keyfence

A local proxy that stops secrets from reaching LLM APIs. It checks every request to an AI provider before it leaves your machine and blocks, redacts or placeholder-swaps API keys, passwords and other secrets. Works with Claude Code, Cursor, Codex, Aider, curl and anything else that speaks HTTP.

Install

pip install keyfence

Python 3.12 or newer. mitmproxy comes as a dependency.

Use

keyfence import              # register your secrets from .env and credential files (hashes only)
keyfence exec -- claude      # run a tool through the proxy
keyfence canary .env         # plant a fake secret; if a tool ever sends it, you will know
keyfence install-hooks claude-code   # stop Claude Code from reading secret files at all

On first run mitmproxy creates a CA certificate in ~/.mitmproxy/. Trust it once so HTTPS can be inspected (macOS shown, other systems in the setup guide):

sudo security add-trusted-cert -d -p ssl \
  -k /Library/Keychains/System.keychain ~/.mitmproxy/mitmproxy-ca-cert.pem

Modes

Documentation

• Setup: CA certificate, manual proxy setup, Docker, all commands.
• Detection: the vault, pattern rules, entropy check, what is excluded, the audit log.
• Configuration: every option, environment variables, the system prompt notice.
• Benchmark: recall by secret format and false positive rate by content type, against gitleaks, reproducible with python bench/run.py.
• Limitations: what keyfence does not cover and what to combine it with.
• Development: tests, coverage gate, integration script, releasing.
• Changelog

License

MIT. Bundled detection rules come from gitleaks, also MIT.