Stop Autonomous AI Agents
From Leaking Your Secrets.

npx @ritualdev-lab/agentshield scan .env
npx @ritualdev-lab/agentshield scan config.json --json Copy

npx @ritualdev-lab/agentshield redact app.ts
npx @ritualdev-lab/agentshield redact app.ts --style hash Copy

env | npx @ritualdev-lab/agentshield stream
cat build.log | npx @ritualdev-lab/agentshield stream Copy

npx @ritualdev-lab/agentshield compliance .env Copy

npx @ritualdev-lab/agentshield mcp-proxy Copy

npx @ritualdev-lab/agentshield ledger verify Copy

npx @ritualdev-lab/agentshield exec "cat .env"

🚨 [AgentShield Sandbox Block]
Blocked attempt to read raw .env file!

npx @ritualdev-lab/agentshield exec "sh -c $'cat\\t.env'"

🚨 [AgentShield Sandbox Block]
De-obfuscated AST: 'cat .env' → Blocked!

npx @ritualdev-lab/agentshield exec "npm test"
npx @ritualdev-lab/agentshield exec "git status"

✅ Allowed & executed transparently

# Install in .git/hooks/pre-commit
npx @ritualdev-lab/agentshield hook git-install

# Manually audit staged files
npx @ritualdev-lab/agentshield hook check Copy

name: AgentShield Security Gate
on: [pull_request, push]
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: RitualDev-Lab/AgentShield@v1
        with: { fail_on_leak: "true" } Copy

# Diff against base branch & export SARIF
npx @ritualdev-lab/agentshield ci --base origin/main \
  --report report.md \
  --sarif results.sarif Copy

# 1-click init or add to .claude/settings.json:
npx @ritualdev-lab/agentshield init-claude

# .claude/settings.json hooks array:
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash|Terminal",
        "command": "npx @ritualdev-lab/agentshield exec --claude-hook"
      }
    ]
  }
} Copy

# Add rule to .cursorrules:
"Always run npx @ritualdev-lab/agentshield exec
before inspecting configs or shell state.
Verify staged diff with:
npx @ritualdev-lab/agentshield hook check"

# AgentShield includes native SKILL.md
cat SKILL.md

# Automatically invokes local CLI gates
✓ Zero setup required

# Add to claude_desktop_config.json or cursor settings:
"devshelf": {
  "command": "npx",
  "args": ["-y", "devshelf", "mcp"]
}
# Discover tools & verify zero-leak audits! Copy

import { AgentShieldEngine, AgentCommandSandbox } from "@ritualdev-lab/agentshield";

// 1. Initialize Engine
const shield = new AgentShieldEngine();

// 2. Sanitize LLM prompt input
const input = "Connect using postgres://admin:secret123@db:5432/main";
const result = shield.scanAndRedact(input);
console.log(result.sanitizedText);
// → "Connect using postgres://admin:[AGENT_SHIELD:GENERIC_PASSWORD:8f2a1b]@db:5432/main"

// 3. Rehydrate locally upon LLM completion
const original = shield.rehydrate(result.sanitizedText);

// 4. Test Shell Sandbox
const sandbox = new AgentCommandSandbox();
const check = sandbox.inspect("cat .env");
console.log(check.allowed); // false Copy