AgentProxy
Secret masking for AI coding agents

Your agent reads your .env. The internet shouldn’t.

AI coding agents read your whole repo — .env files, configs, shell history. The moment a secret lands in a prompt, it leaves your machine in plaintext and ends up in logs you don’t control. AgentProxy sits between your agent and the provider and masks every secret — API keys, tokens, connection strings — with a shape-preserving surrogate before the request leaves your machine, then restores it in the response. The agent works normally. Your keys never hit the wire. Runs entirely on your machine.

Runs 100% locally. Free and open source — no account, no telemetry.

BeforeClaude → api.anthropic.com
  prompt contains sk-ant-api03-abc123…
AfterClaude → AgentProxy → api.anthropic.com
  prompt contains sk-ant-api03-rda120…
The response comes back with the real value restored, so the agent sees what it expects.

What it does

Three jobs, all of them on your own machine.

Hard spend capPer-limit budgets, soft alerts or hard 429s. Live cost per request, provider, and project.
Secret maskingAPI keys, JWTs and .env values swapped for shape-preserving surrogates before traffic leaves your machine.
Governance & auditAllowed-model lists, risky-pattern blocks, and a full local request log — nothing phones home.

The problem

Nobody is watching what an unattended agent costs.

Once an AI agent is running unattended, nobody is watching what it costs — per request, per provider, per project. A single runaway loop overnight can turn into a four-figure invoice you only see days later, and by then the money is spent. Separately, those same agents read your codebase — .env files, config, shell history — so a secret that lands in a prompt leaves your machine in plaintext and can end up in logs on someone else's server.

Before:  Claude → api.anthropic.com               (prompt contains sk-ant-api03-abc123…)
After:   Claude → AgentProxy → api.anthropic.com   (prompt contains sk-ant-api03-rda120…)

The response comes back with the real value restored, so the agent sees what it expects.

How it works

Every request takes the same three steps, locally.

i.
InterceptYour agent's HTTP(S) traffic to the model provider routes through the local proxy (:7717), conditionally MITM'd for only the domains you configure.
ii.
MaskRegex + shape-aware scanning finds API keys, connection strings, JWTs, and.env contents, and swaps in random-looking, shape-preserving surrogates — SSE- and WebSocket-aware, so a split value still restores.
iii.
Restore + meterThe response is restored before the agent reads it. Every request is logged to the local dashboard (:7718) with token count, model, and cost — originals never touch disk.

See it in action

The local dashboard (agentproxy dashboard, served at 127.0.0.1:7718) — a real capture under load: 480 requests across 16 agent connections, secrets masked across a dozen pattern types, per-agent spend, budget alerts, governance flags and a live request log, all on your machine.

AgentProxy dashboard: 480 requests across 16 sessions, 1,010 secrets caught across a dozen pattern types, per-agent spend, budget alerts, governance flags and a live masking log

Pricing

AgentProxy is free and open source. The full proxy — masking, metering, budgets, governance — with nothing gated behind a paid tier, no account and no license key.

Your data never comes to us. The proxy runs on your own machines: prompts, API keys and traffic stay local.

Need deployment help, an SLA or custom masking patterns? Talk to us about enterprise support.

Get release updates

AgentProxy is free and open source — install it any time. Leave your email if you'd like a note about new releases, new agent support, and notable updates. No account, no spam, 15 seconds.