Agent transcripts often keep API keys, cloud credentials and email addresses in plain text on disk. I wanted a tool that stays on the machine, prints only masked values, and refuses writes it cannot yet do safely.

That tool is agentscrub. I am Jarvis Osorio, and I released it as open source under Apache-2.0.

What it does

agentscrub is a local-first Rust CLI that discovers, scans and redacts secrets and PII in AI agent session transcripts. It runs offline, with no accounts and no telemetry.

Commands in v0.1.0:

  • discover — list recognized session files
  • scan — detect secrets and PII (exit 8 if the scan is incomplete)
  • report — re-render a saved JSON report, or re-scan
  • scrub — dry-run redaction by default; pass --confirm to write
  • verify — post-remediation check
  • retention — status / plan / apply / verify (apply refuses while the flag is off)
  • config — show effective config (the current binary expects config show)

Scan output is masked values and fingerprints only. It never logs raw secrets.

Adapters in v0.1

Adapter Read Redact Notes
claude_code yes yes JSONL sessions
codex yes yes JSONL sessions
cursor yes no JSONL + SQLite state.vscdb — rewrite is intentionally disabled
generic_jsonl yes yes Configurable text fields
generic_json yes yes Single JSON documents

Unsupported or malformed files are skipped and reported, not silently modified. Writes that are allowed use an exclusive lock, a pre-write hash recheck, and an atomic same-filesystem replace. Symlink targets are refused.

Cursor rewrite is held back until SQLite and transcript mutation are proven safe. Retention planning is in the tree, but retention.enabled is false by default and retention apply will not delete. This is not a credential revocation service — rotate anything the scan finds at the provider.

Install

agentscrub is not on crates.io or Homebrew yet. It requires Rust 1.89+:

git clone https://github.com/JarvisOsorio/agent-session-scrubber.git cd agent-session-scrubber cargo install --path . # or: cargo build --release && ./target/release/agentscrub --help

A short fixture walk-through (copy fixtures first — do not scrub the originals in-tree):

mkdir -p /tmp/agentscrub-demo/.claude cp tests/fixtures/claude/session_secrets.jsonl /tmp/agentscrub-demo/.claude/ agentscrub discover --path /tmp/agentscrub-demo agentscrub scan --path /tmp/agentscrub-demo --format terminal agentscrub scrub --path /tmp/agentscrub-demo/.claude/session_secrets.jsonl agentscrub scrub --path /tmp/agentscrub-demo/.claude/session_secrets.jsonl --confirm agentscrub verify /tmp/agentscrub-demo/.claude/session_secrets.jsonl --format json # expect: clean=true, remaining_findings=0, exit 0

A name collision to be aware of

The binary is called agentscrub. An unrelated Python project, ppravdin/agentscrub, already exists on GitHub and PyPI. pip install agentscrub is not this tool. Use the GitHub repository above.

Status

The public version is 0.1.0. The GitHub release tag exists; prebuilt binary assets were not attached at publish time, so install from source as shown. Docs in the repository cover the security policy, privacy, threat model and redaction behavior.

If you try it, I would like feedback on the Cursor-rewrite hold and on detector precision. Issues and discussions belong on the GitHub repository.

— Jarvis Osorio