Happy slice of mcp pizzaMCP.pizza

vigils

MCP.Pizza Chef: duncatzat

Agents that read files, run commands, and paste text into websites can cause real damage before you notice. Vigils sits in the middle: risky actions wait in a queue for your yes or no, passwords and personal details are stripped out before text reaches a model or a log, and every action is written to a searchable record you can review later. A desktop app finds the agent tools already on your machine and protects them, and a Chrome extension covers chat sites.

Coding
Other

Use This MCP client To

Approve risky commands before an agent runs them Stop my passwords and keys ending up in a chat See a full history of what an agent did today Keep an agent out of folders it should not touch Scrub secrets from text before I paste it into ChatGPT

README

Vigils

A local-first control plane for AI agents — see what they do, approve what matters, keep secrets out.

CI Release License: Apache-2.0 Platforms

Website · ▶ Watch the 20s demo · Quick Start · Architecture · Security Model · Documentation

English | 简体中文

AI agents (Claude Code, Codex, Cursor, Zed, Kimi CLI, ZCode, pi, browser assistants) call tools, read files, hit APIs, and paste into web UIs on your behalf. That power is useful — and risky. Vigils sits between your agents and the tools/data they touch, and it is local-first: your prompts, secrets, and audit trail never leave your machine.

   AI agent ──▶  ┌─────────────────── Vigils ───────────────────┐  ──▶  tools / data
 (MCP client)    │  redact → firewall → approve → sandbox → audit │       (MCP servers,
                 └───────────────────────────────────────────────┘        files, APIs, web)

Why Vigils

Four guarantees, enforced locally:

Guarantee How
See what the agent did Every tool call is recorded in a tamper-evident SHA-256 hash-chained ledger with full-text search.
Approve risky actions first Destructive / sensitive calls pause for human review in an Approval Queue, with per-agent policy and scoped grants.
Keep credentials out of prompts / logs / UI A redaction engine strips secrets and PII (hard-fingerprint rules + an optional ML ensemble) before text reaches a model, a log, or the screen.
Contain & roll back The ledger is traceable end-to-end and the sandbox runner is fail-closed by default (Wasm + native + Linux Landlock).

vigils FAQ

Which agents does it cover?
Tools like Claude Code, Codex, Cursor, and Zed, plus browser assistants such as ChatGPT, Claude, Gemini, and Perplexity through the Chrome extension.
Does anything leave my computer?
No — it is built local-first, so prompts, secrets, and the record of what happened stay on your machine.
Can I use this to review what an agent did last week?
Yes — every action lands in a searchable log that is built to make tampering obvious.
Do I need a key or an account?
No — it wraps the agent tools you already use and asks for no key of its own.
How hard is setup?
The desktop app finds your agent tools, backs up their settings, and switches protection on from one button; a command-line version exists for people who prefer it.
Which computers does it run on?
Windows, macOS, and Linux.