Agent Shield

AgentShield is a zero-leak secret defense and kernel sandbox for autonomous coding agents. Core capabilities: • Native kernel sandboxing with Bubblewrap, Landlock, Seatbelt, and AppContainer • Syscall trapping for unauthorized actions • Environment secret redaction in volatile memory • Synthetic decoy canaries that expose credential theft • Strict CIDR egress filtering • Prompt injection defense • 100% local-first, zero-telemetry operation. AgentShield wraps agent processes such as Claude Code, Cursor, Windsurf, and Codex inside OS-level sandboxes, so every shell command and file access runs under restricted kernel policies. Secrets stay protected because environment variables are redacted before an agent can read or leak them, and decoy keys reveal any attempt to exfiltrate credentials. Egress rules block outbound connections that do not match approved network ranges, which stops data from leaving the machine. Installation is simple through Homebrew, npm, or the VS Code and Open VSX marketplaces. Built for developers, security teams, and enterprises who run autonomous coding agents on sensitive codebases and need strong isolation without sending data to the cloud. Because the project is open source and fully offline-capable, teams can audit the code and keep their environments private.