# Subprocess

Canonical page: /glossary/subprocess

API keys & secrets glossary, Claude Code & MCP. Subprocess: Why It Matters for Claude and Your Secrets

**Short answer:** A subprocess is a new, separate process that one program starts and controls, in this case a command that Claude Code or an MCP server runs on your behalf. A subprocess gets its own environment variables, which is what makes it possible to hand a command a secret without exposing that secret anywhere else.

## Why it matters

When a value is injected only into a subprocess's environment, the parent process, in this case Claude, never sees the value itself, only whatever the subprocess prints back to it.

## In Claude Keychain

Claude Keychain's run_with_secrets tool works by starting a subprocess with the chosen secret set as an environment variable, then returning only that subprocess's stdout and stderr, never the variable itself, to Claude.

## Common questions

**Can a subprocess see its parent's other secrets?**

Only if they are explicitly passed to it. A well-built tool passes exactly one secret at a time.

**Is this the same as a sandbox?**

Related but different. A subprocess is about environment isolation; a sandbox additionally restricts what the process can access on disk or the network.

## Related

[MCP tool](/glossary/mcp-tool), [Environment variable](/glossary/environment-variable), [App Sandbox](/glossary/app-sandbox)