egressai 0.1.2

Local-first redaction engine for AI egress security

EgressAI

EgressAI is a local-first redaction engine for AI egress security.

The first package takes text, detects secrets, replaces them with stable placeholders, and returns structured findings without exposing plaintext secret values in the public result.

Install

pip install egressai

The package depends on egressai-detect-secrets for provider-aware secret detection.

Python API

from egressai import RedactionEngine

secret = "sk-proj-" + "a" * 40
result = RedactionEngine().redact(f"OPENAI_API_KEY={secret}")
print(result.redacted_text)

Output:

OPENAI_API_KEY={{EGRESSAI_SECRET_OPENAI_001}}

Structured result:

payload = result.to_dict()

The structured output includes:

• redacted_text
• findings
• stats

Plaintext secret values are not included in result.to_dict().

CLI

Redact inline text:

egressai redact "OPENAI_API_KEY=sk-proj-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

Redact a file:

egressai redact ./prompt.txt

Redact stdin:

cat ./logs.txt | egressai redact

Return the full redaction result as JSON:

egressai redact --json ./sample.env

Scan without printing redacted text:

egressai scan ./sample.env

Return findings and stats as JSON:

egressai scan --json ./sample.env

Fail when findings are present:

egressai scan --fail-on-findings ./sample.env

Use a custom placeholder prefix:

egressai redact --placeholder-prefix SAFE ./prompt.txt

Exit Codes

By default, CLI commands exit 0 even when findings are detected.

With --fail-on-findings:

• exits 0 when no findings are detected
• exits 1 when findings are detected
• exits 2 for CLI usage errors

Supported Secret Types

Initial support includes:

• OpenAI API keys
• Anthropic API keys
• Google/Gemini API keys
• GitHub tokens
• GitLab tokens
• AWS access keys
• Stripe keys
• Slack tokens
• npm tokens, including .npmrc auth tokens and NPM_TOKEN=npm_... env values
• PyPI tokens
• Hugging Face tokens
• JWTs
• private key blocks
• database URLs
• Azure connection strings
• generic .env-style secret assignments

Maintainer Notes

Every user-visible change should update this README in the same change set.

Before publishing:

python3 -m pytest
python3 -m build
python3 -m twine check dist/egressai-*