Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
A local control plane for AI agents — see what they do, approve what matters, keep secrets out. Rust + Tauri + Chrome MV3.
| Date | Stars |
|---|---|
| 2026-07-31 | 300 |
| 2026-08-06 | 300 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
35.0
growth rate 0.00%/day
<div align="center">
# Vigils
### A local-first control plane for AI agents — see what they do, approve what matters, keep secrets out.
[](https://github.com/duncatzat/vigils/actions/workflows/ci.yml)
[](https://github.com/duncatzat/vigils/releases)
[](./LICENSE)
[](#installation)
[Website](https://vigils.ai) · [▶ Watch the 20s demo](https://duncatzat.github.io/vigils/demo.html) · [Quick Start](#quick-start) · [Architecture](#architecture) · [Security Model](#security-model) · [Documentation](#documentation)
**English** | [简体中文](./README.zh-CN.md)
</div>
---
AI agents (Claude Code, Codex, Cursor, Zed, Kimi CLI, ZCode, pi, browser assistants) call tools, read
files, hit APIs, and paste into web UIs on your behalf. That power is useful — and risky.
**Vigils sits between your agents and the tools/data they touch**, and it is *local-first*:
your prompts, secrets, and audit trail never leave your machine.
```
AI agent ──▶ ┌─────────────────── Vigils ───────────────────┐ ──▶ tools / data
(MCP client) │ redact → firewall → approve → sandbox → audit │ (MCP servers,
└───────────────────────────────────────────────┘ files, APIs, web)
```
## Why Vigils
Four guarantees, enforced locally:
| Guarantee | How |
|---|---|
| **See what the agent did** | Every tool call is recorded in a tamper-evident **SHA-256 hash-chained ledger** with full-text search. |
| **Approve risky actions first** | Destructive / sensitive calls pause for human review in an **Approval Queue**, with per-agent policy and scoped grants. |
| **Keep credentials out of prompts / logs / UI** | A **redaction engine** strips secrets and PII (hard-fingerprint rules + an optional ML ensemble) *before* text reaches a model, a log, or the screen. |
| **Contain & roll back** | The ledger is traceable end-to-end and the **sandbox runner is fail-closed by default** (Wasm + native + Linux Landlock). |
## Features
- **🔒 Tamper-evident audit ledger** — SQLite + SHA-256 hash chain; every event links to the
previous one, so tampering is detectable. FTS5 full-text search over the redacted trail.
- **🛡️ Default-deny firewall** — tool calls are gated by a Rust policy DSL; per-agent rules;
OAuth scope allow-lists for remote MCP. Nothing runs unless allowed.
- **✅ Human-in-the-loop approval** — risky effects (file writes, network, destructive ops)
pause for review. Grants can be scoped (once / this-session).
- **🙈 Secret & PII redaction** — hard-fingerprint detection for 13+ credential classes
(GitHub PAT, Stripe keys, Google/GitLab tokens, DB URLs, …) plus an optional multilingual
ML ensemble; a fail-closed merge layer decides what to mask.
- **🎟️ Secret lease broker** — short-lived credential leases injected only into the child
process that needs them; plaintext is never persisted.
- **📦 Sandbox runner** — one-shot tool execution in Wasm (Wasmtime) or native processes,
with **Linux Landlock LSM** filesystem isolation and `env_clear` so children don't inherit
your environment. Fail-closed by default.
- **🔌 MCP gateway** — sits in front of MCP servers over **stdio and HTTP**; descriptor
pinning with drift detection (alerts when a tool's definition changes); bare-command stdio
upstreams (`npx`/`node`/`python`) resolve via host PATH before sandboxing.
- **🖥️ Desktop app — protection in a few clicks** (Tauri 2 + Vue 3). Open the **Aegis
command deck** and click **Deploy Guardian**: Vigils finds every AI agent on the machine,
backs up their configs, wires hook + MCP-gateway protection into all of them, and lights up
per-agent status — no terminal, no hand-edited files,Excerpt of 21,508 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:7b303904b4d24ba5, llm:Repository topics and description: 'agent-security, ai-agents, audit-log, desktop, llm, local-first, pii, rust, sandbox, tauri' and description: 'A local control plane for AI agents — see what they do, approve what matters, keep secrets out.'
matched fp:7b303904b4d24ba5, llm:Repository topics and description: 'agent-security, ai-agents, audit-log, desktop, llm, local-first, pii, rust, sandbox, tauri' and description: 'A local control plane for AI agents — see what they do, approve what matters, keep secrets out.'
matched fp:7b303904b4d24ba5, llm:Repository topics and description: 'agent-security, ai-agents, audit-log, desktop, llm, local-first, pii, rust, sandbox, tauri' and description: 'A local control plane for AI agents — see what they do, approve what matters, keep secrets out.'
matched fp:7b303904b4d24ba5, llm:Repository topics and description: 'agent-security, ai-agents, audit-log, desktop, llm, local-first, pii, rust, sandbox, tauri' and description: 'A local control plane for AI agents — see what they do, approve what matters, keep secrets out.'