Vigils CLI
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
- 74 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Edits settings of Claude Code, Codex, Cursor and other agents: installs hooks and rewrites stdio MCP server launches through the gateway
- All tool calls and results pass through the gateway, and a local process sees keys and prompts
- Optionally installs a model API proxy and a browser extension that reads text typed on AI sites
Install
- Works in
Manual install
curl -fsSL https://vigils.ai/install.sh | shInstalls the vigil-hub CLI in ~/.local/bin without editing agent settings. Windows has irm https://vigils.ai/install.ps1 | iex. Read the script before running it.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Edits settings of Claude Code, Codex, Cursor and other agents: installs hooks and rewrites stdio MCP server launches through the gateway
- All tool calls and results pass through the gateway, and a local process sees keys and prompts
- Optionally installs a model API proxy and a browser extension that reads text typed on AI sites
This is third-party code. Review the repository files before installing.
What it does
Vigils runs locally and sends nothing out. The `vigil-hub` gateway proxies MCP servers over stdio and HTTP and runs every call through a chain: redaction, firewall, approval, sandbox, audit. The firewall denies by default whatever a rule in the built-in policy language does not allow. Every tool call lands in a SQLite ledger with a SHA-256 hash chain, and a tampered entry shows up on verification. Risky actions such as file writes, network requests and deletion wait for a human in an approval queue, with grants for once or for the session. The redaction engine finds over 17 classes of secrets and personal data, including GitHub tokens, Stripe keys and database URLs, and masks them before text reaches the model, the log or the screen. `vigil-hub setup --all` installs pre-tool-use hooks in Claude Code, Codex CLI, Gemini CLI and Cursor and reroutes the stdio MCP servers of about ten more agents through the gateway. Monitor posture is the default: servers keep working as before while raw-secret blocking, result redaction and the log stay on. Add `--enforce` for default deny. There is also a Tauri desktop app and a Chrome extension that hides secrets before paste into ChatGPT, Claude, Gemini and Perplexity.
Who it is for. Developers who let agents run commands and MCP servers and want to see and limit what an agent does with files, network and keys.
Good fit when
- The environment holds GitHub tokens and cloud keys and the agent must not be able to carry them into a model request
- You need an agent call log where a tampered entry is caught by hash chain verification
- Deleting and writing files should wait for your approval and never run silently
- Several MCP servers are connected and you need to notice when a tool's definition changes
Not a fit when
- You need network or container protection for the whole machine: Vigils works with agent and MCP server events
- The machine cannot run background processes or have agent settings edited
- You expect an antivirus replacement: the project does not promise full protection against prompt injection
Example request
Install Vigils, run vigil-hub demo and show how a secret is replaced with a placeholder, then wire protection into Claude Code in monitor modeLimitations
- Early releases are not OS-code-signed, so the system may show a warning on first launch. Every file has a SHA-256 and a build attestation for verification.
- Codex skips third-party hooks until you approve them with `/hooks`; until then Vigils shows the agent as pending trust.
- The ML engine downloads 0.8 to 1.5 GB of models on first run and works on Mac only with Apple Silicon. The default build uses rules without models.
- The Wasm sandbox is off in shipped builds, and on Linux isolation goes through Landlock.
How to disable. Run `vigil-hub setup --all --uninstall`: it removes only Vigils entries and restores agent settings. In the desktop app a rollback button does the same. The binaries sit in `~/.local/bin` or `%LOCALAPPDATA%\Vigils\bin` and can be deleted by hand.
FAQ
How do I install Vigils?
Install the CLI with `curl -fsSL https://vigils.ai/install.sh | sh` on macOS and Linux or `irm https://vigils.ai/install.ps1 | iex` in PowerShell. The script only places binaries and leaves agent settings alone. `vigil-hub setup --all` turns protection on.
Which agents does Vigils protect?
Pre-tool-use hooks go into Claude Code, Codex CLI, Gemini CLI and Cursor. MCP servers pass through the gateway for those agents and for Windsurf, Kimi CLI, ZCode, pi, Grok CLI, OpenCode, CodeBuddy and Cline.
Does my data go to the cloud?
No, prompts, secrets and the log stay on the machine. The network is used only for installing and for downloading redaction models in ML mode, and downloads are verified by SHA-256.
How does monitor mode differ from enforce?
In monitor mode servers work as before while raw-secret blocking, result redaction and the log stay on. The `--enforce` flag adds default deny for calls that no rule allows.
Can I check what Vigils caught?
Yes: `vigil-hub inspect protection` shows blocked secrets, redacted leaks and the hash chain state, and `vigil-hub demo --tamper` shows verification detecting a tampered log.
Discussion
No questions or reviews yet.
Related
CLI toolsSecurity hook for coding agents: scores each tool call with session context and flags injections in results and skills
An MCP memory server for agents plus a free gate that stops dangerous commands before they run
Clawvisor is a gateway between agent and APIs: the agent declares a task, a human approves scope, the gateway injects keys.
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Vahta lets an agent use your passwords and API keys from an encrypted vault without ever showing it the values
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Vigils (this card) | no | 74 | |
| HOL Guard | yes | 1,094 | agent command hooks and package checks, with no MCP gateway that scrubs results and no browser extension |
| Destructive Command Guard | no | 6,349 | blocks dangerous shell commands and does not cover secrets or MCP |
README in short
The project page presents Vigils as a local control plane for AI agents with four guarantees: see what agents did, approve risky actions, keep secrets out of prompts and logs, and contain execution. It then lists features: the ledger, firewall, approvals, redaction, the MCP gateway, the desktop app and the extension. The install section compares the rules and ML builds and explains download verification. The quick start goes from install to a one-minute demo and the setup command.