keyfence

A local proxy that stops secrets from reaching LLM APIs. It checks every
request to an AI provider before it leaves your machine and blocks, redacts
or placeholder-swaps API keys, passwords and other secrets. Coding agents
read .env files and credential stores and send what they find to the
model; keyfence makes sure the values never arrive.

Try it in one minute

uv tool install keyfence     # or: pipx install keyfence, or pip install keyfence
keyfence demo                # shows what each mode does to a fake request, no network

Use it

keyfence import              # register your own secrets: .env files and credential stores, hashes only
keyfence exec -- claude      # run Claude Code through the proxy

That is the whole setup for Claude Code, pi, Codex, Aider, curl and
anything built on the Python or Node SDKs: keyfence exec starts the
proxy, points the command at it and hands it the CA certificate, then
stops the proxy when the command exits. No sudo, nothing changes on
your system.

Not sure it is working? keyfence doctor checks every piece and says what
to fix; keyfence selftest sends a throwaway secret through a fresh proxy
and checks what comes out the other side. keyfence status shows what has
been caught.

Two more layers, both optional:

keyfence install-hooks claude-code   # Claude Code refuses to read secret files, and refuses a prompt that carries a secret
keyfence install-hooks pi            # same for pi, as a pi extension
keyfence canary .env                 # plant a fake secret; if a tool ever sends it, you will know

Modes

Set mode in ~/.keyfence/config.yaml.

What it catches

Your own secrets, whatever their format, once registered with
keyfence import (from .env files, ~/.aws/credentials, ~/.netrc,
~/.npmrc, ~/.docker/config.json, or --from op|vault|doppler|aws);
240 known formats through built-in rules and the bundled gitleaks ruleset;
and high-entropy strings that look like secrets. Only salted hashes are
stored. Details and numbers in the benchmark.

Verified with

Claude Code (through exec, --local and the hook), pi (through exec
and the extension), the Anthropic and OpenAI HTTP APIs, curl, Python and
Node clients. GitHub Copilot, Vertex AI and Azure AI hosts are on the
default list but have not been tested end to end. Cursor and Windsurf
route through their own backends and are not on the list; add their hosts
with extra_hosts if you want to try, and an issue with the result helps
either way.

Documentation

• Setup:
  install options, GUI apps and system-wide trust, capturing tools that
  ignore proxies, Docker, all commands.
• Detection:
  the vault, pattern rules, entropy check, what is excluded, the audit log.
• Configuration:
  every option, environment variables, the system prompt notice.
• Benchmark:
  recall by secret format and false positive rate by content type, against
  gitleaks, reproducible with python bench/run.py.
• Limitations:
  what keyfence does not cover and what to combine it with.
• Claude Code plugin:
  the hook and two skills, installable with /plugin marketplace add aminueza/keyfence.
• Agents:
  what install-hooks does for Claude Code and for pi.
• Agent hook contract:
  the wire format of keyfence hook, the tool names and fields per agent,
  and how to wire up another agent.
• Security:
  what the proxy sees, what it stores, how releases are built.
• Development
  and Changelog.

License

MIT. Bundled detection rules come from gitleaks,
also MIT.