Ashlr cover: a green shield and a placeholder key, with the headline Setup fixes for Claude Code and a safer status check.

Ashlr releaseSecurity

Phantom Secrets 0.7.9 fixes Claude Code setup

By Ashlr.AIAI-assisted briefingPublished Sep 7, 2026, 8:10 PM UTC3 min read

Phantom Secrets 0.7.9 fixes how it registers with Claude Code and adds a status check that never opens your vault. This is an Ashlr release.

This briefing covers a release from Ashlr’s own developer-tool projects. Product claims come from the linked sources; this is not an independent review.

What changed

Phantom Secrets is our open-source tool that keeps real API keys out of your AI agent's view. Version 0.7.9 was published on GitHub on September 7, 2026. The release notes call it a repair release. It fixes how the tool connects to agents.

The first fix is a new status check. The command phantom status --json now gives a short, stable answer about whether a project is set up. It reads only metadata. It does not open your vault, it does not need a login token, and it does not poke the old proxy port. Other tools can use it to ask "is Phantom ready here?" without touching a secret.

Browse all stories

Field noteSecurity

Your agent can use the key. It never sees it.

Oct 17, 2026

The second fix is for Claude Code users. Phantom now writes its project registration to a file called .mcp.json. It leaves your other settings in .claude/settings.local.json alone. If an older setup used only the legacy location, the readiness check now says so out loud.

The third change is a test. The project's automated checks now run the installed command-line tool and the MCP onboarding steps on every supported platform, not only the source code.

The notes say the earlier v0.7.8 release stays available. They also say that the hosted service is tracked separately from this native release. Nothing here changes the core idea: your project holds placeholders, and the real keys stay in your keychain.

What it means for your work

For builders

If you set up Phantom Secrets with Claude Code before this release, run phantom status --json and check that your project registration shows up in .mcp.json. If the readiness check flags a legacy-only setup, re-run the setup command.

For business

This is routine repair work, and that is a good sign. A security tool should fix onboarding bugs in the open and keep old versions available. Ask any vendor how it ships fixes and whether you can stay on a version you have reviewed.

Put it to work

Read the 0.7.9 notes in the changelog, then run the status command in one project. Write down whether it matches what you expected.

Explore the project

Ashlr tools connected to this story. Review their source and setup requirements.

Phantom Secrets

Delegate supported API work through scoped placeholders and a local proxy, keeping real keys out of agent context.

Visit website View source

Go to the source

Source material behind this briefing. Our practical implications are Ashlr’s interpretation.

Phantom Secrets v0.7.9 release notes (opens in a new tab)
Ashlr.AISep 7, 2026

This briefing was prepared with AI assistance from the linked sources. The analysis may include interpretation; consult the original sources for complete context. Cover artwork is illustrative.

Editorial approach Suggest a correction

5 min read

Agents can read your .env file like any other file. Phantom Secrets swaps real keys for placeholders and adds the real one only when a request leaves.

Ashlr cover: a map pin inside a circle, with the headline Wrong account, impossible.

Field noteSecurity

Locus: how to stop an agent from using the wrong account

Oct 17, 20264 min read

Agents inherit whatever accounts happen to be logged in on your computer. Locus pins an agent to one identity, so acting as the wrong client becomes impossible.

Ashlr cover: a green shield and placeholder key, with the headline Sign-in that recovers when it fails.

The briefingSecurity

Phantom Secrets fixes sign-in and device approval recovery

Oct 10, 20263 min read

On October 10, Phantom Secrets merged two fixes so a failed GitHub sign-in no longer leaves the dashboard or device approval stuck on an old account.