Secret & PII scanning

Polyglot scans the output of every tool call - shell commands, file reads, web fetches, MCP tools - for secret-looking values before that text is added to the model’s context (and the transcript, and the audit log). It’s on by default in warn mode: the text the model sees is unchanged, you just get a note.

> run: aws configure get aws_secret_access_key
⏺ bash(aws configure get aws_secret_access_key)
⚠ 1 secret-looking value in bash output (aws-key) - not redacted (set redaction.mode: "redact")

This is content-based and complements the path-based protection already in place: a file named like a secret (.env, *.pem, anything under .ssh/) still prompts for approval before it’s read at all - see Always-prompt paths. Scanning catches the cases that slip past that: a key pasted into a command’s output, or one living in a plainly-named config file.

warn vs redact

redaction.mode	What the model sees	When
"warn" (default)	the value, unchanged, plus a ⚠ note in the transcript	you want visibility without breaking a debugging session
"redact"	the value replaced with [redacted:<label>]	the model genuinely should not see the secret

{ "redaction": { "mode": "redact" } }

POLYGLOT_REDACT_OUTPUT=1 forces redact mode for one run; POLYGLOT_NO_OUTPUT_SCAN=1 turns scanning off entirely.

What’s matched

Always: AWS access keys, sk-… / sk-ant-… keys, GitHub tokens, Bearer … tokens, PEM private-key blocks, and SOMETHING_KEY = "…" style assignments.

With redaction.pii: true: email addresses, US SSNs, Luhn-valid card numbers, and E.164 phone numbers. Off by default because these are noisier - a git log is full of email addresses.

Your own patterns

{
  "redaction": {
    "extraPatterns": [
      { "label": "internal-token", "regex": "\\bINT-[A-Z0-9]{12}\\b" }
    ]
  }
}

Each regex is a JavaScript source string, compiled with the g flag. One that doesn’t compile is dropped with a startup warning - it never stops Polyglot from loading.

Where it applies

• Every built-in tool, every MCP tool, and work delegated to sub-agents and agent definitions.
• The audit log records a content_findings entry - pattern labels and counts only, never the matched text, so the log stays safe to ship off-machine even in warn mode.
• /status shows the current mode (scanning: warn tool output / redact / off).

Reference

settings.json	Default
redaction.scanOutput	true	scan tool output at all
redaction.mode	"warn"	"warn" or "redact"
redaction.pii	false	also scan email / SSN / card / phone
redaction.extraPatterns	[]	{ label, regex } entries

Env
POLYGLOT_NO_OUTPUT_SCAN=1	turn scanning off
POLYGLOT_REDACT_OUTPUT=1	force mode: "redact"

Scanning is a safety net, not a guarantee - it catches common formats and will miss bespoke secrets. For anything sensitive, keep it out of the working tree and off the command line. See Data handling.