<div align="center">

🛡️ AgentShield

Boundary-Safe Secret Defense & Shell Sandbox for Autonomous AI Coding Agents

<br />

⚡ Quick Start • 📖 Full Guide • 🎯 Threat Model • 🛡️ Agent Sandbox • 🐙 GitHub Action • 🤖 Agent Skill • 📋 Compliance • 🏆 Bounties • 🏛️ Governance • 📜 Grants • 👥 Contributors • 💖 Sponsor (Dodo) • 🌐 Website

<br/><br/>

<p align="center"> <img src="docs/terminal-demo.svg" alt="AgentShield Terminal Sandbox Demo" width="820" /> </p> </div>

---

💥 The AI Agent Security Blindspot

Autonomous coding agents (Claude Code, Cursor, Windsurf, Codex, Antigravity) are routinely granted terminal and file access to inspect codebases and resolve bugs. Without a guardrail, agents frequently:

| Vulnerability Vector | Real-World Agent Behavior | Threat Impact | | :--- | :--- | :--- | | Context Window Leak | Agent runs cat .env or type .env to read configs. | Production credentials leak to third-party model inference APIs & chat history. | | Accidental Exfiltration | Agent runs curl or shell scripts with exported tokens. | Ephemeral tokens dumped into terminal logs & CI artifacts. | | Git Contamination | Agent writes tests or code with live test credentials. | Secrets committed permanently into Git history and pull requests. |

AgentShield acts as a deterministic, local-first defense layer that intercepts, audits, and redacts credentials before they ever escape your machine. Grounded in our verifiable Threat Model, it replaces unprovable marketing claims with mathematically testable streaming invariants.

---

⚡ Instant 30-Second Setup

No account or complicated daemon required. Run instantly with npx:

# 1. Audit any directory or config file for credentials
npx @ritualdev-lab/agentshield scan .env

# 2. Prevent git commits with leaked secrets (installs pre-commit gate)
npx @ritualdev-lab/agentshield hook git-install

# 3. Safely wrap agent bash execution
npx @ritualdev-lab/agentshield exec "cat .env"

---

🚀 Key Defense Layers

🛡️ 1. Autonomous Agent Shell Sandbox & OS Isolation Boundary

Intercept and sandbox agent terminal execution. If an agent tries to read .env, dump shell variables (printenv), or send keys to outbound endpoints, AgentShield blocks it on the fly:

npx @ritualdev-lab/agentshield exec "cat .env"
# 🚨 [AgentShield Sandbox Block] Blocked attempt to read raw .env or private credential file.
# Protected credentials from entering agent LLM context window!

OS Isolation Guarantees & Defense-in-Depth Boundary

[!IMPORTANT] Defense-in-Depth vs OS Security Boundary: Userland command inspection (AST parsing and regex heuristics) is defense-in-depth designed to prevent accidental exfiltration and common script bypasses. It is not an OS kernel security boundary. Arbitrary compiled binaries or direct kernel syscalls require true OS-level containerization.

| Platform | Primary Isolation Mechanism | Security Boundary Level | Guarantees & Limitations | | :--- | :--- | :---: | :--- | | macOS | macos_sandbox_exec | Kernel-Enforced | System call mediation via Apple Seatbelt; restricts file read/write and networking outside workspace. | | Linux | linux_landlock / bwrap | Defense-in-Depth (unless containerized) | Generates Landlock LSM & bubblewrap profiles. Without a container runtime, Node child processes inherit caller privileges. | | Windows | windows_appcontainer | Defense-in-Depth | Generates AppContainer / Low-Integrity profile templates. Win32 child processes run with normal caller token integrity. | | Fallback | process_level_firewall | Defense-in-Depth | AST pattern firewall and real-time streaming redaction. |

Strict Isolation Enforcement (--require-isolation)

By default, requesting kernel sandboxing on non-macOS hosts logs an isolation warning and runs under the defense-in-depth AST firewall. To fail-closed and refuse execution whenever OS-level kernel isolation cannot be guaranteed:

# Refuse execution if the host cannot enforce true OS kernel isolation
npx @ritualdev-lab/agentshield exec "npm test" --require-isolation
# 🛑 [AgentShield Isolation Refusal] Execution refused: requireIsolation is enabled, but OS-level kernel isolation is unavailable on host (win32). Refusing to silently downgrade to process-level firewall.

In the TypeScript SDK:

const result = await interceptor.execute(command, {
  enableKernelSandbox: true,
  requireIsolation: true, // Fails closed instead of silently downgrading
});

🚦 2. Git Pre-Commit Leak Shield

Catch leaked credentials before they enter git history. Audits staged diffs automatically:

# Install once in your repo (native git hook)
npx @ritualdev-lab/agentshield hook git-install

# Or manually audit staged files
npx @ritualdev-lab/agentshield hook check

Or using the standard pre-commit framework (.pre-commit-config.yaml):

repos:
  - repo: https://github.com/RitualDev-Lab/AgentShield
    rev: v0.1.1
    hooks:
      - id: agentshield
      - id: agentshield-audit

🐙 3. CI/CD Security Gate & GitHub Action

Block pull requests that introduce exposed credentials into your codebase:

name: AgentShield Security Gate
on: [pull_request, push]

jobs:
  secret-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: RitualDev-Lab/AgentShield@v1
        with:
          fail_on_leak: "true"

Or run via CLI in any CI container:

npx @ritualdev-lab/agentshield ci --base origin/main --report security-report.md

📋 4. Scope-Honest Secret-Control Assessment

Assess files and workspace streams against technical secret-handling controls in standard frameworks (SOC 2, PCI-DSS, HIPAA, ISO 27001):

npx @ritualdev-lab/agentshield compliance .env

📋 [SECRET-CONTROL ASSESSMENT] Status: NO_FINDINGS_IN_ASSESSED_CONTROLS (Assessed Controls Score: 100%)
ℹ️  Scope: Technical secret detection, real-time streaming token redaction, and CLI command firewall.
⚠️  Disclaimer: Notice: This report reflects only the results of automated secret detection across assessed technical controls ('NO_FINDINGS_IN_ASSESSED_CONTROLS'). It does NOT establish overall organizational SOC 2, HIPAA, PCI-DSS, or ISO 27001 compliance. Overall compliance requires an accredited third-party audit firm, administrative governance, physical safeguards, and operational policies.

  Assessed Controls:
    ✅ [SOC2] CC6.1: Logical Access Controls & Credential Integrity
    ✅ [SOC2] CC6.6: Boundary Protection & Unauthorized Egress Controls
    ✅ [PCI_DSS] Req-3.4: Protection of Authentication & Payment Gateway Secrets
    ✅ [PCI_DSS] Req-8.3: Strong Authentication Credential Management
    ✅ [HIPAA] §164.312(a)(1): Technical Safeguards - Access Control & Authentication
    ✅ [ISO27001] A.8.28: Secure Coding & Secret Management
    ✅ [ISO27001] A.8.24: Use of Cryptography & Key Protection

  Broader Controls (Not Assessed by Secret Scanning):
    ⏸️  [SOC2] CC1.1: Integrity & Ethical Values (Governance) (NOT ASSESSED)
    ⏸️  [SOC2] CC5.2: Risk Assessment & Vendor Management (NOT ASSESSED)
    ⏸️  [PCI_DSS] Req-9.1: Physical Access Restrictions (NOT ASSESSED)
    ⏸️  [HIPAA] §164.308(a)(1): Administrative Safeguards (NOT ASSESSED)
    ⏸️  [ISO27001] A.5.1: Policies for Information Security (NOT ASSESSED)

🔐 5. Zero-Trust In-Memory Surrogate Injection

Instead of cleartext .env keys, AgentShield provides deterministic, collision-resistant surrogate tokens ([AGENT_SHIELD:ID:hexHash]). Agents can safely manipulate configurations and inspect outputs without ever seeing the plaintext secret in prompt history, rehydrating values locally when required.

---

---

🤖 AI Agent Ecosystem Integrations

AgentShield provides 1-command generators for leading AI coding agent environments:

Claude Code (PreToolUse Hook)

Automatically intercept agent terminal executions before commands touch your environment:

npx @ritualdev-lab/agentshield init-claude

Generates .claude/settings.json configured with:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash|Terminal",
        "command": "npx @ritualdev-lab/agentshield exec --claude-hook"
      }
    ]
  }
}

Note: Claude Code delivers tool call payloads via stdin JSON. AgentShield inspects the payload in real-time and cleanly returns exit code 2 to halt unauthorized commands before execution.

Cursor & Windsurf Rules

npx @ritualdev-lab/agentshield init-cursor

Generates .cursor/rules.json with sensitive path boundaries (.env*, *.pem, id_rsa*) and pre-execution command sandboxing.

Antigravity & Copilot

Plug SKILL.md into workspace agent instructions to enforce zero-leak guarantees natively.

---

⚡ Comparative Benchmark: AgentShield vs Traditional Scanners

Traditional scanners (gitleaks, trufflehog) were designed for post-facto static git repository scanning (scanning files and commit histories at rest).

AgentShield is designed specifically for Autonomous Agent Runtime Protection — intercepting shell commands, scrubbing streaming stdio chunk-by-chunk in sub-milliseconds, and sanitizing LLM prompt inputs before transmission.

| Feature / Metric | AgentShield | GitLeaks | TruffleHog | | :--- | :---: | :---: | :---: | | Primary Domain | Agent Runtime & Stdio Interception | Git History Scanner | Git & Filesystem Scanner | | Average Scan Latency | < 0.04 ms / scan | ~ 2 - 5 ms | ~ 10 - 50 ms | | Throughput | 28,000+ operations/sec | ~ 5,000 ops/sec | ~ 1,200 ops/sec | | Streaming Stdio Interception | ✅ Native (createRedactingStream) | ❌ (Disk / Git diff only) | ❌ (Disk / Git diff only) | | Agent AST Command Sandbox | ✅ Native (exec / run) | ❌ None | ❌ None | | Deterministic Vault Rehydration | ✅ Native ([AGENT_SHIELD:...]) | ❌ None | ❌ None | | MCP Protocol Filter (JSON-RPC) | ✅ Native (mcp-proxy) | ❌ None | ❌ None | | Zero Runtime Dependencies | ✅ 0 deps (Pure Node.js) | Go binary | Go binary / Python | | Git Pre-Commit & CI Gates | ✅ Built-in | ✅ Built-in | ✅ Built-in |

---

🔍 Built-in Secret Detections

AgentShield combines high-performance regular expressions with Shannon Entropy to catch both structured keys and arbitrary high-entropy passwords:

• 🤖 AI Providers: OpenAI (sk-proj-*), Anthropic Claude (sk-ant-*), Google Gemini (AIzaSy*), Hugging Face (hf_*)
• ☁️ Cloud Infrastructure: AWS Access Key ID (AKIA*), AWS Secret Access Keys
• 💳 Payments & SaaS: Stripe Live (sk_live_*), Slack Incoming Webhooks
• 🐙 **V