Guardpup checks each file your coding agent reads, each command it runs and each message you send it, on your computer, and stops the ones that would hand a key to the model.
Claude Code, Cursor and VS Code · Free, no account · Checked on your computer
› why can't the app reach the database? ● Bash(cat .env) ⎿ Guardpup: .env holds credentials; reading it would send them to the model provider. Use a secret manager, or read .env.example. ● I'll check config/database.ts instead.
It sits in your agent's tool calls and in front of your own messages.
guardpup init hooks Claude Code, and offers the other agents it finds on your computer (it asks first).
Each file read, command and message is checked on your computer, in about 30 ms.
The agent is told why, and usually finds another way. Everything Guardpup decides goes to a log on your computer.
Already sent a key to your coding agent? Your agents keep your chats on your computer.
guardpup scan --history reads your own messages there, lists each key once, and says where to rotate it.
Guardpupguardpup scan --history --rotated <id> and it stops showing.ChatGPT or Claude in the browser? Check my AI history from their exports.
$ guardpup scan --history Claude Code 2,335 messages · 38 chats Cursor 9,802 messages · 256 chats Rotate these: 2 OpenAI API key sk-p…Qx2a id 3f9a2c1b Cursor · "Fix the billing worker" rotate at platform.openai.com/api-keys Slack webhook http…a8B9 id c25b90fe Claude Code · "Deploy alerts" rotate at api.slack.com/apps ✓ 1 key you marked as rotated, not shown. The values here are made up.
Works with Claude Code, Cursor and VS Code (Copilot chat), each tested in the app. Devin and Gemini CLI are built from their docs and being tested.
.env, ~/.aws/credentials, *.pem, ~/.ssh, service-account JSON, terraform.tfstate. Shell routes too: cat .env, printenv, kubectl get secret.
A key the agent hardcodes is caught before the write lands. 64 kinds of keys. Keys that are public by design, like Stripe's pk_ or a Firebase web config, are left alone.
A key, password, card or ID number you paste into the agent's chat is held back before it's sent, with a masked copy to send instead.
terraform apply, kubectl delete, npm publish, force-pushes and sudo ask you first. rm -rf / and curl | sh are refused.
Tools from MCP servers are watched too, so a file server can't read .env behind the agent's back.
Every decision goes to a log on your computer (guardpup log). With Pro, guardpup report sums up what your agents tried last week, and what was stopped.
For AI chats in the browser and the ChatGPT, Claude and Gemini desktop apps, there's the browser extension and the Mac app: see Personal.
What you type, paste or attach never leaves your computer. Guardpup itself connects only to guardpup.io: with Pro, to check your subscription, and once a week if you choose to share anonymous usage counts. Otherwise it never connects at all. (It also asks once a day for the newest version number, only when you run a guardpup command, and sends nothing with it.)
Measured on real third-party code (Stripe, AWS, Firebase, OpenAI, Supabase and more), October 2026: no detector catches everything. How we measure.
It says what it stopped and why. To let a command it held run once, reply approve. To stop flagging a file or a finding for good, use guardpup allow.
No. See Every Check Runs on Your Computer.
guardpup uninstall takes it out, and names any other agent it still checks, with the command to take it out there too.
Free, with personal details included. Pro adds your own protected items and reports. See pricing. On a team, your company's rules reach the developer tool too: Guardpup for Teams.
Setup, every command and what each one does: the docs. Something else? See help, or ask us. A person replies.
Free. One command to install. Checked on your computer.
Get Guardpup