Your AI coding agents are reading your secrets.
Copilot, Cursor, Claude Code, Cline, Windsurf — every code agent ingests your repos, env files, and credentials. Clevername strips secrets before they leave your machine and gives you a per-agent audit trail of what each one has touched.
API keys land in provider logsAn agent reads .env to debug a build, the file content lands in a prompt, the prompt lands in OpenAI / Anthropic / Google's logs. Now your production keys are in someone else's cold storage.
Agents pull from repos outside scopeCode agents will happily read whatever's in their working directory — including the side repo with customer data, the half-finished M&A workspace, the old monorepo branch with deprecated secrets.
You don't know what each agent has seenWhen a developer leaves, you can audit their git history. When an AI agent leaves, there's no equivalent — unless something governed every call it made.
Secret detection + auto-redactionProvider keys, SSH keys, JWTs, env-style values are detected and stripped before the prompt reaches the model. Held keys can be vaulted automatically into GCP Secret Manager.Learn more →
install-guard CLIOne command wraps Cursor, Claude Code, VS Code, Windsurf, or any IDE that speaks MCP. clevername guard setup <ide> — done.Learn more →
Per-agent chain of custodyEvery prompt, file read, and tool call gets a tamper-evident audit entry tied to the agent identity. When something leaves, you have the receipts.Learn more →
Built for regulated buyers
- ✓SOC 2 Type II (architecture aligned; audit planned 2026)
- ✓GDPR + CCPA
- ✓Self-hosted air-gap option
- ✓BYOK provider keys — never stored in our DB
Govern your first agent today.
Free tier covers individual developers. Pro $29/mo for 25 governed agents.