pastewatch

Detect and obfuscate sensitive data in text using deterministic regex methods.

5|Updated Feb 5, 2026
One-click install
npx skills add https://github.com/ppiankov/pastewatch --skill pastewatch
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: pastewatch
Source: https://github.com/ppiankov/pastewatch/tree/main/docs
Command: npx skills add https://github.com/ppiankov/pastewatch --skill pastewatch

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Pastewatch provides deterministic detection and obfuscation of sensitive data in text content, ensuring secrets do not leak into AI systems during development workflows.

Core Features & Use Cases

  • Deterministic regex-based detection and obfuscation for text content.
  • Local-only, no-ML approach with MCP integration and guard hooks.
  • Suitable for code, configuration files, documentation, and chat prompts that may contain secrets.

Quick Start

Run pastewatch-cli to scan a sample text containing secrets and review the obfuscated output.

Frequently Asked Questions about pastewatch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent secrets from leaking into AI agent workflows?

To prevent secrets from leaking into AI agent workflows, you can use deterministic regex-based detection and obfuscation to scan text content and redact sensitive data before it reaches external systems.

What's the best way to redact sensitive data in code and configuration files?

The best way to redact sensitive data in code and configuration files is applying deterministic regex-based obfuscation, which accurately detects and masks secrets locally without relying on machine learning models.

Does pastewatch process text content locally or send data to external services?

Pastewatch processes text content entirely locally, ensuring that sensitive data remains on your machine during the secret detection and obfuscation process without sending anything to external services.

Can I integrate secret redaction directly into my document workflows using MCP?

You can integrate secret redaction into document workflows using optional MCP redaction and guard hooks, which provide safe integration for scanning and obfuscating secrets in chat prompts and documentation.

How do I scan a sample text for secrets using the command line?

To scan a sample text for secrets using the command line, run pastewatch-cli to process the text content and review the obfuscated output to verify that sensitive data has been properly redacted.

When should I use deterministic regex detection over ML-based secret scanning?

You should use deterministic regex detection over ML-based secret scanning when you need predictable, local-only obfuscation of sensitive data in codebases, configuration files, and AI prompts without relying on external ML inference.