airgap

Security for the modern AI age. Hide secrets from AI agents, while letting them do their work. airgap launches a target program (e.g. an AI coding agent) inside its own mount namespace and transparently replaces secrets (e.g. .env, SSH/PGP private keys) with redacted versions.

An agent running under airgap can still read and modify the protected files, but it never sees the actual secrets. airgap also has an additional layer to defend against malicious packages: it asks for your permission when unexpected files are being accessed — for instance by a malicious npm install script.

Protected secrets

So far airgap protects:

• .env and .env.* (e.g. .env.local, .env.production) — matched by filename. Values are redacted to <redacted value> while keys stay visible; edits, additions, and deletions are persisted back to the real file.
• SSH / PGP private keys — matched by content (any file starting with a private-key header: OpenSSH/ed25519, RSA, EC/PKCS#8, or PGP). The key body is redacted while the BEGIN/END markers are kept.

More secret types will be added.

These are redacted anywhere under the working directory or your home directory ($HOME) — so both a project's .env and ~/.ssh keys are covered. Matching is dynamic: files created after launch are caught too.

Platform support

• Linux — fully supported. airgap relies on mount namespaces and a FUSE overlay, which are Linux features.
• macOS — not yet, but incoming.

Install

cargo install airgap

airgap creates a mount namespace and mounts a FUSE filesystem, which require CAP_SYS_ADMIN. Grant it to the installed binary once so you can run it as a normal user (no sudo per invocation):

sudo setcap cap_sys_admin+ep "$(command -v airgap)"

Note: the capability is an attribute of the file, so it is lost whenever the binary is reinstalled. Re-run setcap after each cargo install.

Usage

airgap <program> [args...]

airgap runs <program> with [args...], passing through argv, the environment, and the working directory unchanged. When <program> exits, airgap exits with the same code.

By default <program> must be a program airgap has a profile for (matched by executable name):

• AI agents — opencode, claude — run with redaction only.
• Package managers — npm, npx, yarn, pnpm — run with redaction plus an interactive file gate: because their install hooks run arbitrary third-party code, airgap asks you to allow or reject the first read of each new file (so a postinstall script reading ~/.ssh/id_rsa is caught). Approving a file grants only that file; decisions last for the run. A few benign paths are pre-approved (~/.npm/_logs, ~/.npm/_cacache, ~/.gitconfig, $CWD/node_modules, $CWD/package.json, $CWD/package-lock.json).

Running anything else requires the --allow-unknown-program opt-out (run it with redaction only). --profile <agent|npm> forces a specific profile onto any program. --debug logs each file access the gate pre-allows (allowlist hits) to stderr. Program matching is a guardrail against accidental misuse, not a security boundary.

Demo

Compare .env's content with and without using airgap:

$ cat .env
API_KEY=sk-live-9f8c2a1b4e7d
DB_PASSWORD=hunter2

$ airgap cat .env
API_KEY=<redacted value>
DB_PASSWORD=<redacted value>

With an AI agent:

$ airgap claude

 show me ./test/fixtures/.env contents

  Read 1 file

Here's the file:

DATABASE_URL="<redacted value>"
API_KEY="<redacted value>"
AWS_SECRET_ACCESS_KEY="<redacted value>"
DEBUG="<redacted value>"

...

Use with Claude / opencode

To always run your AI agent under airgap, alias it in your shell config (~/.bashrc, ~/.zshrc, ...):

alias claude="airgap claude"
alias opencode="airgap opencode"

Now claude (or opencode) transparently runs inside airgap.

Use with npm

Run your package manager under airgap to guard against malicious install scripts — for example a postinstall script that tries to reach for your SSH keys or .env during npm install:

$ airgap npm install
...
airgap: npm wants to read the file /home/you/.ssh/id_rsa — allow? [y/N] n
airgap: npm wants to read the file /home/you/.env — allow? [y/N] n

Answer n to reject the access.

Or alias it in your shell config:

alias npm="airgap npm"