duncatzat/vigils

What it solves

Vigils provides a local-first security layer that sits between AI agents (like Claude Code, Cursor, or Codex) and the tools or data they access. It prevents AI agents from accidentally leaking secrets, executing destructive commands without permission, or operating without a transparent, tamper-proof record of their actions.

How it works

It acts as a control plane and MCP (Model Context Protocol) gateway. When an agent attempts to call a tool, Vigils intercepts the request and processes it through several layers:

• Firewall & Policy: A default-deny system that blocks tool calls unless they match a specific allowed policy.
• Redaction Engine: Uses hard-fingerprint rules and an optional ML ensemble (ONNX Runtime) to strip PII and secrets from prompts and logs before they reach the model or the screen.
• Approval Queue: Pauses risky actions (like file writes or network calls) for human review.
• Sandbox Runner: Executes tools in isolated environments using native processes, Wasm (Wasmtime), or Linux Landlock LSM for filesystem isolation.
• Audit Ledger: Records every event in a SHA-256 hash-chained SQLite database, making the history tamper-evident.

Who it’s for

Developers and power users who use AI agents to automate tasks on their local machines and want to ensure their API keys, credentials, and private data are not leaked to LLM providers or stored in insecure logs.

Highlights

• Local-first architecture: Prompts and secrets never leave the local machine.
• Tamper-evident auditing: Uses a hash-chained ledger to detect any modification of the activity history.
• Secret lease broker: Injects short-lived credentials into child processes so plaintext is never persisted.
• Turnkey setup: A desktop app and CLI that can automatically detect and protect installed AI agents with a single command.
• Browser Guard: A Chrome extension that redacts secrets before they are submitted to AI web interfaces.