agentscrub, a local-first CLI for agent session secrets and PII by Jarvis Osorio
agentscrub is a local-first Rust CLI by Jarvis Osorio that discovers, scans and redacts secrets and PII in AI agent session transcripts. It runs offline, with no accounts and no telemetry. The GitHub repository is agent-session-scrubber.
The current version is 0.1.0, released under the Apache License 2.0. It requires Rust 1.89+. It is not on crates.io or Homebrew yet — install from the GitHub repository.
Dry-run redaction is the default. Cursor sessions can be discovered and scanned, but rewrite is refused until SQLite/transcript mutation is proven safe. Retention planning is available; retention.enabled is false by default, and retention apply refuses deletion while that flag is off. This is not a credential revocation service — rotate secrets at the provider after a finding.
Problem
Agent transcripts (Claude Code, Codex, Cursor, and generic JSONL) often store API keys, cloud credentials and PII in plain text on disk. agentscrub finds them locally and can rewrite supported formats safely (dry-run by default).
Install
git clone https://github.com/JarvisOsorio/agent-session-scrubber.git
cd agent-session-scrubber
cargo install --path .
# or: cargo build --release && ./target/release/agentscrub --helpCommands
| Command | Purpose |
|---|---|
discover | List recognized session files |
scan | Detect secrets/PII; exit 8 if the scan is incomplete |
report | Re-render a saved JSON report (or re-scan) |
scrub | Dry-run redaction by default; --confirm to write |
verify | Post-remediation check |
retention | status / plan / apply / verify (apply refuses while the flag is off) |
config | Show effective config |
Exit codes: 0 ok · 1 general · 2 bad args · 3 unsupported · 4 permission · 5 validation / unclean verify · 6 remediation · 7 policy · 8 incomplete scan. Incomplete is not clean. Unclean verify exits 5.
Quick start (fixtures)
Copy fixtures first — never scrub the originals in-tree during experiments:
mkdir -p /tmp/agentscrub-demo/.claude
cp tests/fixtures/claude/session_secrets.jsonl /tmp/agentscrub-demo/.claude/
agentscrub discover --path /tmp/agentscrub-demo
agentscrub scan --path /tmp/agentscrub-demo --format terminal
agentscrub scrub --path /tmp/agentscrub-demo/.claude/session_secrets.jsonl
agentscrub scrub --path /tmp/agentscrub-demo/.claude/session_secrets.jsonl --confirm
agentscrub verify /tmp/agentscrub-demo/.claude/session_secrets.jsonl --format json
# expect: clean=true, remaining_findings=0, exit 0Scan output is masked values and fingerprints only — no raw secrets. Fixtures under tests/fixtures/ are synthetic only.
Adapters (v0.1)
| Adapter | Read | Redact | Notes |
|---|---|---|---|
claude_code | ✓ | ✓ | JSONL sessions |
codex | ✓ | ✓ | JSONL sessions |
cursor | ✓ | ✗ | JSONL + SQLite state.vscdb scan only — rewrite intentionally disabled |
generic_jsonl | ✓ | ✓ | Configurable text fields |
generic_json | ✓ | ✓ | Single JSON documents |
Unsupported or malformed files are skipped and reported, never silently modified.
Security posture
- Local-only; no telemetry; no network for scan, scrub or verify
- Never logs raw secrets; reports use masked values and fingerprints
- Atomic same-filesystem replace, exclusive lock and pre-write hash recheck
- Symlink targets refused for modification
- Redaction does not erase backups, snapshots or provider-side copies — rotate leaked credentials at the issuer
Source and license
- Repository: github.com/JarvisOsorio/agent-session-scrubber
- Release: v0.1.0
- License: Apache-2.0
- Author: Jarvis Osorio, technology entrepreneur and AI innovator, based in Miami Beach, Florida
- Project site: jarvisosorio.com/agent-session-scrubber/
- Docs in the repository: SECURITY.md, privacy, threat model, redaction
- Also by Jarvis Osorio: mcp-pordego, an open-source MCP security scanner, and Ambient Memory, a local-first MCP memory layer
Identity: Jarvis Osorio · Jarvis Nelson Osorio · AI work · Official profiles
Updated: November 13, 2026 (America/New_York)