agent-sanitizer (Python client)

A thin Python bridge to the agent-sanitizer Node.js CLI. The sanitization logic has a single source of truth — the JavaScript in src/ — so this package shells out to the CLI rather than re-implementing it, giving a Python pipeline byte-identical verdicts with no second implementation to keep in sync.

Requirements

  • Node.js (>= 22) on PATH. The sanitizer is JavaScript; something has to run it. There is deliberately no pure-Python fallback.

That's it — pip install agent-sanitizer and, with Node available, you're ready to go. The wheel ships a self-contained, single-file build of the CLI (the src/ logic and its npm dependencies bundled into one .mjs at release time), so there is no separate JavaScript checkout to clone and no environment variable to set. The bundle is a versioned build artifact from src/, not a hand-maintained port, so it can't drift from the JS.

Optional: point at your own JS checkout

Set AGENT_SANITIZER_CLI to a checkout's bin/sanitize-cli.mjs to override the bundled CLI (e.g. to run against unreleased src/ changes). When the module is imported directly from a repo checkout, the source CLI is found automatically.

Usage

from agent_sanitizer import sanitize

result = sanitize("untrusted text", html=True)
print(result.cleaned, result.found, result.warnings)

See the package docstring for the full set of entry points (sanitize_text, classify_prompt, scan_instruction_files, clean_file, and the long-lived Sanitizer worker).

Secret redaction ([secrets] extra)

The base install is dependency-free. The optional secrets extra adds a pure-Python secret-redaction engine under agent_sanitizer.secrets — detect-secrets plus custom detectors, benign-value skipping, cross-line reassembly, PEM collapse, and exact-match redaction of caller-supplied env-var values. Unlike the sanitizer above it needs no Node.js; its only dependency is detect-secrets, pulled in by the extra:

pip install "agent-sanitizer[secrets]"

Every detect-secrets import lives inside this subpackage, so a plain import agent_sanitizer never touches it. The engine shares the parent package's invisible-character SSOT (agent_sanitizer.invisible) rather than forking it — a fork would be a silent security regression.

In-process

from agent_sanitizer.secrets import RedactorConfig, redact, redact_map

redacted, found = redact("aws_key = AKIAIOSFODNN7EXAMPLE")
# -> ("aws_key = [REDACTED: AWS Access Key]", ["AWS Access Key"])

# Pass provider/host secret values in — config is supplied, never discovered.
cfg = RedactorConfig(host_cred_vars={"GH_TOKEN": "ghp_realtokenvalue123"})
redact("tok=ghp_realtokenvalue123", cfg)  # -> ("tok=[REDACTED: GH_TOKEN]", ["GH_TOKEN"])

The rehydration map contract

redact_map(text, config) returns a lossless, two-way view:

{"text": "<redacted>",
 "pairs": [{"placeholder": "[REDACTED: …]", "original": "<secret>", "start": <int>}],
 "found": ["<type>", ...]}

Substituting each pair["original"] at its start reconstructs the input byte-for-byte. start is a Unicode code-point offset into text (the field is start, not start_offset). U+E000 / U+E001 are reserved placeholder sentinels: input already containing either is refused with {"unmappable": "input contains reserved sentinel characters"} (fail closed) rather than producing an ambiguous map.

Daemon vs. one-shot

detect-secrets caches a process-global secret_type → plugin mapping, so a fresh one-shot call must re-register the plugin set every time — slow under load. Two console scripts (installed with the extra) cover both modes:

  • agent-secret-redactor — one-shot: reads text on stdin, writes the redaction result as JSON on stdout. Re-registers plugins per call.
  • agent-secret-redactor-daemon <socket-path> — long-lived Unix-socket server that configures the plugin set once at startup (a warm-up scan primes the cache before it binds, so a bound socket means ready). Wire protocol both directions: a 4-byte big-endian length prefix then that many bytes of UTF-8 JSON. Request {"text", "map", "web_ingress", "env_secrets"}; response is the one-shot result, JSON null when nothing is redacted, or {"error": …} on a scan failure.

Both console scripts import the engine on startup, so they fail loud if the [secrets] extra (hence detect-secrets) is not installed — fail closed, never a silent no-op.

Versioning

This package is versioned in lockstep with the npm agent-sanitizer: each release publishes both at the same version from the same commit, and the wheel bundles src/ at exactly that version. So pip install agent-sanitizer==X.Y.Z and npm i agent-sanitizer@X.Y.Z are the same underlying logic.

Project links

Data verified by PyPI on Aug 8, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.57.5)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for TurnTrout from gravatar.com TurnTrout

GitHub Statistics

Data verified by PyPI on Aug 8, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

secrets

Tags

ansi prompt-injection sanitizer security unicode

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

agent_sanitizer-2.19.1.tar.gz (298.7 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

agent_sanitizer-2.19.1-py3-none-any.whl (307.6 kB view details)

Uploaded Python 3

File details

Details for the file agent_sanitizer-2.19.1.tar.gz.

File metadata

  • Download URL: agent_sanitizer-2.19.1.tar.gz
  • Upload date:
  • Size: 298.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for agent_sanitizer-2.19.1.tar.gz
Algorithm Hash digest
SHA256 c4a8d1c2a1e0a41ed9cb99413d1284b9b0cd095022aaaa9406d34e87e998c8f6
MD5 0d34eba165da59ebe1cdb7bf0e90b292
BLAKE2b-256 66536e3eac9118dfd1a4ba6ae63bf044df9716f86a03c3f4af3debf6ac431078

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.19.1.tar.gz:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file agent_sanitizer-2.19.1-py3-none-any.whl.

File metadata

File hashes

Hashes for agent_sanitizer-2.19.1-py3-none-any.whl
Algorithm Hash digest
SHA256 d5346fc67c6f303a7215607597d7db37935f69ab31c56f338252e53e9e4963ae
MD5 60efb7c0504d59da535986bfd8c1f900
BLAKE2b-256 fa74430be66227c2125f4a457f287b3f6eaa4c08886e5b58e634a848e788883e

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.19.1-py3-none-any.whl:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

2.57.5

2 files

2.57.4

2 files

2.57.3

2 files

2.57.2

2 files

2.57.1

2 files

2.57.0

2 files

2.56.1

2 files

2.56.0

2 files

2.55.0

2 files

2.54.2

2 files

2.54.1

2 files

2.54.0

2 files

2.53.0

2 files

2.52.0

2 files

2.51.0

2 files

2.50.0

2 files

2.49.2

2 files

2.49.1

2 files

2.49.0

2 files

2.48.6

2 files

2.48.5

2 files

2.48.4

2 files

2.48.3

2 files

2.48.2

2 files

2.48.1

2 files

2.48.0

2 files

2.47.15

2 files

2.47.14

2 files

2.47.13

2 files

2.47.12

2 files

2.47.11

2 files

2.47.10

2 files

2.47.9

2 files

2.47.8

2 files

2.47.7

2 files

2.47.6

2 files

2.47.5

2 files

2.47.4

2 files

2.47.3

2 files

2.47.2

2 files

2.47.1

2 files

2.47.0

2 files

2.46.0

2 files

2.45.9

2 files

2.45.8

2 files

2.45.7

2 files

2.45.6

2 files

2.45.5

2 files

2.45.4

2 files

2.45.3

2 files

2.45.2

2 files

2.45.1

2 files

2.45.0

2 files

2.44.1

2 files

2.44.0

2 files

2.43.12

2 files

2.43.11

2 files

2.43.10

2 files

2.43.9

2 files

2.43.8

2 files

2.43.7

2 files

2.43.6

2 files

2.43.3

2 files

2.43.2

2 files

2.43.1

2 files

2.43.0

2 files

2.41.4

2 files

2.41.3

2 files

2.41.2

2 files

2.41.1

2 files

2.41.0

2 files

2.40.5

2 files

2.40.4

2 files

2.40.3

2 files

2.40.2

2 files

2.40.1

2 files

2.40.0

2 files

2.34.12

2 files

2.34.11

2 files

2.34.10

2 files

2.34.8

2 files

2.34.7

2 files

2.34.6

2 files

2.34.5

2 files

2.34.4

2 files

2.34.3

2 files

2.34.2

2 files

2.34.1

2 files

2.34.0

2 files

2.33.1

2 files

2.33.0

2 files

2.32.3

2 files

2.32.2

2 files

2.32.1

2 files

2.32.0

2 files

2.31.6

2 files

2.31.5

2 files

2.31.4

2 files

2.31.3

2 files

2.31.2

2 files

2.31.1

2 files

2.31.0

2 files

2.30.0

2 files

2.29.1

2 files

2.29.0

2 files

2.28.3

2 files

2.28.2

2 files

2.28.1

2 files

2.28.0

2 files

2.27.0

2 files

2.26.3

2 files

2.26.2

2 files

2.26.0

2 files

2.25.0

2 files

2.24.2

2 files

2.24.1

2 files

2.24.0

2 files

2.23.2

2 files

2.23.1

2 files

2.23.0

2 files

2.21.1

2 files

2.21.0

2 files

2.20.2

2 files

2.20.1

2 files

2.20.0

2 files

2.19.8

2 files

2.19.6

2 files

2.19.4

2 files

2.19.2

2 files

This release

2.19.1 This release

2 files

2.19.0

2 files

2.18.1

2 files

2.18.0

2 files

2.17.1

2 files

2.17.0

2 files

2.16.0

2 files

2.15.0

2 files

2.14.14

2 files

2.14.13

2 files

2.14.11

2 files

2.14.10

2 files

2.14.9

2 files

2.14.8

2 files

2.14.6

2 files

2.14.4

2 files

2.14.3

2 files

2.14.2

2 files

2.14.1

2 files

2.14.0

2 files

2.13.0

2 files

2.12.0

2 files

2.11.0

2 files

2.10.1

2 files

2.10.0

2 files

2.9.1

2 files

2.9.0

2 files

2.8.0

2 files

2.7.2

2 files

2.7.1

2 files

2.7.0

2 files

2.6.0

2 files

2.5.0

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.2

2 files

2.2.1

2 files

2.2.0

2 files

2.1.0

2 files

2.0.3

2 files

2.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page