01
Is this file a secret?
.env files, private keys, certificates and service-account files are replaced with a one-line notice, so their contents never reach the model.
Product · Safety, security and focus
Guardian
The boundary behind every action.
Coding agents read files and run commands on their own. The Guardian watches what they reach for, keeps what is sensitive out of the model, stops the commands you cannot undo, and tells you when a session is going in circles.
Start free trialIn Cursor, Claude Code and Codex, on your machine.
Free
on every plan, the free tier included. Secret and command checks keep running even while OptiFlume is paused.
10
kinds of key and token caught in any file the agent reads, from AWS keys to database connection strings, and kept out of the model.
90 days
of catches in an audit log on your machine: what, where and what it did. Never the secret itself.
The kinds of secret, the file types and the commands it looks for are listed in full in the docs. Guardian docs →
Four checks, before the agent acts.
Each time the agent reads a file or runs a command, on your machine, before anything reaches the model or the shell.
02
Is there a secret inside it?
A file holding API keys, tokens, database connection strings, personal details, card numbers or bank details is kept out too: the agent is told why, and the secret never reaches the model.
03
Can this command be undone?
rm -rf, force-pushing over history, hard resets, dropping a table, piping a download into a shell: a warning first, or a block if you choose.
04
Is the session going in circles?
The same fix failing again, or a long chat losing track: it says so, and suggests a fresh start or a more capable model.
What the agent gets
- Reads .env
[OptiFlume Guardian] Stopped the agent from reading .env: it is a sensitive file (files like this hold keys and passwords). The agent will ask you in chat; reply "allow" to let it read the file once. - Reads config/deploy.yml
[OptiFlume Guardian] Stopped the agent from reading config/deploy.yml: it contains a GitHub token. The agent will ask you in chat; reply "allow" to let it read the file once. - Runs rm -rf ./dist
[OptiFlume Guardian] Stopped the agent because it deletes dist, which existed before this session. The agent will ask you in chat; reply "allow" to let it go ahead once.
Before, and with OptiFlume.
Before
With OptiFlume
BeforeThe agent reads your .env, and the keys go to the model.
WithSecret files become a one-line notice before the agent reads them.
Beforerm -rf, on the agent's own initiative.
WithA warning before it runs, or a block if you choose. The agent sees why and takes another route.
BeforeApproving every command, or trusting the agent blindly.
WithA safety net for the commands that can't be undone, whichever way you work.
BeforeAn hour in a doom loop before you notice.
WithThe watchdog calls it out, and suggests a fresh start or a stronger model.
BeforeNo record of what the agent reached for.
WithEvery catch in a log on your machine: what, where and what it did.
01
Secrets stay out of the model
Files that hold credentials, such as .env files, private keys and service-account files, are replaced with a one-line notice before the agent reads them. Any other file holding API keys, tokens, database connection strings, personal details, card numbers or bank details is kept out the same way, and the agent is told why.
02
Commands you can't undo
Destructive shell commands are flagged before they run: rm -rf, force-pushing over history, hard resets, dropping a database table, or piping a download straight into a shell. A warning by default, or blocked if you choose; the agent sees why and takes another route.
03
Your focus, too
The same fix failing again, or a long chat losing track: the session watchdog notices and says so, and suggests a fresh start or a more capable model. Advice, never a block.
04
Every catch on the record
Each intervention is written to a log on your machine: what it caught, where, and what it did. Never the secret itself.
The Guardian works on every plan, the free tier included. Its secret and command checks keep running even while OptiFlume is paused; the session watchdog runs whenever OptiFlume is on.
The same in every tool.
In Cursor, Claude Code and Codex, in VS Code and the terminal: on by default from the moment you install, with nothing to set up.
- Cursor
- Claude Code
- Codex
Questions.
In the docs: Guardian docs · Working memory and session watchdog · Security
All questions →Is it really free?+
Yes. The Guardian runs on Pro, the trial and the free tier. Its secret and command checks keep running while OptiFlume is paused; the session watchdog pauses with OptiFlume and resumes when you turn it back on. While nobody is signed in on the Mac, OptiFlume does nothing at all, the Guardian included.
Will it get in the way of my work?+
By default it warns and the command still runs; blocking is your choice. Files and commands you trust can be allow-listed. If the Guardian itself fails, the read or command goes ahead unchanged.
Does it catch everything?+
No. It recognizes common secret formats and file names: a safety net, not a replacement for keeping secrets out of your repository.
What does the audit log record?+
Every file kept out, secret found, warning and block, kept on your machine for 90 days. It records the file path or the start of the command, never the secret itself.
The other systems, in the same install
Token optimizer
Efficient Router →
The right model and effort for every prompt, switched where you can see it.
Context management & collaboration
Context Manager →
Long sessions keep their goals, decisions and dead ends through compactions and switches.
Learns how you work
Adaptive Intelligence →
Reads your code and your session, and learns from every choice you overrule.
Start with your next prompt.
Install OptiFlume and the Guardian is on, free for good. Pro is free for 30 days, no card.
macOS 11+ · Apple silicon and Intel · Signed by OptiFlume, notarized by Apple · Never locks you out · Uninstall with one command