Inside your AI agent

agentprint install finds the AI coding agents on your computer and arms each one: it adds three things.

• A hook that runs before the agent’s shell commands. Only package publishes (npm, pnpm, yarn and bun publish, uv publish, twine upload, changesets, lerna, and so on) and git push are checked. Everything else runs untouched.
• An MCP server (agentprint mcp) with the tools check_package, check_push, scan_secrets and explain_finding, so the agent can check on its own.
• A short note in the agent’s global instructions: check before publishing or pushing, and never print a key.

Together, the hook and the check it runs are the tripwire. See What install changes for the exact file each agent gets.

What the agent reads

When a publish would leak, the agent gets a brief: the verdict first, then fix steps it can do itself, then what only a person can do. This is the brief, shortened:

agentprint: BLOCK — 2 problems to fix before publishing
[1] critical AP002 Secret in agent file inside package (claude-code)
    where: "my-app-1.0.0.tgz!.claude/settings.local.json" line 4
    fix:
      - Delete the key from the source file ".claude/settings.local.json" in the project (line 4) ...
    ask_human:
      - Rotate the OpenAI API key that starts "sk-p…(len 56)": revoke it and create a new one at ...
[2] high AP006 Agent file would ship in package (claude-code)
    fix:
      - Add the line ".claude/" to .npmignore in the package folder ...
Do every fix step, tell the human each ask_human item, then re-run the same agentprint check.

The key appears masked: the first four characters and the length. A full key is never printed.

Install shows its changes first

Before it writes anything, install prints the lines it adds to each file. It backs the file up in ~/.agentprint/backups. Running it twice changes nothing.

Use agentprint install --dry-run to see the changes and write nothing.

To undo it: agentprint uninstall takes out only what agentprint added. Add --agent codex to disarm one agent. A file you have not touched since comes back byte for byte.

Good to know

• Codex runs a new hook only after you trust it. Type /hooks in Codex once after installing.
• Hermes Agent asks before it runs any new hook, and agentprint never approves its own. Start hermes chat once and accept it. Until then, and in gateway or cron runs that never ask, the hook is off. The MCP server still works.
• Hooks need macOS or Linux. On Windows, only the MCP server and the note are installed for now.
• agentprint only ever blocks, never approves. Your agents’ own approval rules still apply. If agentprint itself fails, the command runs, with a note that it could not check.
• Spotting a publish is best effort. agentprint reads the command line. It is not a shell. It follows cd, &&, bash -c, package scripts, workspaces and release tools. A publish hidden in a Makefile, a script file or a heredoc can slip past, though the note still tells the agent to check. When agentprint is unsure what would be uploaded, it says “could not check”, never “OK”.

See which agents are armed with agentprint status.