zn-gate (local)

Scrubber (preview)

Not released yet. What the next version of the Scrubber is designed to do, so your agent works with your code while the model never sees your secrets or personal data.

View .md

Preview: not released. This page describes work in progress. Nothing here is available in zn-gate 1.4.1, and details may change before release. For what works today, see Secret redaction.

The goal of the Scrubber: your agent works with your code, and the model never sees your secrets or personal data. Today zn-gate redacts secrets in what passes through it (MCP tool output and arguments) with fixed, one-way placeholders. The next version is designed to go further.

What is planned

  • Hooks for agents' built-in tools. File reads, shell output and searches done by the agent itself, not only MCP tools, redacted before the model sees them. First agents: Claude Code, Codex CLI, Cursor and OpenCode. What each agent allows hooks to change differs, and each limit will be documented per agent.
  • Stable, typed placeholders. A secret becomes a placeholder such as __ZN_AWS_KEY_1__, and the same value always gets the same placeholder. The model can still reason about it ("the AWS key") and write consistent code, and the line keeps its shape: DATABASE_URL=postgres://app:__ZN_DB_PASSWORD_1__@db:5432/main.
  • A local encrypted vault that maps placeholders back to values, encrypted with age and a key held in your operating system's keychain. It never leaves your machine and is never synced.
  • Restoration with a policy. Real values are put back only where they belong: for example in files ignored by git or in local commands. Not in tracked files, and not in commands that reach the network without your confirmation, so a prompt injection cannot get the model to send a restored secret somewhere.
  • Known values first. Values from your environment and your .env files are matched exactly, which avoids false positives by construction. More secret formats are added on top of today's patterns.
  • Personal data. Emails, phone numbers, IBANs and card numbers with checksum verification. Detection of names and addresses with a small local model is planned as an option, off by default.

What will not change

  • Detection and replacement are 100% local. No cloud service, ours included, takes part in that path.
  • Open source, MIT, like the rest of zn-gate.
  • Telemetry stays opt-in, off by default, and limited to counts and versions, never values, paths or hosts.

Follow along

Development happens in the open at github.com/usezn/zn. Releases and changes are listed in the CHANGELOG.