osm plugin keeps API keys away from Claude Code

An open-source MIT-licensed Claude Code plugin called osm (opensecretmask) swaps secrets for same-shape fakes before the model sees them and restores real values on tool calls. It uses 146 patterns in six groups with an entropy check and needs no proxy or root CA.

• osm replaces a key with a fake of the same prefix, length and character types
• 146 patterns in six groups plus entropy checks and .env reading
• If a hook fails, the value is blocked instead of reaching the model
• Install via claude plugin marketplace add pratikbin/opensecretmask