deadpush: guardrails for AI coding agents that commit your secrets
Published:
AI coding agents are great until they are not: a background run can drop API keys into .env, commit CLAUDE.md scratchpads, or rewrite half a module while you are in a meeting.
deadpush is an always-on guardian for that failure mode.
pip install deadpush
deadpush protect --hardened
The problem it targets
When agents run with broad filesystem and git access, common failure modes include:
- Hardcoded secrets and “temporary” credentials
- LLM context / rule files committed by accident
- Burst writes that create debris faster than you can review
- Local hooks that a determined agent can bypass unless you also enforce server-side
What deadpush does
- Realtime watch — monitors the repo and quarantines dangerous writes
- Same enforcement kernel across daemon, git hooks, and MCP paths
- Tiers — local harden/sandbox modes, plus CI / pre-receive options so violations cannot merge
- Safety score — reacts when multiple agents go wild in parallel
Details and threat model live in the repo docs.
Who it is for
- Engineers running Cursor / Claude / other agents overnight
- Teams that want a required status check for secret/debris scans
- Anyone who has cleaned up an agent-authored commit they did not intend to ship
Links
- GitHub: harris-ahmad/deadpush
- Install:
pip install deadpush· PyPI - Related tools: gitpull, ChatLiberate
If you try it and hit a false positive worth teaching the guardian, open an issue or email me.