AgentSweep

Offline secret scanner for AI coding agents

Project Overview

Every AI coding CLI stores its full conversation history as plain-text JSONL on disk — under ~/.claude/projects/ for Claude Code, ~/.codex/sessions/ for Codex, and so on. Anything you paste (an AWS key, a .env file, a database URL) sits there in clear text indefinitely. AgentSweep finds and redacts those secrets before a compromised package or supply-chain attack can scrape them.

It scans across 31 supported agents with 193 detection rules covering AWS, GitHub, Stripe, OpenAI, Anthropic, Google, Slack, Discord, JWTs, PEM keys, database URLs, BIP-39 seed phrases and more. Detection runs entirely on your machine — nothing is ever sent anywhere.

Redaction is designed to be safe: every destructive step is gated, backed up, and reversible with a single command. AgentSweep is written in Python, published on PyPI, and installs in one command.