agent-sanitizer (Python client)

A thin Python bridge to the agent-sanitizer Node.js CLI. The sanitization logic has a single source of truth — the JavaScript in src/ — so this package shells out to the CLI rather than re-implementing it, giving a Python pipeline byte-identical verdicts with no second implementation to keep in sync.

Requirements

  • Node.js (>= 22) on PATH. The sanitizer is JavaScript; something has to run it. There is deliberately no pure-Python fallback.

That's it — pip install agent-sanitizer and, with Node available, you're ready to go. The wheel ships a self-contained, single-file build of the CLI (the src/ logic and its npm dependencies bundled into one .mjs at release time), so there is no separate JavaScript checkout to clone and no environment variable to set. The bundle is a versioned build artifact from src/, not a hand-maintained port, so it can't drift from the JS.

Optional: point at your own JS checkout

Set AGENT_SANITIZER_CLI to a checkout's bin/sanitize-cli.mjs to override the bundled CLI (e.g. to run against unreleased src/ changes). When the module is imported directly from a repo checkout, the source CLI is found automatically.

Usage

from agent_sanitizer import sanitize

result = sanitize("untrusted text", html=True)
print(result.cleaned, result.found, result.warnings)

See the package docstring for the full set of entry points (sanitize_text, classify_prompt, scan_instruction_files, clean_file, and the long-lived Sanitizer worker).

Secret redaction ([secrets] extra)

The base install is dependency-free. The optional secrets extra adds a pure-Python secret-redaction engine under agent_sanitizer.secrets — detect-secrets plus custom detectors, benign-value skipping, cross-line reassembly, PEM collapse, and exact-match redaction of caller-supplied env-var values. Unlike the sanitizer above it needs no Node.js; its only dependency is detect-secrets, pulled in by the extra:

pip install "agent-sanitizer[secrets]"

Every detect-secrets import lives inside this subpackage, so a plain import agent_sanitizer never touches it. The engine shares the parent package's invisible-character SSOT (agent_sanitizer.invisible) rather than forking it — a fork would be a silent security regression.

In-process

from agent_sanitizer.secrets import RedactorConfig, redact, redact_map

redacted, found = redact("aws_key = AKIAIOSFODNN7EXAMPLE")
# -> ("aws_key = [REDACTED: AWS Access Key]", ["AWS Access Key"])

# Pass provider/host secret values in — config is supplied, never discovered.
cfg = RedactorConfig(host_cred_vars={"GH_TOKEN": "ghp_realtokenvalue123"})
redact("tok=ghp_realtokenvalue123", cfg)  # -> ("tok=[REDACTED: GH_TOKEN]", ["GH_TOKEN"])

The rehydration map contract

redact_map(text, config) returns a lossless, two-way view:

{"text": "<redacted>",
 "pairs": [{"placeholder": "[REDACTED: …]", "original": "<secret>", "start": <int>}],
 "found": ["<type>", ...]}

Substituting each pair["original"] at its start reconstructs the input byte-for-byte. start is a Unicode code-point offset into text (the field is start, not start_offset). U+E000 / U+E001 are reserved placeholder sentinels: input already containing either is refused with {"unmappable": "input contains reserved sentinel characters"} (fail closed) rather than producing an ambiguous map.

Daemon vs. one-shot

detect-secrets caches a process-global secret_type → plugin mapping, so a fresh one-shot call must re-register the plugin set every time — slow under load. Two console scripts (installed with the extra) cover both modes:

  • agent-secret-redactor — one-shot: reads text on stdin, writes the redaction result as JSON on stdout. Re-registers plugins per call.
  • agent-secret-redactor-daemon <socket-path> — long-lived Unix-socket server that configures the plugin set once at startup (a warm-up scan primes the cache before it binds, so a bound socket means ready). Wire protocol both directions: a 4-byte big-endian length prefix then that many bytes of UTF-8 JSON. Request {"text", "map", "web_ingress", "env_secrets"}; response is the one-shot result, JSON null when nothing is redacted, or {"error": …} on a scan failure.

Both console scripts import the engine on startup, so they fail loud if the [secrets] extra (hence detect-secrets) is not installed — fail closed, never a silent no-op.

Versioning

This package is versioned in lockstep with the npm agent-sanitizer: each release publishes both at the same version from the same commit, and the wheel bundles src/ at exactly that version. So pip install agent-sanitizer==X.Y.Z and npm i agent-sanitizer@X.Y.Z are the same underlying logic.

Project links

Data verified by PyPI on Aug 9, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.57.5)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for TurnTrout from gravatar.com TurnTrout

GitHub Statistics

Data verified by PyPI on Aug 9, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

secrets

Tags

ansi prompt-injection sanitizer security unicode

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

agent_sanitizer-2.31.4.tar.gz (359.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

agent_sanitizer-2.31.4-py3-none-any.whl (368.9 kB view details)

Uploaded Python 3

File details

Details for the file agent_sanitizer-2.31.4.tar.gz.

File metadata

  • Download URL: agent_sanitizer-2.31.4.tar.gz
  • Upload date:
  • Size: 359.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for agent_sanitizer-2.31.4.tar.gz
Algorithm Hash digest
SHA256 d53c9c8049e25dab9559ebb5954ddce28130311440fef7223d18fe884a76a640
MD5 58a0d42fba523358b3db1dc9bd8028ad
BLAKE2b-256 a14d721c1311e8c5433d66ae2653b3a1f6c0839d4356c85fe205bf577c4ae202

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.31.4.tar.gz:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file agent_sanitizer-2.31.4-py3-none-any.whl.

File metadata

File hashes

Hashes for agent_sanitizer-2.31.4-py3-none-any.whl
Algorithm Hash digest
SHA256 f086c6f9999a6d46cb479284950aa7eaf733e963dd57f17a8a5e5d59d3f48dec
MD5 f4cf3fd68c48518a030d0ed42d757a95
BLAKE2b-256 8e86c99846571bf4e1a71d0c8dae2f69a7bf4f6ca67509fb17cf8f8133346dd3

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.31.4-py3-none-any.whl:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

2.57.5

2 files

2.57.4

2 files

2.57.3

2 files

2.57.2

2 files

2.57.1

2 files

2.57.0

2 files

2.56.1

2 files

2.56.0

2 files

2.55.0

2 files

2.54.2

2 files

2.54.1

2 files

2.54.0

2 files

2.53.0

2 files

2.52.0

2 files

2.51.0

2 files

2.50.0

2 files

2.49.2

2 files

2.49.1

2 files

2.49.0

2 files

2.48.6

2 files

2.48.5

2 files

2.48.4

2 files

2.48.3

2 files

2.48.2

2 files

2.48.1

2 files

2.48.0

2 files

2.47.15

2 files

2.47.14

2 files

2.47.13

2 files

2.47.12

2 files

2.47.11

2 files

2.47.10

2 files

2.47.9

2 files

2.47.8

2 files

2.47.7

2 files

2.47.6

2 files

2.47.5

2 files

2.47.4

2 files

2.47.3

2 files

2.47.2

2 files

2.47.1

2 files

2.47.0

2 files

2.46.0

2 files

2.45.9

2 files

2.45.8

2 files

2.45.7

2 files

2.45.6

2 files

2.45.5

2 files

2.45.4

2 files

2.45.3

2 files

2.45.2

2 files

2.45.1

2 files

2.45.0

2 files

2.44.1

2 files

2.44.0

2 files

2.43.12

2 files

2.43.11

2 files

2.43.10

2 files

2.43.9

2 files

2.43.8

2 files

2.43.7

2 files

2.43.6

2 files

2.43.3

2 files

2.43.2

2 files

2.43.1

2 files

2.43.0

2 files

2.41.4

2 files

2.41.3

2 files

2.41.2

2 files

2.41.1

2 files

2.41.0

2 files

2.40.5

2 files

2.40.4

2 files

2.40.3

2 files

2.40.2

2 files

2.40.1

2 files

2.40.0

2 files

2.34.12

2 files

2.34.11

2 files

2.34.10

2 files

2.34.8

2 files

2.34.7

2 files

2.34.6

2 files

2.34.5

2 files

2.34.4

2 files

2.34.3

2 files

2.34.2

2 files

2.34.1

2 files

2.34.0

2 files

2.33.1

2 files

2.33.0

2 files

2.32.3

2 files

2.32.2

2 files

2.32.1

2 files

2.32.0

2 files

2.31.6

2 files

2.31.5

2 files

This release

2.31.4 This release

2 files

2.31.3

2 files

2.31.2

2 files

2.31.1

2 files

2.31.0

2 files

2.30.0

2 files

2.29.1

2 files

2.29.0

2 files

2.28.3

2 files

2.28.2

2 files

2.28.1

2 files

2.28.0

2 files

2.27.0

2 files

2.26.3

2 files

2.26.2

2 files

2.26.0

2 files

2.25.0

2 files

2.24.2

2 files

2.24.1

2 files

2.24.0

2 files

2.23.2

2 files

2.23.1

2 files

2.23.0

2 files

2.21.1

2 files

2.21.0

2 files

2.20.2

2 files

2.20.1

2 files

2.20.0

2 files

2.19.8

2 files

2.19.6

2 files

2.19.4

2 files

2.19.2

2 files

2.19.1

2 files

2.19.0

2 files

2.18.1

2 files

2.18.0

2 files

2.17.1

2 files

2.17.0

2 files

2.16.0

2 files

2.15.0

2 files

2.14.14

2 files

2.14.13

2 files

2.14.11

2 files

2.14.10

2 files

2.14.9

2 files

2.14.8

2 files

2.14.6

2 files

2.14.4

2 files

2.14.3

2 files

2.14.2

2 files

2.14.1

2 files

2.14.0

2 files

2.13.0

2 files

2.12.0

2 files

2.11.0

2 files

2.10.1

2 files

2.10.0

2 files

2.9.1

2 files

2.9.0

2 files

2.8.0

2 files

2.7.2

2 files

2.7.1

2 files

2.7.0

2 files

2.6.0

2 files

2.5.0

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.2

2 files

2.2.1

2 files

2.2.0

2 files

2.1.0

2 files

2.0.3

2 files

2.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page