NewAegis Shield v1 is here

Your code, without the exposure.

Strips secrets from your code before AI sees it. What comes back is exactly what you'd expect.

config.ts — Takumo IDE
config.ts
server.ts
auth.ts
1import { Pool } from 'pg'
2import { createClient } from 'redis'
3
4const dbConfig = {
5 host: "prod-db.acme.internal:5432",
6 user: "admin",
7 password: "s3cr3t_p@ss!",
8 apiKey: "sk_live_4eC39HqLyjWD",
9}
10
11const redis = createClient({
12 url: "redis://10.0.1.5:6379",
13})
14
15export async function getPool() {
16 const pool = new Pool(dbConfig)
17 await pool.connect()
18 return pool
19}
Shield
·
Sentinel
·TypeScript·UTF-8
Ln 7, Col 24

Your secrets never reach

The problem

Every time you paste code into an AI, you're making two bets.

That nothing sensitive goes out.

API keys
Database passwords
Internal hostnames
Connection strings

That what comes back is safe.

SQL injection
Hardcoded secrets
License violations
Vulnerable dependencies

You're probably losing both.

Unlike anything else

Built different on purpose

Deterministic, not random

Same input always produces the same token. Cross-file consistency by design.

password = "s3cr3t"

password = "__TAKUMO_v1_SECRET_a1b2c3__"

Under 100ms

Detection and tokenization for a thousand-line file. You won't notice it.

<100ms

Learns your codebase

Sentinel Brain studies your repositories, conventions, and past incidents. Day one it knows your structure. Month three it catches what your senior engineers would.

Day 1Codebase structure
Month 1Team conventions
Month 3What seniors correct
Year 1Better than most engineers

Both directions, one platform

Shield protects what goes out. Sentinel validates what comes back. Cloud gives your team full visibility. No gaps.

Aegis Shieldoutbound
Sentinelinbound
Takumo Cloudvisibility
How it works

Both directions. Zero blind spots.

Aegis Shield protects what goes out. Sentinel validates what comes back. Two layers, one seamless experience.

Outbound · Aegis Shield
config.ts3 secrets detected
1const config = {
2 host: "prod-db.internal.io",
3 key: "sk_live_4eC39HqLyjWD",
4 url: "redis://admin:pwd@10.0",
5}

1. Scan

Your code is analyzed for API keys, connection strings, private URLs, and anything that shouldn't leave your machine.

config.tsProtected
1const config = {
2 host: "__TKM_HOST_a1b2c3__",
3 key: "__TKM_KEY_d4e5f6__",
4 url: "__TKM_URL_g7h8i9__",
5}

2. Replace

Every sensitive value becomes a safe, deterministic token. Your code structure stays intact, only the secrets disappear.

config.tsRestored
1const config = {
2 host: "prod-db.internal.io",
3 key: "sk_live_4eC39HqLyjWD",
4 url: "redis://admin:pwd@10.0",
5}

3. Restore

The response comes back, tokens are swapped for real values, and you get working code. No manual steps.

Inbound · Sentinel
response.tsResponse intercepted
1export function getPool() {
2 return new Pool({
3 host: "prod-db.acme.internal",
4 password: "admin123",
5 })
6}

4. Intercept

Every AI response is captured before it reaches your editor. Sentinel sees it first.

sentinel2 issues found
No SQL injection
MIT compatible
Hardcoded credential (line 4)
Missing error handling
No known CVEs
3 passed · 2 warnings

5. Validate

Security, licenses, and patterns checked against OWASP, your compliance rules, and your codebase.

response.tsValidated
1export function getPool() {
2 return new Pool({
3 host: "prod-db.acme.internal",
4 password: process.env.DB_PASS,
5 idleTimeoutMillis: 30000,
6 })
7}

6. Deliver

Only validated code reaches your workspace. Issues flagged inline. Tokens restored to real values.

What we detect

50+ patterns today. More every week.

Cloud

AWS
GCP
Azure

Payments

Stripe
Plaid
Square

Databases

PostgreSQL
MySQL
MongoDB

Auth

JWTs
OAuth
Sessions

Dev Tools

GitHub
npm
Vercel

Crypto

RSA keys
SSH keys
PGP keys

Internal

Hostnames
Private IPs
.internal

Infra

Docker
Kubernetes
Terraform

And many more.

The Platform

Four layers, zero gaps

Each layer handles one job and does it well. Together they cover every point where code meets AI.

Aegis Shield

Scans your code for secrets and swaps them with safe tokens before the request leaves your machine. The AI never sees your real credentials.

config.tsOriginal
1const config = {
2 host: "prod-db.internal",
3 key: "sk_live_4eC39H...",
4}
Shield ↓
1const config = {
2 host: "__TKM_HOST_a1b2__",
3 key: "__TKM_KEY_d4e5__",
4}

Sentinel

Checks every AI response before it reaches your editor. If something looks wrong, it gets flagged. You review what matters, skip what doesn’t.

sentinel
Validating
No injection patterns
MIT compatible
Hardcoded credential (ln 4)
Follows team conventions
No known CVEs
4 passed · 1 warning

Sentinel Brain

Indexes your repositories and learns how your team writes code. Naming conventions, architecture decisions, the stuff that takes a new hire months to pick up.

brain
Learning
Codebase Structure
src/db/Pool pattern
src/auth/JWT + refresh
src/api/REST handlers
Conventions Detected
Use ConnectionManager
No raw SQL in handlers
Env vars via config.ts
Confidence
82%

Takumo Cloud

Full visibility into what’s happening across your team. Who triggered what, when, and what got caught. Audit logs that make compliance straightforward.

cloud
Connected
Tokens
12,847
Validations
847
Members
3
Activity
config.tsShield5 secrets tokenized2m
auth.tsSentinelpassed5m
db.tsBrain+1 pattern8m
SOC 2Active
What you'll see

Built for how you actually work.

config.ts
Sentinel
1const config = {
2 host: "prod-db.internal",
3 password: "admin123",
4 apiKey: "sk_live_4eC39HqLyj",
5}
6
7export async function getPool() {
8 const pool = new Pool(config)
9 return pool
10}
Ready

Issues caught before you commit. Fixes suggested inline.

What your team sees

One dashboard. Full visibility.

Who triggered what, when it happened, and what got caught. The whole picture without touching a log file.

Takumo Cloud
Live
0
Shielded
0
Blocked
0
Exposed
Top patterns
API keys 62%/DB creds 24%/Conn strings 14%
Activity (24h)▲ 12% from yesterday
Recent
4 repos connected|Last sync 2s ago
v1.4.2
Why now

In 18 months:

Auditors will ask how you govern AI-generated code.

The first major breach will trace back to an AI suggestion.

Companies without governance will be uninsurable.

The question isn't whether you'll need this.

It's whether you'll have it in time.

Be ready before you need to be.

Early access is open.