Secret sweep kit

Scans a repository for committed secrets by pattern and drafts the rotation steps.

Install the kitIncluded in Builder, $19 a month

To install, sign in, or open a free account and add Builder.

Every part, in assembly order

MODELS.yaml is at revision B from October 22: its Claude Code block now sets effort for each step.

Order	Part	What it does	Test	Revision
1	`README.md`AF-SC-02-RM	Setup, what success looks like and the recovery steps	Setup replays in a fresh project	A, Oct 18
2	`DEPENDENCIES.yaml`AF-SC-02-DP	MCP servers and libraries at exact versions	Every pin resolves exactly	A, Oct 18
3	`MODELS.yaml`AF-SC-02-MD	Model, effort and output limit for each harness	One block for each harness	B, Oct 22
4	`AGENTS.md`AF-SC-02-AG	Role, boundaries and stop conditions	Inside its 4,096 B budget	A, Oct 18
5	`RULES.md`AF-SC-02-RU	Numbered rules, checked on every turn	Inside its 3,072 B budget	A, Oct 18
6	`SKILL.md`AF-SC-02-SK	Checked methods, formulas and snippets	Inside its 6,144 B budget	A, Oct 18
7	`TOOLS.json`AF-SC-02-TL	Typed tool schemas with path limits	Every schema validates on load	A, Oct 18
8	`WORKFLOW.yaml`AF-SC-02-WF	Ordered steps, a call budget and recovery	Runs inside its call budget	A, Oct 18
9	`contract_card.json`AF-SC-02-CC	Typed ports, slot ID, refusal codes and checksums	Every SHA-256 checksum matches	A, Oct 18
10	`verifier.py`AF-SC-02-VF	Independent checks, run apart from the worker	Replays the recorded cases	A, Oct 18

Standard files and size budgets: the AgentFoundry blog, October 18, 2026. Part numbers, tests and revisions are sample previews.

What it works with.

Checked with 4 models across 4 harnesses. verifier.py replays the kit’s recorded cases on each one before a release.

Harness	Files it reads
Claude Code	CLAUDE.md, .mcp.json, .claude/settings.json
Codex	AGENTS.md, ~/.codex/config.toml
OpenCode	AGENTS.md, opencode.json
Pi	AGENTS.md, .pi/extensions/secret-sweep.ts

Set it up in your harness.

The same ten files, mounted four ways. Your models, permissions and project stay yours. Or hand the job to your agent with this prompt.

Installed kit files carry the MIT licence: use, change and share them in your own projects. Builder installs kits over MCP, with setup for each harness and every new revision.

Agent prompt: check, then install

Read https://getagentfoundry.si/llms.txt. Get kit AF-SC-02, the secret sweep kit. Check each file against the checksums in contract_card.json, run verifier.py on its recorded cases and show me the result. Set it up in this harness after I say yes.

Claude Code

CLAUDE.md imports AGENTS.md and RULES.md, and a hook runs verifier.py after each edit.

# CLAUDE.md
@AGENTS.md @RULES.md
# .claude/settings.json
# the model block from MODELS.yaml
# PostToolUse hook, Edit|Write
python3 verifier.py

Codex

Codex reads AGENTS.md at the project root, and a WORKFLOW.yaml gate runs verifier.py.

# ~/.codex/config.toml
[mcp_servers.agentfoundry]
url = "https://getagentfoundry.si/mcp"
# project root
AGENTS.md  WORKFLOW.yaml

OpenCode

OpenCode reads AGENTS.md. opencode.json adds the server and the model from MODELS.yaml.

// opencode.json
"mcp": { "agentfoundry": {
  "type": "remote",
  "url": "https://getagentfoundry.si/mcp" } }

Pi

Pi reads AGENTS.md. The kit’s tools load through one extension file.

# extension
.pi/extensions/secret-sweep.ts