Your .env stays out of agents’ file reads
File reads and writes of env files, keys and credentials are blocked, and sending them is flagged by the read scan.
A secret read, stopped
- The value never reaches the model
- The read is denied before it runs, so the file’s contents are not in the agent’s context.
- Allowed once, on purpose
- The agent or person asks from the record. An admin allows it once or for a while, and the retry passes.
- Tracked by variable name
- A config change can live in a task by variable name and owner, with no secret in it.
The Secrets and env files policy
Reads and writes of .env files, keys and tokens, and sending them anywhere.
- It installs as Observe, so you see your own traffic first. Turn it to Block when you are ready.
- File names are exact: .env.staging is not covered until an admin adds it.
- Sending a secret somewhere needs the content scan, which looks at what the agent reads.
- A shell command's files cannot all be listed, so while this policy is on, shell commands are observed.
Related use cases and clients
- Production changesAn agent’s deploy is blocked until someone allows it, and the answer stays on the record.
- Set up CursorShell commands, MCP tools and file reads in Cursor pass the adapter before they run.
- Set up the MCP proxyThe adapter’s proxy wraps each MCP server a client uses, so every tool call passes the same policy.