agent-sanitizer (Python client)

A thin Python bridge to the agent-sanitizer Node.js CLI. The sanitization logic has a single source of truth — the JavaScript in src/ — so this package shells out to the CLI rather than re-implementing it, giving a Python pipeline byte-identical verdicts with no second implementation to keep in sync.

Requirements

  • Node.js (>= 22) on PATH. The sanitizer is JavaScript; something has to run it. There is deliberately no pure-Python fallback.

That's it — pip install agent-sanitizer and, with Node available, you're ready to go. The wheel ships a self-contained, single-file build of the CLI (the src/ logic and its npm dependencies bundled into one .mjs at release time), so there is no separate JavaScript checkout to clone and no environment variable to set. The bundle is a versioned build artifact from src/, not a hand-maintained port, so it can't drift from the JS.

Optional: point at your own JS checkout

Set AGENT_SANITIZER_CLI to a checkout's bin/sanitize-cli.mjs to override the bundled CLI (e.g. to run against unreleased src/ changes). When the module is imported directly from a repo checkout, the source CLI is found automatically.

Usage

from agent_sanitizer import sanitize

result = sanitize("untrusted text", html=True)
print(result.cleaned, result.found, result.warnings)

See the package docstring for the full set of entry points (sanitize_text, classify_prompt, scan_instruction_files, clean_file, and the long-lived Sanitizer worker).

Secret redaction ([secrets] extra)

The base install is dependency-free. The optional secrets extra adds a pure-Python secret-redaction engine under agent_sanitizer.secrets — detect-secrets plus custom detectors, benign-value skipping, cross-line reassembly, PEM collapse, and exact-match redaction of caller-supplied env-var values. Unlike the sanitizer above it needs no Node.js; its only dependency is detect-secrets, pulled in by the extra:

pip install "agent-sanitizer[secrets]"

Every detect-secrets import lives inside this subpackage, so a plain import agent_sanitizer never touches it. The engine shares the parent package's invisible-character SSOT (agent_sanitizer.invisible) rather than forking it — a fork would be a silent security regression.

In-process

from agent_sanitizer.secrets import RedactorConfig, redact, redact_map

redacted, found = redact("aws_key = AKIAIOSFODNN7EXAMPLE")
# -> ("aws_key = [REDACTED: AWS Access Key]", ["AWS Access Key"])

# Pass provider/host secret values in — config is supplied, never discovered.
cfg = RedactorConfig(host_cred_vars={"GH_TOKEN": "ghp_realtokenvalue123"})
redact("tok=ghp_realtokenvalue123", cfg)  # -> ("tok=[REDACTED: GH_TOKEN]", ["GH_TOKEN"])

The rehydration map contract

redact_map(text, config) returns a lossless, two-way view:

{"text": "<redacted>",
 "pairs": [{"placeholder": "[REDACTED: …]", "original": "<secret>", "start": <int>}],
 "found": ["<type>", ...]}

Substituting each pair["original"] at its start reconstructs the input byte-for-byte. start is a Unicode code-point offset into text (the field is start, not start_offset). U+E000 / U+E001 are reserved placeholder sentinels: input already containing either is refused with {"unmappable": "input contains reserved sentinel characters"} (fail closed) rather than producing an ambiguous map.

Daemon vs. one-shot

detect-secrets caches a process-global secret_type → plugin mapping, so a fresh one-shot call must re-register the plugin set every time — slow under load. Two console scripts (installed with the extra) cover both modes:

  • agent-secret-redactor — one-shot: reads text on stdin, writes the redaction result as JSON on stdout. Re-registers plugins per call.
  • agent-secret-redactor-daemon <socket-path> — long-lived Unix-socket server that configures the plugin set once at startup (a warm-up scan primes the cache before it binds, so a bound socket means ready). Wire protocol both directions: a 4-byte big-endian length prefix then that many bytes of UTF-8 JSON. Request {"text", "map", "web_ingress", "env_secrets"}; response is the one-shot result, JSON null when nothing is redacted, or {"error": …} on a scan failure.

Both console scripts import the engine on startup, so they fail loud if the [secrets] extra (hence detect-secrets) is not installed — fail closed, never a silent no-op.

Versioning

This package is versioned in lockstep with the npm agent-sanitizer: each release publishes both at the same version from the same commit, and the wheel bundles src/ at exactly that version. So pip install agent-sanitizer==X.Y.Z and npm i agent-sanitizer@X.Y.Z are the same underlying logic.

Project links

Data verified by PyPI on Aug 10, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.57.5)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for TurnTrout from gravatar.com TurnTrout

GitHub Statistics

Data verified by PyPI on Aug 10, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

secrets

Tags

ansi prompt-injection sanitizer security unicode

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

agent_sanitizer-2.34.11.tar.gz (362.6 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

agent_sanitizer-2.34.11-py3-none-any.whl (372.7 kB view details)

Uploaded Python 3

File details

Details for the file agent_sanitizer-2.34.11.tar.gz.

File metadata

  • Download URL: agent_sanitizer-2.34.11.tar.gz
  • Upload date:
  • Size: 362.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for agent_sanitizer-2.34.11.tar.gz
Algorithm Hash digest
SHA256 c47ddb8a4804e1680f118509846c0c3f5ed438bbf20382579659cacbaa63b85d
MD5 a444e2245dfb0130114a75b2162ad140
BLAKE2b-256 7daf257a4a5c18281f8885d92fce898f85cca3bfed0f4417bb97622b62b18d9c

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.34.11.tar.gz:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file agent_sanitizer-2.34.11-py3-none-any.whl.

File metadata

File hashes

Hashes for agent_sanitizer-2.34.11-py3-none-any.whl
Algorithm Hash digest
SHA256 a19b3334c623fb02f6cea2783cd063a7f3cd04fdaae67911de1f2ed64af6d7ec
MD5 49bf428f7d88ef809f55d8f56310f25d
BLAKE2b-256 eb6683b30c1f57c6df5adc8ecac015f0764998dc686362599253361920b759cc

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_sanitizer-2.34.11-py3-none-any.whl:

Publisher: auto-version.yaml on AlexanderMattTurner/agent-sanitizer

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

2.57.5

2 files

2.57.4

2 files

2.57.3

2 files

2.57.2

2 files

2.57.1

2 files

2.57.0

2 files

2.56.1

2 files

2.56.0

2 files

2.55.0

2 files

2.54.2

2 files

2.54.1

2 files

2.54.0

2 files

2.53.0

2 files

2.52.0

2 files

2.51.0

2 files

2.50.0

2 files

2.49.2

2 files

2.49.1

2 files

2.49.0

2 files

2.48.6

2 files

2.48.5

2 files

2.48.4

2 files

2.48.3

2 files

2.48.2

2 files

2.48.1

2 files

2.48.0

2 files

2.47.15

2 files

2.47.14

2 files

2.47.13

2 files

2.47.12

2 files

2.47.11

2 files

2.47.10

2 files

2.47.9

2 files

2.47.8

2 files

2.47.7

2 files

2.47.6

2 files

2.47.5

2 files

2.47.4

2 files

2.47.3

2 files

2.47.2

2 files

2.47.1

2 files

2.47.0

2 files

2.46.0

2 files

2.45.9

2 files

2.45.8

2 files

2.45.7

2 files

2.45.6

2 files

2.45.5

2 files

2.45.4

2 files

2.45.3

2 files

2.45.2

2 files

2.45.1

2 files

2.45.0

2 files

2.44.1

2 files

2.44.0

2 files

2.43.12

2 files

2.43.11

2 files

2.43.10

2 files

2.43.9

2 files

2.43.8

2 files

2.43.7

2 files

2.43.6

2 files

2.43.3

2 files

2.43.2

2 files

2.43.1

2 files

2.43.0

2 files

2.41.4

2 files

2.41.3

2 files

2.41.2

2 files

2.41.1

2 files

2.41.0

2 files

2.40.5

2 files

2.40.4

2 files

2.40.3

2 files

2.40.2

2 files

2.40.1

2 files

2.40.0

2 files

2.34.12

2 files

This release

2.34.11 This release

2 files

2.34.10

2 files

2.34.8

2 files

2.34.7

2 files

2.34.6

2 files

2.34.5

2 files

2.34.4

2 files

2.34.3

2 files

2.34.2

2 files

2.34.1

2 files

2.34.0

2 files

2.33.1

2 files

2.33.0

2 files

2.32.3

2 files

2.32.2

2 files

2.32.1

2 files

2.32.0

2 files

2.31.6

2 files

2.31.5

2 files

2.31.4

2 files

2.31.3

2 files

2.31.2

2 files

2.31.1

2 files

2.31.0

2 files

2.30.0

2 files

2.29.1

2 files

2.29.0

2 files

2.28.3

2 files

2.28.2

2 files

2.28.1

2 files

2.28.0

2 files

2.27.0

2 files

2.26.3

2 files

2.26.2

2 files

2.26.0

2 files

2.25.0

2 files

2.24.2

2 files

2.24.1

2 files

2.24.0

2 files

2.23.2

2 files

2.23.1

2 files

2.23.0

2 files

2.21.1

2 files

2.21.0

2 files

2.20.2

2 files

2.20.1

2 files

2.20.0

2 files

2.19.8

2 files

2.19.6

2 files

2.19.4

2 files

2.19.2

2 files

2.19.1

2 files

2.19.0

2 files

2.18.1

2 files

2.18.0

2 files

2.17.1

2 files

2.17.0

2 files

2.16.0

2 files

2.15.0

2 files

2.14.14

2 files

2.14.13

2 files

2.14.11

2 files

2.14.10

2 files

2.14.9

2 files

2.14.8

2 files

2.14.6

2 files

2.14.4

2 files

2.14.3

2 files

2.14.2

2 files

2.14.1

2 files

2.14.0

2 files

2.13.0

2 files

2.12.0

2 files

2.11.0

2 files

2.10.1

2 files

2.10.0

2 files

2.9.1

2 files

2.9.0

2 files

2.8.0

2 files

2.7.2

2 files

2.7.1

2 files

2.7.0

2 files

2.6.0

2 files

2.5.0

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.2

2 files

2.2.1

2 files

2.2.0

2 files

2.1.0

2 files

2.0.3

2 files

2.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page