Fida is a local-first secret-leak prevention layer designed specifically to keep raw secret values out of reach of AI coding agents. Its goal is very restrained: it does one thing only—detected secrets must not enter the model context. It is explicitly not a general-purpose agent policy engine, approval system, or developer workflow firewall; it does not decide which ordinary commands an agent may run, which files it may edit, or manage whether curl | sh may be used. Regarding project status, the materials show that the MVP has been implemented: Fida can install local integrations, verify the redaction path with synthetic credentials, scan repositories for risk, and record redaction-safe audit events.
Purpose and main capabilities When content an agent needs may contain credentials, Fida provides a sanitized view instead of the raw bytes. Its integration consists of three layers:
- Redacting MCP gateway: fida_read and fida_shell return redacted file contents and captured command output. fida_shell still runs the real command, and the subprocess retains the real credentials, so work can be completed normally; only the output returned to the model is redacted, thereby enabling the agent to "use secrets without seeing them." File reads are restricted to the workspace by default, and trusted user attachments can be covered by optionally specifying explicit read roots; secrets outside these roots (for example, ~/.aws) are covered on agents with enforced protection only by the native read hook.
- Agent guidance: through a managed instruction, tell the agent to use these redacting tools when sensitive content is needed.
- Native read hook (in supported environments): When Fida detects secret content that native tools cannot redact, Codex and Claude Code can block native reads and guide the agent to use the gateway instead. Ordinary clean reads, edits, commands, installations, network access, and approvals remain the responsibility of the agent and developer. Fida's gateway follows the same low-friction rules: it captures and redacts output, but does not apply command allowlists or repository approval policies.
Detection scope The built-in detector catalog can identify dotenv assignments, PEM private keys, and high-precision formats for AWS, GitHub, Google, Slack, Stripe, OpenAI, Anthropic, and JWT credentials. It prioritizes precision over recall: credentials in formats Fida cannot recognize pass through unredacted. This is a best-effort protection against accidental exposure and does not guarantee zero leaks; it is recommended to use it together with gitleaks or GitGuarused together with dedicated history scanners such as dian. Fida adopts a fail-closed strategy for redaction: if it cannot prove that a response is clean, it suppresses that response rather than returning a partial key.
Installation and Usage The binary is installed to ~/.local/bin by default. When run in an interactive terminal, the installer proactively offers to wire up protection for you; otherwise, you need to start setup yourself. The materials provide ways to install to the default location, pin a version, or choose another installation directory (for the specific installation commands, please refer to the project repository documentation). Daily commands include: fida scan reports whether raw keys may reach a detected agent; it never prints key values, lengths, or fragments thereof; fida status reports the actual status of each detected agent: enforced, best_effort, incomplete, or inactive. fida is designed to be install-and-forget: it hooks into every detected programming agent, and running it again later checks for updates. When run in a terminal, the installer proactively completes the wiring; in a pipeline or CI environment, it stays quiet and only prints fida as the next step.
Scope and Limitations Fida only protects content sent to models on the integration paths where it is installed; it is not an operating system sandbox, nor a complete data loss prevention (DLP) product. If an agent can ignore guidance, bypass hooks, or access files through native tools that are not mediated, operating system-level isolation may still be needed. Fida honestly states its coverage rather than turning daily development into a maze of authorizations everywhere. If you discover a security-sensitive issue that may expose keys, bypass redaction, or misreport protection coverage, please report it privately and see SECURITY.md; for license terms, see LICENSE.
