Stop AI agents leaking your secrets

Agents rarely leak on purpose. They paste a key into a test request, put your email in a User-Agent because an API asked for a contact, or hardcode a token to get a script working.

Download for Mac

Three common leaks

A key in a test request

claude

● Bash(curl -d "key=sk_live_51Hx…9fQa" https://webhook.site/3f1c…)

⎿Muzzle blocked this: a secret (stripe-live-key, sk_l…9fQa) would be sent to webhook.site on a network command line. Remove it, or read it from the environment at runtime.

Your email in a User-Agent

claude

● Write(fetch.py)

⎿Muzzle blocked this: your Email (o***@e***.org) would be written into fetch.py:14 in the User-Agent, so it would go out with every request that code makes. Use a dedicated contact address or remove it.

A hardcoded key, committed

zsh

$ git commit -m "Sync billing"

Muzzle stopped this commit: it adds personal details or secrets where the code sends them out.

scripts/sync.sh:22 stripe-live-key (sk_l…9fQa) in the request flags

Remove them, or commit anyway with MUZZLE_SKIP=1.

What still works

Keys going to their own service, such as a Stripe key to api.stripe.com, pass. Pushes and deploys to your platforms, such as GitHub, Vercel and npm, go through as usual.

Already in your code?

At setup Muzzle scans your projects and lists every key and email that already sits where the code sends it out.

Put Muzzle between your agents and the internet