are accepted only from device management or a local configuration file. * Added the option to… Deploy with Enterprise Admin Console Claude Documentation · in the page third-party/claude-desktop/admin-console …es your AWS region and account ID. Claude Desktop 1.52386.0 and later mask the account ID before sending. For Google Cloud, the identifier can be a resource path that includes your project ID | `claud… Deploy with a bootstrap server Claude Documentation · in the page third-party/claude-desktop/bootstrap …n file only, never from the bootstrap response, and header values are masked in the diagnostic report. [Origin pinning](#origin-pinning) applies in this mode exactly as in device-code mode. Use this i… Configuration reference Claude Documentation · in the page third-party/claude-desktop/configuration …ces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. > **bootstrapHeadersHelper deta… User identity and local data Claude Documentation · in the page third-party/claude-desktop/data-storage …riables for Code sessions from their original source, because the app masks saved values * In each project they use from Chat, use **Choose a folder > Choose a different folder** to select the same fo… Debugging Model Context Protocol · in the page docs/2024-11-05/tools/debugging …. **Sensitive Data** * Sanitize logs * Protect credentials * Mask personal information 2. **Access Control** * Verify permissions * Check authentication * Monitor access patterns F… Security Best Practices Model Context Protocol · in the page docs/2024-11-05/tutorials/security/security_best_practices …ge token disrupts all workflows * Audit noise: single omnibus scope masks user intent per operation * Privilege chaining: attacker can immediately invoke high-risk tools without further elevation… Debugging Model Context Protocol · in the page docs/2025-03-26/tools/debugging …. **Sensitive Data** * Sanitize logs * Protect credentials * Mask personal information 2. **Access Control** * Verify permissions * Check authentication * Monitor access patterns F… Security Best Practices Model Context Protocol · in the page docs/2025-03-26/tutorials/security/security_best_practices …ge token disrupts all workflows * Audit noise: single omnibus scope masks user intent per operation * Privilege chaining: attacker can immediately invoke high-risk tools without further elevation… Debugging Model Context Protocol · in the page docs/2025-06-18/tools/debugging …. **Sensitive Data** * Sanitize logs * Protect credentials * Mask personal information 2. **Access Control** * Verify permissions * Check authentication * Monitor access patterns F… Security Best Practices Model Context Protocol · in the page docs/2025-06-18/tutorials/security/security_best_practices …ge token disrupts all workflows * Audit noise: single omnibus scope masks user intent per operation * Privilege chaining: attacker can immediately invoke high-risk tools without further elevation… Debugging Model Context Protocol · in the page docs/2025-11-25/tools/debugging …. **Sensitive Data** * Sanitize logs * Protect credentials * Mask personal information 2. **Access Control** * Verify permissions * Check authentication * Monitor access patterns F… Security Best Practices Model Context Protocol · in the page docs/2025-11-25/tutorials/security/security_best_practices …ge token disrupts all workflows * Audit noise: single omnibus scope masks user intent per operation * Privilege chaining: attacker can immediately invoke high-risk tools without further elevation… Debugging Model Context Protocol · in the page docs/2026-07-28/tools/debugging …. **Sensitive Data** * Sanitize logs * Protect credentials * Mask personal information 2. **Access Control** * Verify permissions * Check authentication * Monitor access patterns F… Configuration and flags Model Context Protocol · in the page docs/2026-07-28/tools/inspector/configuration …every write. Generate the key rather than choosing it, for example `(umask 077 && openssl rand -base64 32 > ~/.config/mcp-inspector/secret-key)`, and keep it away from the secrets file, its backups an… Recipes Model Context Protocol · in the page docs/2026-07-28/tools/inspector/recipes …tory: > > ```bash theme={null} > mkdir -p ~/.config/mcp-inspector > (umask 077 && openssl rand -base64 32 > ~/.config/mcp-inspector/secret-key) > ``` > > Even encrypted, secrets on disk carry moderate… Web client Model Context Protocol · in the page docs/2026-07-28/tools/inspector/web …put their own diagnostics. Secrets in Network headers and bodies are masked, with a control to reveal them; Protocol and Console show traffic as sent. Entries can be cleared or exported. `, and keep it away from the secrets file, its backups an… Recipes Model Context Protocol · in the page docs/draft/tools/inspector/recipes …tory: > > ```bash theme={null} > mkdir -p ~/.config/mcp-inspector > (umask 077 && openssl rand -base64 32 > ~/.config/mcp-inspector/secret-key) > ``` > > Even encrypted, secrets on disk carry moderate… Web client Model Context Protocol · in the page docs/draft/tools/inspector/web …put their own diagnostics. Secrets in Network headers and bodies are masked, with a control to reveal them; Protocol and Console show traffic as sent. Entries can be cleared or exported. ![](https:/… Security Best Practices Model Context Protocol · in the page docs/draft/tutorials/security/security_best_practices …ge token disrupts all workflows * Audit noise: single omnibus scope masks user intent per operation * Privilege chaining: attacker can immediately invoke high-risk tools without further elevation…