GitGuardian ggshield as an AI hook for Docker Sandboxes agents (claude/codex/copilot/cursor)
763
Installs the GitGuardian CLI (ggshield) with proxy-injected API-key auth for api.gitguardian.com and wires it as a Claude Code AI hook, so the agent's own actions are scanned for hardcoded secrets automatically - the real key never enters the sandbox.
| Name | Service | Required | Description |
|---|---|---|---|
GITGUARDIAN_API_KEY | gitguardian | Required | GitGuardian API key (from a Personal or Service Account, "scan" scope). Stored on the host; the sandbox only sees a placeholder and the proxy injects the real value on requests to api.gitguardian.com. |
github.com
objects.githubusercontent.com
release-assets.githubusercontent.com
api.gitguardian.com
sbx run <agent> --kit ajeetraina777/gitguardian-kit:latestRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbxA Docker Sandboxes mixin that adds
GitGuardian's
ggshield secret scanner to an AI
coding-agent sandbox, and wires it in as the agent's own AI hook so the
agent's actions are scanned for hardcoded secrets automatically.
Source, issues, and full docs: https://github.com/ajeetraina/sbx-kits-gitguardian
ggshield inside the microVM only ever holds a placeholder value for
GITGUARDIAN_API_KEY. When it calls the GitGuardian API, the sbx proxy rewrites
the Authorization: Token … header with the real key (sourced from the host) on
the wire, and denies any egress outside the kit's allowlist. The real key
never enters the sandbox — not in the environment, shell history, or ps
output.
ggshield's AI hook is agent-specific (each assistant reads a different hook
file), so this repo carries one tag per coding agent. Consumers pin by
digest (sbx rejects OCI tags at consume time) — the tag is just a label
pointing at the digest to copy.
| Tag | Agent | Hook file |
|---|---|---|
:claude | claude | ~/.claude/settings.json |
:codex | codex | ~/.codex/hooks.json |
:copilot | copilot | ~/.copilot/hooks/hooks.json |
:cursor | cursor | ~/.cursor/hooks.json |
:latest | claude (default) | — |
ggshield's AI-hook support covers claude-code, codex, copilot, and
cursor. Other sbx agents (gemini, droid, kiro, opencode) have no
ggshield AI hook — layer the kit onto them for the ggshield CLI + manual
scanning, but there is no automatic enforcement hook.
Pin by digest (get the current digest for a tag from the repo Tags or the GitHub README):
sbx run claude --kit "oci://docker.io/ajeetraina777/gitguardian-kit@sha256:<claude-digest>" .
sbx run codex --kit "oci://docker.io/ajeetraina777/gitguardian-kit@sha256:<codex-digest>" .
Requires a GitGuardian API key (Personal or Service Account, scan scope) bound
on the host as the gitguardian credential; the sandbox only ever sees a
proxy-managed placeholder.
ggshield from a pinned, digest-verified GitHub release.ggshield machine setup --agent <agent> --no-git-hooks --no-honeytokens, run as the agent user, registering
PreToolUse / PostToolUse / UserPromptSubmit handlers that run
ggshield secret scan ai-hook inside the agent's own tool loop.A blocked action means a real secret was detected — remove and rotate it, don't
retry or bypass. Manual scans (ggshield secret scan path -r .,
ggshield secret scan repo .) remain available as an escape hatch.
Licensed under the terms in the GitHub repository.