Moon Blur in Moon CLI

In Moon CLI, Moon Blur runs on your machine. Before each request to the model, it replaces secrets and, depending on the mode, personal data with placeholders. The real values are put back in the answers: the model never sees them, and your files keep them.

How it works#Link to the How it works section

1. Moon CLI scans everything that goes to the model: your messages, the files the agent reads, and the results of commands and tools.
2. Each detected value is replaced with a placeholder of the form MOONBLUR_<TYPE>_<16 characters>. The same value keeps the same placeholder for the whole session.
3. In the model’s answers and tool calls, Moon CLI puts the real values back before the agent uses them: a file the agent edits contains your real values.
4. The model knows these placeholders stand for real values on your machine, hidden only from it: it copies them as is into its files, and into its commands when they cannot change their meaning (see below), without asking for them again (since Moon CLI 0.5.2, through an instruction and a reminder when the conversation contains some).
5. The mapping table stays in memory, on your machine, for the length of the session. It is erased at the end, and Moon CLI tells you how many values were masked.

STRIPE_KEY=MOONBLUR_STRIPEKEY_8C1F0A9E3B7D2C45
DATABASE_URL=MOONBLUR_CONNSTRING_41D7E0B92A6C5F18

Masked values in commands#Link to the Masked values in commands section

Since Moon CLI 0.5.3, a real value is only put back into a command if it cannot change the command’s meaning: unaccented letters and digits, and the characters _ - . : / + = @, with no - or @ at the start.

• A value with quotes, spaces, other symbols, accented letters or several lines is not placed in the command: the command does not run.
• The model is then asked to write the value to a temporary file outside the repository, pass it through that file (for example curl -H @file), then delete it.
• This rule applies to every command the agent runs, whatever name the model gives the tool. Files written or edited always get the real values.

Modes#Link to the Modes section

secrets is the default because, in code, personal data triggers many false positives (test addresses, sample numbers), while a secret must never go out.

In strict mode, new content that contains a secret is not sent. The agent shows: “Moon Blur (mode strict) : votre dernier message ou résultat d’outil contient un secret, rien n’a été envoyé. Retirez-le, ou passez en mode secrets (/blur) pour l’envoyer masqué.” (your last message or tool result contains a secret, nothing was sent; remove it, or switch to secrets mode with /blur to send it masked). History that was already sent does not block what follows. Since Moon CLI 0.5.4, strict mode also blocks when you choose it in the middle of a session, not only at launch.

Choosing the mode#Link to the Choosing the mode section

See the active mode and where it comes from:

moon blur

Change the default mode, or the mode of the current folder only:

moon blur redact          # for all your projects
moon blur strict --here   # for this folder only
moon blur reset --here    # removes this folder's setting
moon blur reset           # removes the default setting

For a single terminal, the MOON_BLUR_MODE variable takes precedence over your settings:

export MOON_BLUR_MODE=strict
moon

$env:MOON_BLUR_MODE = "strict"
moon

The mode that applies is decided in this order:

1. the MOON_BLUR_MODE variable;
2. with moon rc only, the level chosen for this folder from the Code page on the web (see From Code);
3. the folder setting (moon blur <mode> --here, or the Moon Blur pill in Moon Desktop);
4. the default setting (moon blur <mode>);
5. the Moon CLI default, secrets.

These settings live in your personal settings (moon.json), never in the repository: a cloned repository can neither lower Moon Blur nor add allowed values.

During a session#Link to the During a session section

In the agent, /blur changes the mode for the current session; the active mode is shown in the status bar. moon blur does not change a session that is already open: it applies at the next launch.

From Code#Link to the From Code section

Since Moon CLI 0.5.4, the folder level can also be set from Code, with the Moon Blur pill in the input area, down to off (“Off”). Raising it takes effect at once; lowering it asks for a confirmation that says what will go to the model as is. The level applies right away to the current session.

• In Moon Desktop (2.1.2 or later), it is the same setting as moon blur <mode> --here: it then applies to that folder in the app and in the terminal alike. Lowering it is confirmed in a Moon Desktop window. See Folder Moon Blur in Moon Desktop.
• On the Code page on the web (moon rc), it is a separate level, read only by moon rc: the page can never lower the level of the terminal or of Moon Desktop. See Folder Moon Blur on the page.

In the terminal, moon blur shows the level chosen from the web separately, moon blur <mode> --here reminds you of it when there is one (“Code sur le web (moon rc) garde son propre niveau ici : off. Pour le retirer : moon blur reset --here”, Code on the web (moon rc) keeps its own level here: off; to remove it, run moon blur reset --here), and moon blur reset --here removes it together with the folder setting.

MOON_BLUR_MODE and the workspace rule take precedence over these settings, as over the others.

When the workspace requires Moon Blur#Link to the When the workspace requires Moon Blur section

The owner or an admin of an organization can require Moon Blur in Moon CLI: in the admin console, on the “API and keys” page, with the “Moon Blur required in Moon CLI” setting. For Moon CLI sessions in that workspace:

• the off and detect modes are replaced with secrets at launch (detect since Moon CLI 0.5.4);
• /blur refuses to switch to off or detect, and Code does not let you go below “Secrets”;
• Moon AI also scans the requests on its side, whatever your mode.

Without this rule, Moon AI does not apply its own masking again to Moon CLI requests: the mode you chose applies, off included.

What Moon Blur detects#Link to the What Moon Blur detects section

Secrets (every mode except off and detect)#Link to the Secrets (every mode except off and detect) section

• Private keys in PEM format (RSA, EC, OpenSSH, PGP, DSA).
• API keys and tokens: AWS, GitHub, GitLab, OpenAI, Anthropic, Stripe (keys and webhook secrets), Google, Slack, npm, Hugging Face, Azure Storage and other common services.
• JWT tokens.
• Connection strings for a database or a message queue, with a password.
• Credentials in a URL: https://user:password@….
• Values assigned to a sensitive key in quotes: api_key = "…", token: "…", password = "…".
• .env and YAML lines whose value looks like a random secret: DATABASE_PASSWORD=…, client_secret: ….
• Passwords written out in plain text after password: or passphrase=.

Personal data#Link to the Personal data section

What is not treated as a secret#Link to the What is not treated as a secret section

• Sample values: test cards and IBANs, keys from documentation, demo tokens.
• Technical addresses: git@…, noreply@…, example.com, localhost.
• Code references: process.env.X, ${JWT_SECRET}, opts.token, an identifier such as hashPassword.

Letting a value through#Link to the Letting a value through section

First check what would be masked in a file, without sending anything:

moon blur audit config/dev.env

◗ 2 éléments masqués dans config/dev.env (mode secrets) :
  ligne   12  STRIPEKEY     sk_…9f
  ligne   18  CONNSTRING    pos…db

Faux positif ? Ajoutez « moonblur:allow » en fin de ligne, ou : moon blur allow <valeur>

The audit (in French in the terminal) shows the first 50 items, line by line, using the current folder’s mode (redact mode if Moon Blur is set to off).

Three ways to let a false positive through:

What Moon Blur does not cover#Link to the What Moon Blur does not cover section

• Tools receive the real values. For commands and tools to work, Moon CLI gives them the real values. An MCP server or a network command therefore receives whatever the agent sends it. Moon Guard, when on, blocks sending a real secret over the network or to an MCP tool: see Moon Guard.
• A value written into a script and then run is not checked like a command, and neither is a command started by an MCP server itself.
• Detection is not exhaustive. It relies on known formats: a secret in an unknown format can get through.
• off turns everything off. Keep it for projects with no sensitive data.

In the web chat, Moon Blur is applied by Moon AI and offers other settings, such as your own terms to mask: see the Moon Blur section.

See also#Link to the See also section

• Moon Guard
• Configuration
• Command reference