agenticstack-guard-secrets

Secrets detection and redaction guard plugin for AgenticStack.

Scans agent input and output for credentials and replaces each with a [REDACTED:<kind>] placeholder (or blocks the content entirely).

Detected secret kinds:

Install

pip install agenticstack-guard-secrets

Use

from agenticstack import Agent
from agenticstack_guard_secrets import SecretsGuard

# Redact mode (default): secrets are replaced before they reach the
# model or the conversation history.
agent = Agent(name="Helper", guards=[SecretsGuard()])

# Block mode: refuse content containing secrets outright.
agent = Agent(name="Strict", guards=[SecretsGuard(block_instead_of_redact=True)])

Or resolve it by name once the plugin is activated:

from agenticstack import get_runtime

# Auto-discovered via the `agenticstack.plugins` entry point:
await get_runtime().activate("agenticstack.guard-secrets")

agent = Agent(name="Helper", guards=["secrets"])

SecretsGuard subclasses the plain Guard ABC, so it runs on both agent input and output.

Permissions

None — pure-Python regex scanning with no network, filesystem, shell, or environment access.