Secrets do not only come from .env files. They can appear in a prompt, a terminal response, a browser page, structured MCP data, or a screenshot. Pentect checks these values before the supported client sends its next request to the model provider.

A secret pasted into a prompt

You may paste a token while asking the agent to test an API:

Test the account with OPENAI_API_KEY=sk-ABCDEFGHIJKLMNOPQRSTUVWX

When the protected client sends that prompt, Pentect replaces the detected value first:

Test the account with OPENAI_API_KEY=<<OPENAI_API_KEY_...>>

The client UI can still show what you typed locally. The provider receives the protected request. This applies only when the client was started through Pentect and the request uses a supported format.

A secret appears by accident

A tool may print more than expected. Common examples include:

• a command that prints its environment;
• a log containing a connection string;
• a file-read result containing a token;
• clipboard text copied from an admin page;
• JSON returned by an MCP server or connector.

Pentect checks supported tool results before they become part of the next model request. Text and structured values are replaced with handles. The model can continue using the safe reference without receiving the original value.

This protection happens on the provider boundary. Pentect cannot take back a value that another program already sent outside the protected flow.

An MCP browser creates an API key

An agent can use a browser tool to create a credential without asking you to copy it into chat. A protected flow looks like this:

1. The model asks the local browser or MCP tool to create the key.
2. The website shows the new key on your computer.
3. The tool returns page text, HTML, JSON, clipboard text, or an image.
4. Pentect checks the supported tool result before the client sends it back to the provider.
5. The provider sees a handle such as <<APIKEY_...>>.
6. A later local tool can use that known handle through the protected tool boundary or its PENTECT_<LABEL>_<ID> environment binding.

For example, an MCP result like this:

{
  "structuredContent": {
    "apiKey": "sk-ABCDEFGHIJKLMNOPQRSTUVWX"
  }
}

is sent to the provider with the value replaced:

{
  "structuredContent": {
    "apiKey": "<<APIKEY_...>>"
  }
}

Pentect does not grant the browser permission to create or use a key. Browser confirmation, site permissions, and the MCP server's own access rules still apply. If the browser tool sends a secret directly to a website, that network side effect happens outside Pentect's provider boundary.

Screenshots and OCR

A screenshot may contain a token even when the tool result has no useful text. With OCR enabled, Pentect scans supported image payloads locally and covers detected sensitive regions before the image is sent to the provider.

Pentect also checks text found in supported QR codes and barcodes. When an image must be rewritten, it removes supported metadata and sends protected pixels instead of the original image.

If OCR is disabled or an image cannot be checked, the default setting blocks it. You can choose to allow unchecked media, but then the provider may receive content Pentect did not inspect:

[image]
unscanned = "allow"

OCR is not perfect. Low contrast, small text, unusual fonts, handwriting, cropped content, or an unsupported image format can be missed. Keep browser and tool permissions limited even when OCR is enabled.

See Files and images for supported formats, limits, remote URLs, PDF behavior, and image settings.

What is covered

Source	What Pentect does before the provider request
Prompt text	Replaces detected sensitive values with handles
Terminal, file, and log output	Masks supported text returned by a local tool
MCP text or structured result	Checks supported strings and structured fields
Clipboard text returned by a tool	Masks detected values
Supported screenshot or inline image	Runs local OCR and covers detected regions
Unknown media or result format	Blocks it by default when it cannot be checked safely

What is not covered

• A request made by a client that was not started through Pentect
• Data already sent before Pentect saw it
• A direct network side effect performed inside a browser, MCP server, or local tool
• Content hidden in an unsupported or unchecked format
• A sensitive value that no detector or OCR engine finds

Pentect reduces exposure to the model provider. It does not replace browser approval, MCP permissions, restricted credentials, or normal access control.