aigate

Secret hygiene for AI-generated code. Catches hardcoded credentials in prompts, tool inputs, generated code, and existing files.

Quick start

pip install aigate && aigate setup-all

That's it. This installs a background proxy (redact mode), a PostToolUse hook for file scanning, and registers the MCP server with Claude Code. Restart your terminal for env vars to take effect.

Requires Python 3.11+ and jq.

What it does

Three layers, one detection engine:

setup-all installs all three. Or pick what you need:

aigate install-hook              # hooks only (no proxy)
claude mcp add aigate aigate-mcp # MCP server only
aigate setup && aigate start     # proxy only

Scan existing code

aigate scan-dir .                # find secrets in a directory
aigate scan-dir . --fix --dry-run # preview what would change
aigate scan-dir . --fix          # replace with env var refs, save to .env

Detection

AWS keys, API tokens (OpenAI, Anthropic, GitHub, GitLab, Slack, SendGrid, Square), database URLs, private keys, GCP service accounts, Tailscale keys, env file secrets, and high-entropy password/token fields.

Detected secrets are mapped to conventional env var names:

Proxy modes

aigate start -m block    # reject requests (default)
aigate start -m redact   # replace secrets with env var placeholders
aigate start -m warn     # forward + log warning
aigate start -m audit    # forward + silent log

Uninstall

aigate stop-proxy && aigate uninstall-hook && claude mcp remove aigate
pip uninstall aigate && rm -rf ~/.aigate ~/.mitmproxy

Remove the lines after # aigate: proxy env vars and # aigate: trust mitmproxy CA from your shell profile.

CA cert removal — macOS: sudo security delete-certificate -c mitmproxy /Library/Keychains/System.keychain | Debian: sudo rm /usr/local/share/ca-certificates/mitmproxy-aigate.crt && sudo update-ca-certificates --fresh | RHEL: sudo rm /etc/pki/ca-trust/source/anchors/mitmproxy-aigate.pem && sudo update-ca-trust