duncatzat/vigils

A local control plane for AI agents — see what they do, approve what matters, keep secrets out. Rust + Tauri + Chrome MV3.

What it solves

Vigils provides a security and control layer that sits between AI agents (like Claude Code, Cursor, or Codex) and the tools or data they access. It prevents AI agents from accidentally leaking secrets, executing dangerous commands without permission, or operating without a traceable record, all while keeping the data local to the user's machine.

How it works

It acts as a local-first control plane and MCP (Model Context Protocol) gateway. When an agent attempts to call a tool, Vigils intercepts the request and passes it through several security layers:

  1. Firewall & Approval: A default-deny firewall checks tool calls against a policy. Risky actions are paused in an Approval Queue for human review.
  2. Redaction Engine: A system using hard-fingerprint rules and an optional ML ensemble (ONNX Runtime) strips PII and secrets from prompts and tool results before they reach the model or logs.
  3. Sandbox Execution: Tools are run in isolated environments using Wasm (Wasmtime) or native processes with Linux Landlock LSM for filesystem isolation.
  4. Audit Ledger: Every action is recorded in a SQLite database using a SHA-256 hash-chained ledger to ensure the history is tamper-evident.

Who it’s for

Developers and power users who use AI agents to interact with their local files, APIs, and system tools but want to ensure their credentials remain private and their system remains secure.

Highlights

  • Tamper-evident audit: Uses a hash-chained ledger to detect any modification of the activity history.
  • Secret Lease Broker: Injects short-lived credentials into child processes so plaintext secrets are never persisted.
  • Turnkey Setup: A one-command setup (setup --all) that automatically configures hooks and MCP gateways for popular agents like Claude Code, Cursor, and Windsurf.
  • Local-first: All prompts, secrets, and audit trails stay on the local machine.
  • Multi-interface: Available as a CLI, a Tauri-based desktop app, and a Chrome browser extension for redacting secrets before submission to AI sites.