Let AI build.Keep secrets yours.
A local security layer between your project and your AI tools. Detect sensitive data, mask what you share, and stop risky actions before they run.
Works with your coding tools
- Claude Code
- Cursor
- Codex
- GitHub Copilot
- Antigravity
- Windsurf
Catch it before it leaves.
AI tools read your files, take your prompts, and run shell commands. shk adds a check at each of those points, before anything leaves your machine.
src/config.tsOPENAI_API_KEY = "••••••••••••"
HIGH secret.openai_api_keysrc/config.ts:121 finding · value not displayed
Find the rule and location. The matched secret stays out of the scan output.
Please review this customer record:Email: alex@example.comPhone: +1 (415) 555-0123
Please review this customer record:Email: [REDACTED]Phone: [REDACTED]
Replace sensitive values before you paste a prompt into an AI app.
AI agent → shellcat .env
DENY action_guardsecret_dump_commandStopped before execution
A managed pre-hook can deny a risky command before the agent runs it.
Illustrative example only.
Use the same policy from scans to CI.
From your first prompt to your next pull request, keep your security checks connected.
Scan
Finds secrets and PII in source, Markdown, plain text, Office documents, and text-layer PDFs. Scan a directory, staged files, files changed since a branch, or Git history.
$ shk scan .Mask
Redacts findings from prompts, files, the clipboard, and .docx, .xlsx, and .pptx files before you share them. Choose match, partial, or full-line redaction per project.
$ shk mask < prompt.txtAI tool hooks
Installs pre-hooks for six AI coding tools. Sensitive content is stopped before it enters a prompt, and an action guard denies dangerous commands such as .env dumps and recursive deletes.
$ shk hooks install-aiEncrypted .env
Encrypts dotenv files. Private keys live in the OS keyring or 1Password, and decrypted values are injected only into the command you run.
$ shk env run -- npm testMCP audit
Reads MCP client configuration and flags unpinned packages, embedded credentials, plaintext HTTP endpoints, and filesystem servers scoped to / or $HOME. The audit is static and never starts a server.
$ shk mcp auditCI workflow
Writes a GitHub Actions workflow that installs a pinned release, verifies its checksum and attestation, and scans every pull request. SARIF upload to code scanning is one flag.
$ shk ci init githubDetection is pattern-based: hand-tuned rules plus rules adapted from the gitleaks defaults. Image-only PDFs are reported as skipped, not scanned. Treat shk as the check at the AI-tool boundary, not as your only secret scanner.
Review your projects in shk Desktop.
The same Rust engine. A thoughtfully simple desktop app. Scan projects, mask prompts, and review blocked AI activity in one place.
- Quick Setup applies the policy, .gitignore patterns, hooks, .env encryption, and agent skills in one step
- AI Mask workspace for prompts and Office documents, with a shortcut to the AI app you use
- OS notifications when a hook blocks an agent, with file paths kept out of the banner
backend-api
| Tool | Reason | When |
|---|---|---|
| cursorpre | action_guardsecret_dump_command | 2m |
| claude-codeuser-prompt | finding_thresholdsecret.openai_api_key | 14m |
| codexpre | finding_thresholdpii.ja.my_number | 1h |
| windsurfpre | action_guardexternal_transfer | 3h |
LOCAL BY DESIGN
Sensitive data checks.On your machine.
Check sensitive data without sending it away. Scanning, masking, and hook checks all run on your machine.
No network requests during checks
No network access during scans
Scans, masking, and hook checks read local files only. Update checks happen only when you run shk status or shk doctor version.
Audit logs hold metadata only
Audit logs record metadata such as finding counts and rule IDs. Matched values, prompt bodies, and command text are never retained.
Verify what you install
Release archives ship with SHA256 checksums and GitHub artifact attestations. The generated CI workflow verifies both before installing.
Install the CLI
Start with a read-only scan. See the findings, tune your policy, then enable the hooks.
npm install -g security-harness-kitcurl --proto '=https' --tlsv1.2 -LsSf https://github.com/Kazuki-tam/security-harness-kit/releases/latest/download/shk-cli-installer.sh | shbrew install Kazuki-tam/homebrew-tap/shkpowershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://github.com/Kazuki-tam/security-harness-kit/releases/latest/download/shk-cli-installer.ps1 | iex"- 01
Create the policy
Writes shk.toml with default rules and thresholds. If package.json is present it can also pin ignore-scripts and a release age gate for npm, pnpm, Yarn, and Bun.
shk init - 02
Scan the project
Prints findings with severity, rule ID, and location. Exit codes are stable, so the same command works in a pre-commit hook and in CI.
shk scan . - 03
Install the hooks
Registers shk as a pre-hook in each AI tool you use. Start with --audit to observe, then remove the flag to block.
shk hooks install-ai --audit
Questions
Does shk send my code or prompts anywhere?
No. Scanning, masking, hook checks, and MCP audits run on your machine and read local files only. Network access is limited to the optional version check in shk status and shk doctor version, and to commands that exist to talk to a service you choose, such as shk secrets push or the 1Password backend for shk env.
Is shk free?
Yes. shk is open source under the MIT license, and both the CLI and shk Desktop are free to use. The source code and every release archive are published on GitHub.
Which platforms are supported?
The CLI runs on macOS (Intel and Apple Silicon), Linux (x86_64 and aarch64), and Windows x86_64, installed with npm, Homebrew, or the installer scripts. shk Desktop ships for the same platforms. macOS builds are signed and notarized; the Windows installer is not yet code-signed.
How is this different from gitleaks or a hosted secret scanner?
shk is built for the AI-tool boundary: it masks prompts, blocks agent actions, and audits MCP configuration in addition to scanning files. Its detection is pattern-based and includes rules adapted from the gitleaks defaults, so treat it as a local guardrail rather than a replacement for a dedicated scanning platform.
Which files and formats are covered?
Source code, Markdown, plain text, dotenv files, .docx, .xlsx, .pptx, and PDFs with a text layer. Image-only PDFs are reported as skipped rather than silently ignored.
What exactly do the hooks block?
Two things. Content that matches secret or PII rules above your threshold, and actions the guard classifies as dangerous: sensitive file reads and writes, secret and environment dumps, recursive deletes, database mutations, privilege changes, outbound transfers, package manager and system installs, and, in the strict profile, opaque execution such as bash -c. Both are configurable in shk.toml, and --audit mode records without blocking.