What agents see

When an AI agent runs accio, any secret value that appears in the command's output is replaced with <concealed by fidelius: NAME>. If a test prints your API key, the agent sees the key's name, not the key. At the end of the run, accio says that it concealed something, so this never happens silently.

accio recognizes Claude Code and Codex. For any other agent, or to try it yourself, set FIDELIUS_MASK=1. When you run accio in your own terminal, output shows as it is. A terminal or editor that an agent started (for example code . run by Claude Code) counts as the agent, so accio conceals there too.

Choose which values are concealed

Each secret has a Hide in agent output switch. Turn it off for plain settings like NODE_ENV or a region name, so logs stay readable.

Values under 6 characters stay visible unless you turn the switch on yourself, because short values like true or 3000 appear in output all the time. accio list my-app shows which keys aren't concealed and why.

When you need the real output

• Add --no-mask: accio my-app --no-mask -- cmd.
• When an agent writes a secret into a file (accio my-app cmd > key.pem), it must add --no-mask, or the file gets the concealed text instead of the value.
• For an MCP server, put --no-mask in its config: accio my-app --no-mask -- server ….

What masking can't catch

• A value that was changed before it was printed: reversed, split, re-encoded, compressed or encrypted.
• Binary output.
• Output going straight to a terminal window, unless FIDELIUS_MASK=1 is set.

Masking is a second line of protection. The first is the agent instructions, which tell agents never to print or read secret values. See Connecting AI agents.