I Built a Local Secret Scanner That Intercepts AI Coding Agents Before They Write to Disk

AI coding agents are incredibly fast, remarkably helpful, and completely unaware of which strings are secrets.
Existing scanners like Gitleaks and TruffleHog are excellent tools, but they primarily catch secrets after they have already been written to disk—whether that is locally at commit time or downstream in your CI pipeline.

Once an autonomous agent is in your loop, that window is too wide. Tools like Claude Code and Cursor will happily paste a live API key directly into a file or an unmasked curl command if they aren't stopped. I wanted a way to check content before the write operation even happens.
So I built StagedSec.

What it does

StagedSec uses a single detection engine that intercepts secret leaks at three critical development points:

Where How it works

Terminal
stagedsec scan runs as a pre-commit hook checking exactly what is staged.

Editor
A native VS Code extension highlights secrets as you type and provides rotation guides.

AI Agent
A Claude Code hook and a Model Context Protocol (MCP) server inspect content right inside the agent's write loop.

Core Design Philosophy

• 100% Local Execution: Everything runs directly on your machine.
• Zero Overhead: No accounts to create, no tracking, and no external telemetry.
• The Single Network Exception: There is a completely opt-in --verify-aws flag. When enabled, it reaches out to check if an identified AWS key is actually live. It is entirely turned off by default.

Current State & Honest Limitations (Roast Me)

This is currently at version v0.1.
To be completely transparent about where it stands:
• It has about 70 detection rules compared to Gitleaks’ ~220.
• On a fresh, untuned set of token types, its current hit rate is roughly 50%.
• The complete benchmark harness—including the exact test cases where the scanner currently loses—is included directly in the repository. I'd much rather you see where it fails directly from me.
The project is written in Go and is entirely MIT licensed.
I would love to get the community's feedback on this. Specifically, opening issues regarding false positives or missed secrets in your own agent workflows is the most helpful thing you can give me right now to improve the ruleset.
Main Repository: https://gitlab.com/stagedsec/stagedsec
github repo: https://github.com/stagedsec/stagedsec