agent-sanitizer (Python client)

A thin Python bridge to the agent-sanitizer Node.js CLI. The sanitization logic has a single source of truth — the JavaScript in src/ — so this package shells out to the CLI rather than re-implementing it, giving a Python pipeline byte-identical verdicts with no second implementation to keep in sync.

Requirements

  • Node.js (>= 22) on PATH. The sanitizer is JavaScript; something has to run it. There is deliberately no pure-Python fallback.

That's it — pip install agent-sanitizer and, with Node available, you're ready to go. The wheel ships a self-contained, single-file build of the CLI (the src/ logic and its npm dependencies bundled into one .mjs at release time), so there is no separate JavaScript checkout to clone and no environment variable to set. The bundle is a versioned build artifact from src/, not a hand-maintained port, so it can't drift from the JS.

Optional: point at your own JS checkout

Set AGENT_SANITIZER_CLI to a checkout's bin/sanitize-cli.mjs to override the bundled CLI (e.g. to run against unreleased src/ changes). When the module is imported directly from a repo checkout, the source CLI is found automatically.

Usage

from agent_sanitizer import sanitize

result = sanitize("untrusted text", html=True)
print(result.cleaned, result.found, result.warnings)

See the package docstring for the full set of entry points (sanitize_text, classify_prompt, scan_instruction_files, clean_file, and the long-lived Sanitizer worker).

Secret redaction ([secrets] extra)

The base install is dependency-free. The optional secrets extra adds a pure-Python secret-redaction engine under agent_sanitizer.secrets — detect-secrets plus custom detectors, benign-value skipping, cross-line reassembly, PEM collapse, and exact-match redaction of caller-supplied env-var values. Unlike the sanitizer above it needs no Node.js; its only dependency is detect-secrets, pulled in by the extra:

pip install "agent-sanitizer[secrets]"

Every detect-secrets import lives inside this subpackage, so a plain import agent_sanitizer never touches it. The engine shares the parent package's invisible-character SSOT (agent_sanitizer.invisible) rather than forking it — a fork would be a silent security regression.

In-process

from agent_sanitizer.secrets import RedactorConfig, redact, redact_map

redacted, found = redact("aws_key = AKIAIOSFODNN7EXAMPLE")
# -> ("aws_key = [REDACTED: AWS Access Key]", ["AWS Access Key"])

# Pass provider/host secret values in — config is supplied, never discovered.
cfg = RedactorConfig(host_cred_vars={"GH_TOKEN": "ghp_realtokenvalue123"})
redact("tok=ghp_realtokenvalue123", cfg)  # -> ("tok=[REDACTED: GH_TOKEN]", ["GH_TOKEN"])

The rehydration map contract

redact_map(text, config) returns a lossless, two-way view:

{"text": "<redacted>",
 "pairs": [{"placeholder": "[REDACTED: …]", "original": "<secret>", "start": <int>}],
 "found": ["<type>", ...]}

Substituting each pair["original"] at its start reconstructs the input byte-for-byte. start is a Unicode code-point offset into text (the field is start, not start_offset). U+E000 / U+E001 are reserved placeholder sentinels: input already containing either is refused with {"unmappable": "input contains reserved sentinel characters"} (fail closed) rather than producing an ambiguous map.

Daemon vs. one-shot

detect-secrets caches a process-global secret_type → plugin mapping, so a fresh one-shot call must re-register the plugin set every time — slow under load. Two console scripts (installed with the extra) cover both modes:

  • agent-secret-redactor — one-shot: reads text on stdin, writes the redaction result as JSON on stdout. Re-registers plugins per call.
  • agent-secret-redactor-daemon <socket-path> — long-lived Unix-socket server that configures the plugin set once at startup (a warm-up scan primes the cache before it binds, so a bound socket means ready). Wire protocol both directions: a 4-byte big-endian length prefix then that many bytes of UTF-8 JSON. Request {"text", "map", "web_ingress", "env_secrets"}; response is the one-shot result, JSON null when nothing is redacted, or {"error": …} on a scan failure.

Both console scripts import the engine on startup, so they fail loud if the [secrets] extra (hence detect-secrets) is not installed — fail closed, never a silent no-op.

Versioning

This package is versioned in lockstep with the npm agent-sanitizer: each release publishes both at the same version from the same commit, and the wheel bundles src/ at exactly that version. So pip install agent-sanitizer==X.Y.Z and npm i agent-sanitizer@X.Y.Z are the same underlying logic.

Project links

Data verified by PyPI on Aug 9, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.57.5)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for TurnTrout from gravatar.com TurnTrout

GitHub Statistics

Data verified by PyPI on Aug 9, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

secrets

Tags

ansi prompt-injection sanitizer security unicode

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

agent_sanitizer-2.28.2.tar.gz (356.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

agent_sanitizer-2.28.2-py3-none-any.whl (365.8 kB view details)

Uploaded Python 3

File details

Details for the file agent_sanitizer-2.28.2.tar.gz.

File metadata

  • Download URL: agent_sanitizer-2.28.2.tar.gz
  • Upload date:
  • Size: 356.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for agent_sanitizer-2.28.2.tar.gz
Algorithm Hash digest
SHA256 708eefc10c5938ee8d9ef559bce039860fc1f5ad4dc715d3a3c8a01af1f3f0d7
MD5 6ffb1df8965f5309dee6f00198ca5f62
BLAKE2b-256 d9d1c40ddfa88b58746242cf59cdb54dfbba058a7f90bcead527097b171e2687

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.28.2.tar.gz:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file agent_sanitizer-2.28.2-py3-none-any.whl.

File metadata

File hashes

Hashes for agent_sanitizer-2.28.2-py3-none-any.whl
Algorithm Hash digest
SHA256 5f4ae13c6a512ee4ab3608088ecd09d3862de525c6281ef49dd5642432fa847b
MD5 f31391848c51324cec404c824720e7ec
BLAKE2b-256 59557a9416a2dcf15fa5e140e23a63bdf6332db151eb059aecdc7905330d8c7d

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.28.2-py3-none-any.whl:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

2.57.5

2 files

2.57.4

2 files

2.57.3

2 files

2.57.2

2 files

2.57.1

2 files

2.57.0

2 files

2.56.1

2 files

2.56.0

2 files

2.55.0

2 files

2.54.2

2 files

2.54.1

2 files

2.54.0

2 files

2.53.0

2 files

2.52.0

2 files

2.51.0

2 files

2.50.0

2 files

2.49.2

2 files

2.49.1

2 files

2.49.0

2 files

2.48.6

2 files

2.48.5

2 files

2.48.4

2 files

2.48.3

2 files

2.48.2

2 files

2.48.1

2 files

2.48.0

2 files

2.47.15

2 files

2.47.14

2 files

2.47.13

2 files

2.47.12

2 files

2.47.11

2 files

2.47.10

2 files

2.47.9

2 files

2.47.8

2 files

2.47.7

2 files

2.47.6

2 files

2.47.5

2 files

2.47.4

2 files

2.47.3

2 files

2.47.2

2 files

2.47.1

2 files

2.47.0

2 files

2.46.0

2 files

2.45.9

2 files

2.45.8

2 files

2.45.7

2 files

2.45.6

2 files

2.45.5

2 files

2.45.4

2 files

2.45.3

2 files

2.45.2

2 files

2.45.1

2 files

2.45.0

2 files

2.44.1

2 files

2.44.0

2 files

2.43.12

2 files

2.43.11

2 files

2.43.10

2 files

2.43.9

2 files

2.43.8

2 files

2.43.7

2 files

2.43.6

2 files

2.43.3

2 files

2.43.2

2 files

2.43.1

2 files

2.43.0

2 files

2.41.4

2 files

2.41.3

2 files

2.41.2

2 files

2.41.1

2 files

2.41.0

2 files

2.40.5

2 files

2.40.4

2 files

2.40.3

2 files

2.40.2

2 files

2.40.1

2 files

2.40.0

2 files

2.34.12

2 files

2.34.11

2 files

2.34.10

2 files

2.34.8

2 files

2.34.7

2 files

2.34.6

2 files

2.34.5

2 files

2.34.4

2 files

2.34.3

2 files

2.34.2

2 files

2.34.1

2 files

2.34.0

2 files

2.33.1

2 files

2.33.0

2 files

2.32.3

2 files

2.32.2

2 files

2.32.1

2 files

2.32.0

2 files

2.31.6

2 files

2.31.5

2 files

2.31.4

2 files

2.31.3

2 files

2.31.2

2 files

2.31.1

2 files

2.31.0

2 files

2.30.0

2 files

2.29.1

2 files

2.29.0

2 files

2.28.3

2 files

This release

2.28.2 This release

2 files

2.28.1

2 files

2.28.0

2 files

2.27.0

2 files

2.26.3

2 files

2.26.2

2 files

2.26.0

2 files

2.25.0

2 files

2.24.2

2 files

2.24.1

2 files

2.24.0

2 files

2.23.2

2 files

2.23.1

2 files

2.23.0

2 files

2.21.1

2 files

2.21.0

2 files

2.20.2

2 files

2.20.1

2 files

2.20.0

2 files

2.19.8

2 files

2.19.6

2 files

2.19.4

2 files

2.19.2

2 files

2.19.1

2 files

2.19.0

2 files

2.18.1

2 files

2.18.0

2 files

2.17.1

2 files

2.17.0

2 files

2.16.0

2 files

2.15.0

2 files

2.14.14

2 files

2.14.13

2 files

2.14.11

2 files

2.14.10

2 files

2.14.9

2 files

2.14.8

2 files

2.14.6

2 files

2.14.4

2 files

2.14.3

2 files

2.14.2

2 files

2.14.1

2 files

2.14.0

2 files

2.13.0

2 files

2.12.0

2 files

2.11.0

2 files

2.10.1

2 files

2.10.0

2 files

2.9.1

2 files

2.9.0

2 files

2.8.0

2 files

2.7.2

2 files

2.7.1

2 files

2.7.0

2 files

2.6.0

2 files

2.5.0

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.2

2 files

2.2.1

2 files

2.2.0

2 files

2.1.0

2 files

2.0.3

2 files

2.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page