Overview

Fida is a local-first secret leak prevention layer for AI coding agents. It installs a redacting gateway, checks whether each agent integration is really protected, and scans your repository for paths where a raw secret could reach a model.

Its promise is intentionally narrow and testable: a detected secret is redacted before Fida returns content to an agent. Detection is pattern-based and favors precision, so a credential in a format Fida does not recognize can still pass through. This is best-effort protection against accidental exposure, not a guarantee of zero leakage.

Fida is not a general policy engine, agent approval layer, or development firewall. Normal commands, file edits, and package installs run without prompts — the default decision is allow. It only refuses a narrow, built-in hard-deny set of unambiguously destructive, exfiltration-prone, or SSRF actions.

How it works

Three layers keep the product focused on secret exposure:

1. Redacting gateway — fida_read and fida_shell inspect returned file content and command output, then replace detected values before the result reaches the agent. fida_shell runs the real command (the child process keeps the true credential) and redacts only the output sent back to the model. Gateway file reads stay inside the workspace; secrets in out-of-workspace paths like ~/.aws are covered only by the native-read hook on enforced agents.
2. Agent steering — a managed rules file tells the agent to use the redacting tools for sensitive reads.
3. Native-read hook — on Codex and Claude Code, Fida blocks a native read only when it contains a detected secret that cannot be safely transformed. The agent is directed to the redacting gateway instead.

Normal clean reads, edits, commands, network use, and approvals remain unrestricted by Fida.

Get started

fida
fida status
fida scan

Bare fida wires every detected agent globally and runs a synthetic-secret self-test (run it again later to check for an update); fida on/fida off toggle individual agents. fida status reports protection as enforced, best_effort, incomplete, or inactive, plus how many secrets have been protected. fida scan never emits a secret value, length, or fragment.

Honest limit

Fida is a strong model-context guardrail, not a perfect OS sandbox. An agent that ignores steering and bypasses an available hook can still use an unmediated native tool. This is why Fida reports coverage explicitly rather than claiming protection it cannot verify.