Subprocess
A subprocess is a new, separate process that one program starts and controls, in this case a command that Claude Code or an MCP server runs on your behalf. A subprocess gets its own environment variables, which is what makes it possible to hand a command a secret without exposing that secret anywhere else.
Why it matters
When a value is injected only into a subprocess's environment, the parent process, in this case Claude, never sees the value itself, only whatever the subprocess prints back to it.
Can a subprocess see its parent's other secrets?
Only if they are explicitly passed to it. A well-built tool passes exactly one secret at a time.
Is this the same as a sandbox?
Related but different. A subprocess is about environment isolation; a sandbox additionally restricts what the process can access on disk or the network.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.