Aigate

aigate

Secret hygiene for AI-generated code. Catches hardcoded credentials in prompts, tool inputs, generated code, and existing files.

Quick start

pip install aigate && aigate setup-all

That's it. This installs a background proxy (redact mode), a PostToolUse hook for file scanning, and registers the MCP server with Claude Code. Restart your terminal for env vars to take effect.

Requires Python 3.11+ and `jq`.

What it does

Three layers, one detection engine:

Layer	Scope	How
Proxy	Network-level	Intercepts HTTPS requests to AI APIs. Redacts secrets before they leave your machine.
Hooks	Claude Code	PostToolUse scans files after Write/Edit. PreToolUse redacts tool inputs.
MCP Server	Any agent	Three tools agents call to scan code, store secrets, and audit files.

`setup-all` installs all three. Or pick what you need:

aigate install-hook              # hooks only (no proxy)
claude mcp add aigate aigate-mcp # MCP server only
aigate setup && aigate start     # proxy only

Scan existing code

aigate scan-dir .                # find secrets in a directory
aigate scan-dir . --fix --dry-run # preview what would change
aigate scan-dir . --fix          # replace with env var refs, save to .env

Detection

AWS keys, API tokens (OpenAI, Anthropic, GitHub, GitLab, Slack, SendGrid, Square), database URLs, private keys, GCP service accounts, Tailscale keys, env file secrets, and high-entropy password/token fields.

Detected secrets are mapped to conventional env var names:

Token	Env var
sk-ant-*	ANTHROPIC_API_KEY
sk-*, sk-proj-*	OPENAI_API_KEY
ghp_*, github_pat_*	GITHUB_TOKEN
glpat-*	GITLAB_TOKEN
xoxb-*	SLACK_BOT_TOKEN
SG.*	SENDGRID_API_KEY
AKIA*	AWS_ACCESS_KEY_ID

Proxy modes

aigate start -m block    # reject requests (default)
aigate start -m reda