agenticstack-guard-secrets 0.1.0

Secrets detection and redaction guard plugin for AgenticStack

agenticstack-guard-secrets

Secrets detection and redaction guard plugin for AgenticStack.

Scans agent input and output for credentials and replaces each with a [REDACTED:<kind>] placeholder (or blocks the content entirely).

Detected secret kinds:

Kind	Pattern
openai-key	sk-... API keys
github-token	ghp_ / gho_ / ghu_ / ghs_ / ghr_ tokens
aws-access-key-id	AKIA... access key ids
slack-token	xoxb- / xoxa- / xoxp- / xoxr- / xoxs- tokens
bearer-token	Bearer <token> authorization headers
hex-secret	32+ hex chars preceded by key/token/secret context words

Install

pip install agenticstack-guard-secrets

Use

from agenticstack import Agent
from agenticstack_guard_secrets import SecretsGuard

# Redact mode (default): secrets are replaced before they reach the
# model or the conversation history.
agent = Agent(name="Helper", guards=[SecretsGuard()])

# Block mode: refuse content containing secrets outright.
agent = Agent(name="Strict", guards=[SecretsGuard(block_instead_of_redact=True)])

Or resolve it by name once the plugin is activated:

from agenticstack import get_runtime

# Auto-discovered via the `agenticstack.plugins` entry point:
await get_runtime().activate("agenticstack.guard-secrets")

agent = Agent(name="Helper", guards=["secrets"])

SecretsGuard subclasses the plain Guard ABC, so it runs on both agent input and output.

Permissions

None — pure-Python regex scanning with no network, filesystem, shell, or environment access.