harrisahmad.dev

Writing

deadpush: guardrails for AI coding agents that commit your secrets

· updated · 2 min read

AI coding agents are great until they are not: a background run can drop API keys into .env, commit CLAUDE.md scratchpads, or rewrite half a module while you are in a meeting.

deadpush is an always-on guardian for that failure mode.

pip install deadpush
deadpush protect --hardened

The problem it targets

When agents run with broad filesystem and git access, common failure modes include:

  • Hardcoded secrets and “temporary” credentials
  • LLM context / rule files committed by accident
  • Burst writes that create debris faster than you can review
  • Local hooks that a determined agent can bypass unless you also enforce server-side

What deadpush does

  • Realtime watch — monitors the repo and quarantines dangerous writes
  • Same enforcement kernel across daemon, git hooks, and MCP paths
  • Tiers — local harden/sandbox modes, plus CI / pre-receive options so violations cannot merge
  • Safety score — reacts when multiple agents go wild in parallel

Details and threat model live in the repo docs.

How it works

deadpush also stops an agent from destroying work. Inside a deadpush sandbox session, before a destructive git command such as reset --hard or a force-push runs, it takes a validated save point and then blocks the command. In a 48-run ablation this raised the block rate from 0.33 to 0.67 and the share of work preserved from 0.92 to 1.00, with zero false positives.

Architecture — Every agent write path (MCP calls, raw file writes, git) goes through one enforce_content() kernel. A raw file write that breaks a rule is quarantined, its last safe version is restored from git HEAD, and an INCIDENT is pushed to the agent; a proxied MCP call, commit or push that breaks one is refused before it lands. Inside a deadpush sandbox session, a destructive git command (reset –hard or force-push) is handled differently: deadpush takes a validated save point, refuses the command and reports it over GPC. In CI, deadpush scan runs the same kernel on pull requests and pushes to main.

Who it is for

  • Engineers running Cursor / Claude / other agents overnight
  • Teams that want a required status check for secret/debris scans
  • Anyone who has cleaned up an agent-authored commit they did not intend to ship

If you try it and hit a false positive worth teaching the guardian, open an issue or email me.