duncatzat/vigils

What it solves

Vigils provides a local-first security layer that sits between AI agents (like Claude Code, Cursor, or Codex) and the tools or data they access. It prevents AI agents from leaking sensitive credentials (PII/secrets) to LLM providers, blocks unauthorized or destructive tool calls, and maintains a tamper-evident record of all agent activity.

How it works

It acts as a control plane or gateway (MCP gateway) that intercepts tool calls and API requests. It uses a combination of a Rust-based policy engine for a "default-deny" firewall, a redaction engine (using hard-fingerprint rules or an optional ML ensemble) to mask secrets before they leave the machine, and a sandbox runner (utilizing Linux Landlock LSM or Wasm) to isolate tool execution. All events are recorded in a SQLite ledger secured by a SHA-256 hash chain to ensure the audit trail cannot be tampered with.

Who it’s for

Developers and power users who use AI agents and MCP (Model Context Protocol) servers but want to ensure their API keys, personal data, and system files are protected from accidental exposure or autonomous agent errors.

Highlights

• Tamper-evident audit ledger: Uses a SHA-256 hash chain to make any modification to the activity logs detectable.
• Secret & PII redaction: Strips credentials and personal information using deterministic rules or ML models before they reach the LLM or logs.
• Human-in-the-loop approval: Pauses risky actions (like file writes or network calls) for manual human review.
• Default-deny firewall: Blocks all tool calls unless they are explicitly permitted by a Rust policy DSL.
• Local-first architecture: Ensures prompts, secrets, and audit trails never leave the local machine.
• Turnkey setup: Includes a desktop app and CLI that can automatically detect and protect installed AI agents.