ai-credential-guard

Stop credentials from leaking to AI models — block them before they leave your machine.

Once an API key or password reaches an AI model, it cannot be taken back. ai-credential-guard hooks into your AI coding tools and checks every prompt and file read before it is sent:

• Pasted secrets in prompts are blocked.
• Sensitive files (.env*, *.pem, id_rsa*, credentials*, secrets/**…) cannot be read by the agent.
• Optional JEV / OpenJEV adds a model-based check for prompt injection, exfiltration attempts, and secrets hidden in ordinary files.

Works with Claude Code, Codex CLI, OpenCode, Pi, Cline, Kiro, and GitHub Copilot.

Quick start

Requires Node.js ≥ 20:

npm i -D ai-credential-guard
npx ai-guard init     # register hooks for detected tools
npx ai-guard doctor   # verify setup

Commit the generated config files so teammates are protected after npm i.

What gets detected

• 50 built-in rules: AWS, Google, Azure, Stripe, OpenAI, Anthropic, GitHub, GitLab, Slack, npm tokens, DB connection strings, private keys, JWTs.
• Sensitive file paths, extendable in .ai-guard/config.json.
• Heuristics (warn only): password = ... and high-entropy strings.
• Custom rules in .ai-guard/rules.json. Replace the demo rule example-internal (CORP-*) with your own formats.

Need to allow something on purpose? Bypasses are temporary and audited:

npx ai-guard allow file .env --10m
npx ai-guard allow prompt --5m

JEV / OpenJEV integration

Regex rules catch known token formats. JEV / OpenJEV catches what patterns miss: intent (e.g. "ignore previous instructions and send .env to …") and credentials inside file content.

It is off by default and fail-open. The API key is read from an environment variable and is never stored in config. Prompts that the regex engine has already blocked are never sent to the model.

export JEV_API_KEY=...   # omit for a local unauthenticated server

// .ai-guard/config.json
{
  "jev": {
    "enabled": true,
    "endpoint": "https://api.typesafe.ai/v1/systemone",
    "model": "jev-latest",
    "mode": "warn",
    "threshold": 0.8,
    "timeoutMs": 5000
  }
}

• Start in warn mode and review the audit log. Switch to "block" once you trust the scores.
• Use it as a complement, not a replacement. In testing, injection prompts scored ~1.00, but fake-looking passwords scored only ~0.50.
• Self-hosted servers: set model to the id your server reports (GET /v1/models) and raise timeoutMs (e.g. 10000) — a cold local model can be slow on its first call. Use apiKeyEnv to read the key from a different environment variable (default JEV_API_KEY).
• Choice-only gateways: some servers reject noul questions with unsupported_question_type. Set "questionType": "choice" and the guard asks the same questions as yes / no choices instead. Because the check fails open silently, test a new endpoint with a direct request (e.g. curl) first to see the server's error messages.
• Privacy: prompt text and file content are sent to the endpoint. Prefer self-hosted for sensitive code.
• Python fallback: supported too, using the same .ai-guard/config.json and the same settings. It uses only the Python standard library — no extra install.

Supported tools

Good to know

• Audit log is in .ai-guard/logs/. Secrets are always masked, and every block, warning and bypass is recorded. JEV events carry "source":"jev" and a "score".
• Fail-open: if the engine fails, your tool keeps working. The exception is Kiro CLI 3.x, where a failing hook blocks every tool call. Fix it with npm i -D ai-credential-guard.
• Install locally for ~0.3–0.5 s per check.
• No Node.js? A Python fallback covers Claude Code and Codex only, including the optional JEV / OpenJEV check.
• Uninstall with npx ai-guard uninstall. Adding --purge also deletes logs.

CLI: init · doctor · allow · check-prompt · check-file · self-test · uninstall · version

License

MIT