Stop leaking secrets to AI.

Catches secrets in prompts, tool inputs, generated code, and existing files. Redacts or blocks before the API sees them. Fully local.

Setup

Sets up proxy, file scanning hook, and MCP server. Restart your terminal for env vars.

No proxy. Scans prompts, tool inputs, and written files.

For any AI tool. Set HTTPS_PROXY=http://127.0.0.1:8080

Secrets going into AI (prompts, tool inputs) and coming out of AI (generated code, written files).

Rule	Description	Pattern

Scan an existing codebase. --fix replaces secrets with env var references and saves to .env.

Proxy

Network-level. Redacts secrets in API requests. Can't be bypassed.

Hooks

Claude Code. Scans files after Write/Edit. Alerts the agent to fix.

MCP Server

Any agent. Three tools: scan code, store secrets, scan files.

All three share the same detection engine. setup-all installs all of them.

Redact

Replaces secrets with env var placeholders. Saves credentials to .env.

Block

Rejects the request. Developer fixes and retries.

Warn

Forwards but logs a warning.

Audit

Silent JSON logging for compliance.

Codebase

<2K lines of Python.

Speed

0.005ms per prompt. 67ms for 1MB.

Detection

Regex + Shannon entropy. No ML.

Telemetry

None. Fully local.

macOS and Linux · Python 3.11+