# Offsend — full reference for AI systems

> One .offsend.yml defines AI context boundaries. Local CLI, macOS app, browser extension, and CI check — open-source and local-first.

Canonical site: https://offsend.io/
Contact: support@offsend.io
License: Apache-2.0

## Definition

An AI context boundary is the set of repository paths and related signals that should not enter coding agents — including prompts, tool/file reads, shell commands, MCP arguments, and local transcripts. Offsend records that boundary in `.offsend.yml` so the policy is visible, reviewable, and versioned with the project. It is a defense-in-depth layer for everyday agent work, not a guarantee that a path is unreadable forever, and not a cloud secret scanner.

Example policy fragment:

```yaml
# .offsend.yml
exclude:
  - .env*
  - "**/*.pem"
  - secrets/**
```

## Product surfaces

- [Offsend CLI](https://offsend.io/): Audit paths, commit `.offsend.yml`, sync ignore files and hooks, check the local setup. Docs: https://github.com/Offsend/Offsend/blob/main/docs/cli.md
- [Offsend for macOS](https://offsend.io/desktop): Check files, folders, and clipboard text locally before they enter AI tools (Safe Paste and project audits). Bundles the CLI.
- [Offsend Browser Extension](https://offsend.io/extension): Detect and mask sensitive values locally before browser prompts or attached files are sent to ChatGPT, Claude, Gemini, Grok, Perplexity, or DeepSeek.
- [Offsend GitHub Action](https://offsend.io/github-action): CI check (`Offsend/ai-hygiene`) that installs offsend-cli and runs `offsend check` before code lands.
- [Offsend Check](https://check.offsend.io/): Fast online audit of a public GitHub repository without installing the CLI.
- [Offsend Radar](https://radar.offsend.io/): Weekly research on AI-context risk signals across public repositories
- [Offsend vs secret scanners](https://offsend.io/compare/secret-scanners): Offsend vs Gitleaks, TruffleHog, GitHub secret scanning — complementary jobs, not substitutes

## Not a secret scanner

Offsend focuses on what agents can read and pass into supported tools. Path audits and light content checks help set boundaries. It is not a cloud secret scanner, DLP product, or sandbox. Historical leak hunting remains a different job; Offsend is the day-to-day boundary for AI context.

## Limits

- `.offsend.yml` alone does not guarantee a file cannot be read.
- Ignore files are the primary workspace exclusion where tools honor them.
- Runtime gates cover only the hook surfaces each editor exposes — Codex has no file/MCP gates yet, Windsurf cannot seal MCP responses, Claude subagents are not gated. Cloud agents never see local hooks.
- Default posture is local-first; private source does not need to be uploaded to Offsend for core CLI / desktop / extension / Action workflows.

## FAQ (verbatim from https://offsend.io/#answers)

### What does Offsend protect?

Offsend is an open-source, local-first boundary layer for AI coding agents. One committed `.offsend.yml` is the source of truth: `offsend sync` materializes AI ignore files and installs supported hooks. Ignore rules are the primary exclusion. Runtime gates then check prompts, file reads, shell, and MCP on editors that expose those hooks. On Cursor and Claude Code you can seal secrets in MCP responses (and optional sealed file copies) so the agent keeps working without plaintext. Local transcripts can be audited and scrubbed after the fact — that is recovery, not a live gate. Cloud sessions do not run local hooks.

### Is Offsend a secret scanner?

No. Offsend focuses on AI context boundaries — what agents can read and pass into supported tools. Path audits and content checks help you set those boundaries, but Offsend is not a cloud secret scanner or a sandbox.

### Does Offsend upload my code?

No. CLI checks run locally. Repository policies stay in the repo. Local history is audited locally. No cloud scanning is required.

### Does one .offsend.yml guarantee that AI cannot read a file?

No. Offsend is defense-in-depth, not a guarantee. Ignore files are the primary exclusion. Gates cover only the hook surfaces each editor exposes — for example Codex has no file/MCP gates yet, Windsurf cannot seal MCP responses, and Claude subagents are not gated. Cloud agents never see local hooks. Keep secrets out of the repo; use CI `check --policy` for what left the machine.

### Where should I start?

Install the CLI, then `offsend show`, `offsend init`, `offsend protect`, and `offsend sync`. Commit `.offsend.yml`. On the next clone, `offsend sync` restores ignore files and hooks. For a look without installing, use Check on a public GitHub repo.

### What is Radar?

Radar researches AI-context risk signals across public repositories without reading file contents. Visit radar.offsend.io for the latest report.

## Quick start

```bash
curl -fsSL https://install.offsend.io/cli | bash
offsend show
offsend init
offsend protect
offsend sync
offsend doctor
```

## Documentation

- https://github.com/Offsend/Offsend/blob/main/README.md
- https://github.com/Offsend/Offsend/blob/main/docs/cli.md
- https://github.com/Offsend/Offsend/blob/main/SECURITY.md

## Legal

- https://offsend.io/privacy
- https://offsend.io/terms
- https://offsend.io/refund