agent-sanitizer (Python client)

A thin Python bridge to the agent-sanitizer Node.js CLI. The sanitization logic has a single source of truth — the JavaScript in src/ — so this package shells out to the CLI rather than re-implementing it, giving a Python pipeline byte-identical verdicts with no second implementation to keep in sync.

Requirements

  • Node.js (>= 22) on PATH. The sanitizer is JavaScript; something has to run it. There is deliberately no pure-Python fallback.

That's it — pip install agent-sanitizer and, with Node available, you're ready to go. The wheel ships a self-contained, single-file build of the CLI (the src/ logic and its npm dependencies bundled into one .mjs at release time), so there is no separate JavaScript checkout to clone and no environment variable to set. The bundle is a versioned build artifact from src/, not a hand-maintained port, so it can't drift from the JS.

Optional: point at your own JS checkout

Set AGENT_SANITIZER_CLI to a checkout's bin/sanitize-cli.mjs to override the bundled CLI (e.g. to run against unreleased src/ changes). When the module is imported directly from a repo checkout, the source CLI is found automatically.

Usage

from agent_sanitizer import sanitize

result = sanitize("untrusted text", html=True)
print(result.cleaned, result.found, result.warnings)

See the package docstring for the full set of entry points (sanitize_text, classify_prompt, scan_instruction_files, clean_file, and the long-lived Sanitizer worker).

Secret redaction ([secrets] extra)

The base install is dependency-free. The optional secrets extra adds a pure-Python secret-redaction engine under agent_sanitizer.secrets — detect-secrets plus custom detectors, benign-value skipping, cross-line reassembly, PEM collapse, and exact-match redaction of caller-supplied env-var values. Unlike the sanitizer above it needs no Node.js; its only dependency is detect-secrets, pulled in by the extra:

pip install "agent-sanitizer[secrets]"

Every detect-secrets import lives inside this subpackage, so a plain import agent_sanitizer never touches it. The engine shares the parent package's invisible-character SSOT (agent_sanitizer.invisible) rather than forking it — a fork would be a silent security regression.

In-process

from agent_sanitizer.secrets import RedactorConfig, redact, redact_map

redacted, found = redact("aws_key = AKIAIOSFODNN7EXAMPLE")
# -> ("aws_key = [REDACTED: AWS Access Key]", ["AWS Access Key"])

# Pass provider/host secret values in — config is supplied, never discovered.
cfg = RedactorConfig(host_cred_vars={"GH_TOKEN": "ghp_realtokenvalue123"})
redact("tok=ghp_realtokenvalue123", cfg)  # -> ("tok=[REDACTED: GH_TOKEN]", ["GH_TOKEN"])

The rehydration map contract

redact_map(text, config) returns a lossless, two-way view:

{"text": "<redacted>",
 "pairs": [{"placeholder": "[REDACTED: …]", "original": "<secret>", "start": <int>}],
 "found": ["<type>", ...]}

Substituting each pair["original"] at its start reconstructs the input byte-for-byte. start is a Unicode code-point offset into text (the field is start, not start_offset). U+E000 / U+E001 are reserved placeholder sentinels: input already containing either is refused with {"unmappable": "input contains reserved sentinel characters"} (fail closed) rather than producing an ambiguous map.

Daemon vs. one-shot

detect-secrets caches a process-global secret_type → plugin mapping, so a fresh one-shot call must re-register the plugin set every time — slow under load. Two console scripts (installed with the extra) cover both modes:

  • agent-secret-redactor — one-shot: reads text on stdin, writes the redaction result as JSON on stdout. Re-registers plugins per call.
  • agent-secret-redactor-daemon <socket-path> — long-lived Unix-socket server that configures the plugin set once at startup (a warm-up scan primes the cache before it binds, so a bound socket means ready). Wire protocol both directions: a 4-byte big-endian length prefix then that many bytes of UTF-8 JSON. Request {"text", "map", "web_ingress", "env_secrets"}; response is the one-shot result, JSON null when nothing is redacted, or {"error": …} on a scan failure.

Both console scripts import the engine on startup, so they fail loud if the [secrets] extra (hence detect-secrets) is not installed — fail closed, never a silent no-op.

Versioning

This package is versioned in lockstep with the npm agent-sanitizer: each release publishes both at the same version from the same commit, and the wheel bundles src/ at exactly that version. So pip install agent-sanitizer==X.Y.Z and npm i agent-sanitizer@X.Y.Z are the same underlying logic.

Project links

Data verified by PyPI on Aug 8, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.57.5)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for TurnTrout from gravatar.com TurnTrout

GitHub Statistics

Data verified by PyPI on Aug 8, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

secrets

Tags

ansi prompt-injection sanitizer security unicode

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

agent_sanitizer-2.18.1.tar.gz (298.7 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

agent_sanitizer-2.18.1-py3-none-any.whl (307.6 kB view details)

Uploaded Python 3

File details

Details for the file agent_sanitizer-2.18.1.tar.gz.

File metadata

  • Download URL: agent_sanitizer-2.18.1.tar.gz
  • Upload date:
  • Size: 298.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for agent_sanitizer-2.18.1.tar.gz
Algorithm Hash digest
SHA256 80b37df207864e2c23eb9976951bbbb4202726eb486fb5b77ea6e3708f991ea2
MD5 5d6f4ee72c8d70f8373d24b35b728bec
BLAKE2b-256 545a6666cd0d1a1b75b6107eca4e2e65f0a9e4c393fa963ef192c60c2d30b19c

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.18.1.tar.gz:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file agent_sanitizer-2.18.1-py3-none-any.whl.

File metadata

File hashes

Hashes for agent_sanitizer-2.18.1-py3-none-any.whl
Algorithm Hash digest
SHA256 2cb06cd543a9e132ae8c67965d81e880e286f48930be5b0e82950b8887a949b1
MD5 acab7f97cfb7e7a3fc47bea20934d1f2
BLAKE2b-256 d888e4794440b940446ca6dd7650a0cea77908133f464882ca769715d4890435

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.18.1-py3-none-any.whl:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

2.57.5

2 files

2.57.4

2 files

2.57.3

2 files

2.57.2

2 files

2.57.1

2 files

2.57.0

2 files

2.56.1

2 files

2.56.0

2 files

2.55.0

2 files

2.54.2

2 files

2.54.1

2 files

2.54.0

2 files

2.53.0

2 files

2.52.0

2 files

2.51.0

2 files

2.50.0

2 files

2.49.2

2 files

2.49.1

2 files

2.49.0

2 files

2.48.6

2 files

2.48.5

2 files

2.48.4

2 files

2.48.3

2 files

2.48.2

2 files

2.48.1

2 files

2.48.0

2 files

2.47.15

2 files

2.47.14

2 files

2.47.13

2 files

2.47.12

2 files

2.47.11

2 files

2.47.10

2 files

2.47.9

2 files

2.47.8

2 files

2.47.7

2 files

2.47.6

2 files

2.47.5

2 files

2.47.4

2 files

2.47.3

2 files

2.47.2

2 files

2.47.1

2 files

2.47.0

2 files

2.46.0

2 files

2.45.9

2 files

2.45.8

2 files

2.45.7

2 files

2.45.6

2 files

2.45.5

2 files

2.45.4

2 files

2.45.3

2 files

2.45.2

2 files

2.45.1

2 files

2.45.0

2 files

2.44.1

2 files

2.44.0

2 files

2.43.12

2 files

2.43.11

2 files

2.43.10

2 files

2.43.9

2 files

2.43.8

2 files

2.43.7

2 files

2.43.6

2 files

2.43.3

2 files

2.43.2

2 files

2.43.1

2 files

2.43.0

2 files

2.41.4

2 files

2.41.3

2 files

2.41.2

2 files

2.41.1

2 files

2.41.0

2 files

2.40.5

2 files

2.40.4

2 files

2.40.3

2 files

2.40.2

2 files

2.40.1

2 files

2.40.0

2 files

2.34.12

2 files

2.34.11

2 files

2.34.10

2 files

2.34.8

2 files

2.34.7

2 files

2.34.6

2 files

2.34.5

2 files

2.34.4

2 files

2.34.3

2 files

2.34.2

2 files

2.34.1

2 files

2.34.0

2 files

2.33.1

2 files

2.33.0

2 files

2.32.3

2 files

2.32.2

2 files

2.32.1

2 files

2.32.0

2 files

2.31.6

2 files

2.31.5

2 files

2.31.4

2 files

2.31.3

2 files

2.31.2

2 files

2.31.1

2 files

2.31.0

2 files

2.30.0

2 files

2.29.1

2 files

2.29.0

2 files

2.28.3

2 files

2.28.2

2 files

2.28.1

2 files

2.28.0

2 files

2.27.0

2 files

2.26.3

2 files

2.26.2

2 files

2.26.0

2 files

2.25.0

2 files

2.24.2

2 files

2.24.1

2 files

2.24.0

2 files

2.23.2

2 files

2.23.1

2 files

2.23.0

2 files

2.21.1

2 files

2.21.0

2 files

2.20.2

2 files

2.20.1

2 files

2.20.0

2 files

2.19.8

2 files

2.19.6

2 files

2.19.4

2 files

2.19.2

2 files

2.19.1

2 files

2.19.0

2 files

This release

2.18.1 This release

2 files

2.18.0

2 files

2.17.1

2 files

2.17.0

2 files

2.16.0

2 files

2.15.0

2 files

2.14.14

2 files

2.14.13

2 files

2.14.11

2 files

2.14.10

2 files

2.14.9

2 files

2.14.8

2 files

2.14.6

2 files

2.14.4

2 files

2.14.3

2 files

2.14.2

2 files

2.14.1

2 files

2.14.0

2 files

2.13.0

2 files

2.12.0

2 files

2.11.0

2 files

2.10.1

2 files

2.10.0

2 files

2.9.1

2 files

2.9.0

2 files

2.8.0

2 files

2.7.2

2 files

2.7.1

2 files

2.7.0

2 files

2.6.0

2 files

2.5.0

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.2

2 files

2.2.1

2 files

2.2.0

2 files

2.1.0

2 files

2.0.3

2 files

2.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page