agentprint 0.1.1

The security check your AI coding agent runs for you.

uvx agentprint
npx agentprint-cli

_{Works inside: Claude Code · Codex · Cursor · Gemini CLI · Windsurf · Devin · OpenCode · Copilot · Hermes · Antigravity
Also scans: Cline · Claude Desktop · Kilo Code · Zed · Goose · Aider · Continue · Qwen Code · Crush · Kiro · Factory Droid · Augment · Amp · Junie}

Docs · Get started · Checks · Use in CI

Why

• Agent files leak into packages. In April 2026 Lakera reported that of about 46,500 npm packages it scanned, 428 shipped .claude/settings.local.json, and 33 files in 30 packages held credentials.
• We measured it too. Our pilot scan (5 November 2026, counts only) of the newest 1,976 npm packages and 1,997 PyPI releases found agent files in 2.1% of npm packages and 9.2% of PyPI releases. 1 npm and 6 PyPI packages shipped files that should never ship. No key-shaped strings turned up inside those agent files.
• History files keep what you paste. Agents save prompts as plain text in your home folder. A June 2026 Hermes Agent advisory (CVE-2026-53870) covers such files being created readable by every user on the machine.

Quickstart

uvx agentprint scan      # sweep this machine and folder (keys masked)
uvx agentprint fix       # make the safe fixes; shows the plan and asks first
uvx agentprint install   # arm each agent it finds with the tripwire
uvx agentprint pack      # preflight: what your package would publish

On Windows, install adds the MCP server and the note but no agent hook yet (the hooks run through /bin/sh), so no agent hook blocks a publish or push there, and agentprint status says "MCP and note; no hook on Windows yet". agentprint protect (below) still checks pushes and npm publishes at git and npm themselves. scan, fix and pack work the same.

Get started has the details, including running from a clone of this repo.

For a team, a project config and baseline accept what you have already reviewed.

What it checks

Keys are found by pattern and are never used or sent anywhere: Anthropic, OpenAI, GitHub, AWS, Stripe, Slack and Google, then 27 newer rules (and Slack xapp- tokens): Google OAuth client secrets (GOCSPX-), publishing tokens (npm, PyPI, GitLab, Docker Hub), AI providers (Hugging Face, Groq, OpenRouter, xAI, Perplexity, Replicate), developer platforms (Supabase, Cloudflare, DigitalOcean, Linear, Notion, Shopify, Atlassian, Postman, SendGrid, Doppler, 1Password), and DeepSeek, Twilio, Discord and Telegram only next to the provider's name. A generic "secret-looking name = random-looking value" rule catches the rest. Format lengths for Docker Hub, Supabase secret keys and Google OAuth secrets are from third-party scanners, not the vendor's docs.

It also finds keys hidden from ordinary secret scanners: split across strings, behind invisible characters, continued across lines, inside YAML blocks or base64. The benchmark scores agentprint, gitleaks and trufflehog the same way on a labelled corpus, with its method and limits stated.

Inside your AI agent

• A hook runs before the agent publishes a package or runs git push, and checks what would go out. It follows what the command runs, too: shell scripts, make and just recipes, npm version hooks. Not on Windows yet: there install adds only the MCP server and the note.
• An MCP server gives the agent tools to check on its own.
• If something would leak, the agent gets a brief: the fix steps, plus what to ask you (rotate a key).
• It only ever blocks (BLOCK or CLEAR); your agent's own approval rules still apply.
• Strict mode (agentprint install --strict) also blocks a publish or push agentprint can't check.
• agentprint uninstall takes out exactly what install added.
• agentprint protect adds a second check at git and npm themselves (a pre-push hook and prepublishOnly), so a push hidden from the agent hook is still caught. --undo takes it out.
• Rather add it as a plugin? Claude Code, Codex, Copilot CLI, Gemini CLI, Cursor, Antigravity and Hermes each have one: see Plugins.

Details: Inside your agent.

More

Agents · Plugins · Use in CI · Privacy · Comparison · Census · How it works

Contributing · Security · License (MIT)

Built with Python 3.11+, uv, typer, rich, the MCP Python SDK, pytest and ruff; docs with Astro Starlight.