Developer Tool

Keeps your coding agent away from your secrets: .env files, keys in your code, risky commands. For Claude Code, Cursor and VS Code's Copilot agent (Devin and Gemini CLI: being tested), on a Mac or Linux.

Install It

In a terminal, with Node.js 20.11 or later:

npm install -g guardpup
guardpup init

init sets up Claude Code for every project, and offers the other agents it finds on your computer:

$ guardpup init
✓ hook installed    ~/.claude/settings.json
✓ config written    ~/.guardpup/config.json

Every project is protected. When the agent goes for a secret
(.env, keys, the whole environment) Guardpup stops it and says why.

Cursor is installed too: guardpup init --cursor protects it the same way.

Next: guardpup scan  — see what is already exposed.

Then restart your agent, so it loads the check. Other agents: guardpup init --cursor, --vscode, --gemini or --devin. Just one project, kept out of git: guardpup init --project.

Check it's working with guardpup doctor, which runs the check the way your agent will:

$ guardpup doctor
  ✓ hook runs                  exit 0 in 27ms
  ✓ blocks credential reads    .env read → deny
  ✓ catches hardcoded secrets  hardcoded token → deny
  ✓ never echoes the secret    output carries fingerprints, not plaintext

✓ the hook is live and its output matches the PreToolUse contract.

What Your Agent Sees

Every file read, command and edit your agent tries is checked on your computer, in about 30 ms. Most pass silently. When one goes for a secret, it's stopped, and the agent is told why, so it usually finds another way:

Agent: Read .env
Guardpup: .env holds credentials; reading it would send them to the model provider.
Use a secret manager, or ask the user for the specific non-secret value you need.

What it does	For example
Stops reading secret files	`.env`, `~/.aws/credentials`, `*.pem`, `~/.ssh`, and shell routes like `cat .env` or `printenv`
Stops keys written into code	A key the agent hardcodes is caught before the write lands
Asks you first	`terraform apply`, `kubectl delete`, `npm publish`, force-pushes, `sudo`
Refuses	`rm -rf /`, `curl \| sh`

When Guardpup asks about a command, Claude Code shows its usual permission prompt. With prompts off, reply approve to let it through once, or approve always for that kind of command in this project. guardpup level sets how much is asked about.

What's Already Exposed

guardpup scan lists credential files and secrets already in your project:

$ guardpup scan
Credential files (blocked from agent reads)
  .env

Secrets in tracked files
  critical ai.js:1  OpenAI API key
           fingerprint f5c2f20ff6c0 · 48 chars · guardpup allow f5c2f20ff6c0

Not a secret? guardpup allow <fingerprint> stops reporting it. Already sent a key to your agent? guardpup scan --history reads your own messages in the chat history Claude Code and Cursor keep on your computer, lists each key once, and says where to rotate it.

Everything It Decided

guardpup log shows the latest decisions, kept in a log on your computer:

$ guardpup log
deny  Read   credential-file-read   ~/shop-api/.env
ask   Bash   terraform-apply        terraform apply

With Pro, guardpup report sums up what your agents tried in the last week and what was stopped, and guardpup protect adds things of your own to protect. Sign in with guardpup login: Account and Plans.

Updates

About once a day, when you run a guardpup command yourself (never from inside your agent), Guardpup asks for the newest version number and says if there's a newer one. To update:

npm install -g guardpup@latest

Turn the check off with GUARDPUP_NO_UPDATE_CHECK=1.

Remove It

guardpup uninstall takes Guardpup out of every agent and project it was set up in, asks about your log, settings and sign-in, then offers to remove the command itself. Uninstall has the details.

Every command, with its options: Commands.

← Windows App Commands →