Fida

What ajipurn/fida MCP server does

The ajipurn/fida MCP server is a local secret-redaction layer for AI coding agents. It scans content returned through its gateway and replaces recognized credentials before the response reaches the model. The underlying command still runs with its original environment, so a task can use a credential without showing the value to the agent.

Fida provides two gateway tools: fida_read for workspace file content and fida_shell for command execution and captured output. It also installs agent steering that directs an agent to use these tools for sensitive content. For Codex and Claude Code, a native-read hook can block a direct read when Fida finds secret material that the native tool cannot redact. Other listed integrations use gateway protection and steering on a best-effort basis.

How it works

By default, file access through the gateway is limited to the workspace. Trusted attachment locations can be added as explicit read roots. Content outside those roots, such as ~/.aws, is covered only by the native-read hook on agents with enforced coverage.

The built-in detector recognizes dotenv assignments, PEM private keys, and high-precision credential patterns for AWS, GitHub, Google, Slack, Stripe, OpenAI, Anthropic, and JWT credentials. Fida prefers precision over recall, so formats outside this catalog can pass through unchanged. If Fida cannot establish that a response is clean, it suppresses the response instead of returning a potentially partial secret.

The gateway does not provide a general command allowlist, approval workflow, OS sandbox, or repository policy engine. Ordinary commands, edits, installs, network access, and approvals remain under the agent and developer's control.

Setup and configuration

Install the binary with the project's shell installer:

curl -fsSL https://raw.githubusercontent.com/ajipurn/fida/main/install.sh | sh

The default destination is ~/.local/bin. Running the installed fida command without arguments starts setup, while fida on [agent] enables protection for one detected agent or all detected agents. Use fida off [agent] to remove it, fida status to inspect coverage and protected-secret counts, and fida scan to assess repository risk without printing secret values. fida scan --fail-on high can make the scan fail at the high-risk threshold.

The installer supports FIDA_VERSION for a pinned release and FIDA_INSTALL_DIR for a different installation directory. A source-based installation is also documented through Cargo or a cloned repository.

Limitations and notes

The ajipurn/fida MCP server protects content only on installed integration paths. Codex and Claude Code can report enforced when their hook and gateway self-test pass; Cursor, OpenCode, GitHub Copilot, Windsurf, Antigravity, and Kiro are listed as best_effort. Actual status may instead be incomplete or inactive.

Fida is not a complete data-loss-prevention system. An agent can potentially bypass steering or hooks, or read through an unmediated native tool. The detector's coverage is also limited to recognized formats. The README recommends pairing Fida with a history scanner such as gitleaks or GitGuardian. The project is described as an MVP, is implemented in Rust 1.85+, and is licensed under MIT.