One file defines your
AI context boundary
One file in git. Ignore, gates, CI —
secrets become tokens where the editor allows.
curl -fsSL https://install.offsend.io/cli | bash
Supported tools
| Editor | Runtime gates |
|---|---|
 Cursor | prompt, read, shell, MCPseal where the editor allows it |
 Claude Code | prompt, read, shell, MCPseal where the editor allows it |
 Windsurf | prompt, read, write, shell, MCP argsno MCP response seal |
 Codex | prompt onlyfile / MCP gates not supported yet |
LimitsLocal-first CLI. Defense-in-depth — not a guarantee that an agent cannot read a file. Cloud agent sessions are outside local hooks.
Ignore-file supportGitHub Copilot, Continue, Gemini, LLM, Aider, Cline, Roo, Zed, Cody
AI context enters through more than prompts
Coding agents can read workspace files, follow file references, run shell commands, call tools, spawn subagents, and retain local transcripts.
A repository needs boundaries across all of these paths — not only for committed files.
Check a repositoryA context policy that belongs to the repository
.offsend.yml keeps AI-context rules visible, reviewable, and versioned with the project.
Audit paths, write the policy, sync ignore files and hooks, then check the local setup — all from the CLI.
curl -fsSL https://install.offsend.io/cli | bashafter install — quick start
FAQ
What does Offsend protect?
Offsend is an open-source, local-first boundary layer for AI coding agents. One committed `.offsend.yml` is the source of truth: `offsend sync` materializes AI ignore files and installs supported hooks. Ignore rules are the primary exclusion. Runtime gates then check prompts, file reads, shell, and MCP on editors that expose those hooks. On Cursor and Claude Code you can seal secrets in MCP responses (and optional sealed file copies) so the agent keeps working without plaintext. Local transcripts can be audited and scrubbed after the fact — that is recovery, not a live gate. Cloud sessions do not run local hooks.
Is Offsend a secret scanner?
Offsend includes content scanning (offsend check) for keys, tokens, and similar patterns in files, staged diffs, and stdin. Its primary job is still the AI context boundary — path policy, AI ignore sync, and runtime gates — not full git-history leak forensics or a cloud sandbox. Use it alongside Gitleaks, TruffleHog, or GitHub secret scanning when you need deep history coverage.
Does Offsend upload my code?
No. CLI checks run locally. Repository policies stay in the repo. Local history is audited locally. No cloud scanning is required.
Does one .offsend.yml guarantee that AI cannot read a file?
No. Offsend is defense-in-depth, not a guarantee. Ignore files are the primary exclusion. Gates cover only the hook surfaces each editor exposes — for example Codex has no file/MCP gates yet, Windsurf cannot seal MCP responses, and Claude subagents are not gated. Cloud agents never see local hooks. Keep secrets out of the repo; use CI `check --policy` for what left the machine.
Where should I start?
Install the CLI, then `offsend show`, `offsend init`, `offsend protect`, and `offsend sync`. Commit `.offsend.yml`. On the next clone, `offsend sync` restores ignore files and hooks. For a look without installing, use Check on a public GitHub repo.
What is Radar?
Radar researches AI-context risk signals across public repositories without reading file contents. Visit radar.offsend.io for the latest report.
Surfaces
CLI for repos. macOS, extension, and GitHub Action for the other paths.
CLI
Audit paths, commit .offsend.yml, sync ignore files and hooks, check the local setup.
Install CLI
Desktop
Check files, folders, and clipboard text before sharing them with AI tools.
Download for macOS
Browser Extension
Detect and mask sensitive values before browser prompts or attached files are sent.
Install extension
GitHub Action
Run the same offsend check in CI before code lands.
Add to CI
Check
Run a fast repository audit without installing the CLI.
Check repository
Radar
Research showing AI-context risk signals across public repositories.
Read latest report