Open source · Rust · Apache 2.0

Let AI coding agents work — without seeing your secrets.

AgentBlindfold is a credential-flow control plane for agents like Claude Code and Codex. It launches the agent with a sanitized environment, brokers secrets only to approved commands, and keeps a tamper-evident audit trail.

$ cargo install agentblindfold

Get started View on crates.io Star on GitHub

Sanitized launch Redacted output Policy-gated secrets Complements native sandboxes Agents stay productive

Terminal demo: real AWS and OpenAI keys are masked as [MASKED] before agentblindfold launches the claude agent with a sanitized environment.

The problem

Agents inherit everything your shell knows

Environment variables, .env files, and command output are the easy paths for a secret to leak into a prompt, a log, or a model. AgentBlindfold puts a boundary in front of that flow.

Before

Inherited secrets

A launched agent sees AWS_SECRET_ACCESS_KEY, provider keys, and every other exported variable — plus whatever your commands print.

At launch

Sanitize & mask

AgentBlindfold starts the agent with a sanitized environment and registers known secrets for output redaction as [MASKED:NAME].

On demand

Brokered release

Only commands that match an explicit execution profile receive scoped credentials — through the policy-gated exec broker.

How it works

Three moves: sanitize, broker, audit

Sanitize the launch

The wrapper (agentblindfold claude) starts the native agent with a cleaned environment — provider keys and AWS_* masked by default — while preserving the real TUI.

Broker the secrets

exec --profile is a policy gate: it releases vault secrets, reference-mode credentials, or short-lived materializations only to commands that match a profile's patterns.

Audit everything

Every launch and decision writes a value-free, hash-chained JSONL event. audit verify proves the chain wasn't tampered with; audit graph exports a session flow.

Features

A control plane, not just a wrapper

Sanitized environments

Launch Claude Code with inherited secrets stripped. Opt provider keys back in explicitly — they stay registered for redaction.

Policy-gated exec broker

Scoped execution profiles match commands by glob and release only the named vault, AWS-reference, or Kubernetes credentials they're allowed to.

Encrypted vault

Secrets at rest under AES-256-GCM with an Argon2id-derived key. Import from .env; list shows names and masked previews only.

Scanning & redaction

Shared pattern, context, and entropy detectors find secrets in the repo and mask them in captured output — even across stream boundaries.

Tamper-evident audit

Hash-chained events record names, decisions, and reasons — never values. audit graph exports Mermaid or DOT for a single session.

Native agent wrappers

TUI mode inherits stdio so the full-screen Claude Code experience is untouched. Arguments like -p pass through verbatim.

Defense in depth

Keep the sandbox. Add a credential boundary.

AgentBlindfold is not a replacement for Claude Code, Codex, or OS-level sandboxing. It complements those controls, and the layers are designed to coexist.

Sandbox the runtime

Claude Code, Codex, and OS-level sandboxes constrain where code can operate through filesystem, network, process, permission, and approval boundaries.

Protect credential flow

AgentBlindfold sanitizes inherited secrets, releases approved credentials only to profile-matched commands, redacts brokered output, and records value-free audit events.

Use both layers

The sandbox limits the agent's operating boundary; AgentBlindfold limits its credential boundary. It preserves and, where configured, enables native sandbox controls rather than bypassing them.

Quickstart

Up and running in a minute

Run the setup wizard, then launch your agent through AgentBlindfold. The wizard only ever prints names, paths, and masked previews — never raw values.

install & launch

# install from crates.io (latest release)
$ cargo install agentblindfold

# …or pin a version
$ cargo install agentblindfold@0.3.0

# …or build from a local checkout
$ cargo install --path .

# detect the project, scan safely, write config
$ agentblindfold setup

# launch the native agent, sanitized
$ agentblindfold claude

scoped secret release

# which profile fits this command?
$ agentblindfold profile suggest \
    --command "python -m pytest"

# release only that profile's secrets
$ agentblindfold exec --profile test \
    -- python -m pytest

# prove the audit chain is intact
$ agentblindfold audit verify

Policy modes

Explicit behavior when something looks risky

Every decision carries a reason and can be audited. Resolution order: CLI flag → profile → execution default → policy default → strict.

Mode	Behavior
strict	Blocks risky operations and exits non-zero. This is the default.
audit	Allows where possible, prints a warning, and records what strict mode would have blocked.
interactive	Asks before sensitive operations on a TTY; otherwise falls back to the fail behavior.
allow	Allows the operation while still redacting known secrets and auditing risky behavior.

Audit log & viewer

Every decision recorded — no values, tamper-evident

When enabled, safe JSONL events land in .agentblindfold/audit.jsonl. Each new event is hash-chained over canonical, value-free JSON, so audit verify catches any modified, deleted, or reordered entry.

Value-free by construction. Names, decisions, reasons, exit codes, and redaction counts — never secret values.
Tamper-evident. previous_hash/event_hash link the chain; audit verify fails loudly if it breaks.
Defensive rendering. The viewer re-runs every line through the redactor, so even a legacy hand-written value stays masked.
Graph export. audit graph emits Mermaid or Graphviz DOT for one session — export only, no rendering deps, safe references like npm:NPM_TOKEN and explicit NO TOKEN RELEASED nodes.

inspect a session

$ agentblindfold audit summary
$ agentblindfold audit tail --lines 20
$ agentblindfold audit verify
$ agentblindfold audit graph --session sess_7fa3 \
    --format mermaid

The audit graph command emits a Mermaid flowchart for one session: session root, wrapper start, a policy allow decision, an npm token release, and the exec event — chained top to bottom with no secret values. — A single session, exported as a Mermaid flowchart

Security model

Clear about what it is — and isn't

AgentBlindfold reduces accidental secret exposure. It is not an OS sandbox or a replacement for Claude Code or Codex sandboxing. Use these complementary layers together.

What it does

Starts agents with sanitized environments
Redacts known secrets from captured output
Brokers credential release through approved profiles only
Encrypts the vault and prints names, never values
Writes a tamper-evident, value-free audit log

What it does not

Prevent all file reads on the machine
Prevent all network access or egress
MITM or inspect HTTPS requests
Replace Claude Code or Codex permissions and sandboxing
Guarantee a malicious child can't reach other OS channels

🛡️ Built by a husband-and-wife engineering team

“AgentBlindfold started with one question: Can AI agents help without seeing what they should not?”

We are building it under AgentDefSec Labs to make AI-assisted development safer, more practical, and a little less scary.

Get started

Give your agent a blindfold before you give it your repo

Install, run agentblindfold setup, and launch your agent the way you already do.

Install from crates.io ↗ View on GitHub ↗ Read the onboarding guide