Show HN: Secret Guard – a local LLM gateway; keys never leave your machine Developer luochen1990 released Secret Guard, a local LLM gateway that replaces secrets in outbound agent requests with equal-length, same-charset mock values and restores the real credentials when responses return, so LLM vendors never see actual passwords, private keys, tokens or cookies. The tool requires only pointing an agent harness's API base URL at the local gateway, and supports per-secret strategies of redact/restore (default), "reject" (returns 503 when the secret appears) and "placeholder" (swaps in a never-restored [REDACTED:{id}] token that doubles as a canary). Version 0.1.0 ships as static musl binaries for Linux x86_64 and ARM64 with SHA256 checksums, plus a Nix flake, and a WebUI records each forward showing exactly what the LLM saw. A lightweight local LLM gateway: outbound requests have their Secrets replaced with equal-length realistic Mocks; responses are restored back to real values on the way in — the LLM never touches a real Secret, while your Agent tools keep working. Docs https://secret-guard.lambda.lc/en/ · Download https://secret-guard.lambda.lc/en/download/ · Quick Start https://secret-guard.lambda.lc/en/tutorial-quick-start/ · Protocol Support protocol-support · 简体中文 https://github.com/luochen1990/secret-guard/blob/master/README.zh-CN.md The local Agent Harness claude-code / opencode / hermes-agent and friends does your work by stuffing material wholesale into the prompt — code, configuration, terminal output, along with the passwords, private keys, tokens, and cookies in them, all delivered to the LLM vendor's servers. Once that data leaves your machine, it is out of your control: it may end up in LLM vendor logs, be used for model training, or leak in a breach. And "never put Secrets in the context" is simply not viable in Agent workflows — credentials are exactly what an Agent tool needs to act on real systems on your behalf. Secret Guard resolves this tension: your Agent tools keep working with your Secrets, while the LLM never touches a real value. The only integration cost is one line: point your Agent tool's API base URL at the local gateway, and traffic flows through it to the LLM vendor: Outbound: Agent tool ──real Secret──► secret-guard ──realistic Mock──► LLM vendor Return: local tools ◄──real Secret── secret-guard ◄──Mock reply──── LLM vendor Redact / Restore both happen locally, transparent in both directions - Outbound Redact : Secrets in requests bound for the LLM are replaced with equal-length, same-charset realistic Mocks default strategy — the LLM keeps working with them, none the wiser. - Return Restore : when LLM responses come back tool-call arguments included , Mocks are restored to real values — a curl command carrying a Secret lands on your machine with authentication passing as usual. - Per-secret strategy : redact/restore above is the default; a secret can instead be configured strategy = "reject" to refuse forwarding 503 the moment it appears in a request — for credentials that must never leave the machine — or strategy = "placeholder" to swap it for an explicit REDACTED:{id} token that is never restored. Every placeholder secret doubles as a canary: if its real value ever shows up in an LLM response, you get an alert WARN log + WebUI timeline badge, no secret values in the alert while the response itself passes through untouched. - Built-in protection for Secret Guard's own credentials : the sg API tokens it issues and the provider API keys you register with it are protected automatically — zero configuration, effective the instant a token is created. If a prompt injection talks your Agent into pasting its own gateway token into the conversation, the LLM vendor only ever sees an equal-length Mock. The same request, before and after it leaves the machine captured from a real run; only the token value is fictional : Agent Harness sends: GITHUB TOKEN=ghp 0123456789abcdefghijklmnopqrstuvwxyz LLM vendor receives: GITHUB TOKEN=2 9rr 61dr1lmv2wf15aotyyt262l3t9 2pt4uih A quick tour of the WebUI — session timeline, the LLM's-eye request view with the Mock highlighted, and the restored real value on the response side: Every forward can be inspected in the WebUI's Records page session timeline + request detail, with Secret locations highlighted as the Mock — i.e. exactly what the LLM saw : Binary archives Linux x86 64 / ARM64, fully static musl, with SHA256 checksums : https://github.com/luochen1990/secret-guard/releases archive name pattern: secret-guard-