🛡️ AegisGate Lens

Privacy-first browser extension that warns you before you hit send.

A free browser extension that catches your Social Security number, passwords, API keys, and prompt injection attacks before they reach an AI company — 100% on-device, zero data leaves your browser.

100% on-device · Zero data leaves your browser · Free · Forever

Found Lens useful? Star the repo ⭐ and tell a colleague — it helps others discover privacy-first AI tooling.

Install · How It Works · ML Detector · Detection · Privacy · Architecture · Releases

We follow GitHub's recommended security practices for open source projects. CodeQL scanning · Secret scanning with push protection · Dependabot alerts & security updates · Protected branches · RFC 9116 security policy · Report a vulnerability →

🛡️ Using AegisGate at work? AegisGate Platform is our server-side gateway — 820 detection patterns (303 canonical + 517 detector adapter), MCP/A2A/ACP protection, 30+ compliance frameworks, and cryptographic attestation. For the 95% of users without enterprise protections, Lens is here. Explore Platform →

Why AegisGate Lens?

Every AI conversation is a potential data leak. A prompt containing an API key, a social security number, or a database credential gets sent in plain text to a third-party LLM — and you can never take it back.

Lens is the browser extension that catches it before you hit send.

Think of it like a spellchecker for privacy — but instead of catching typos, it catches your Social Security number, credit card number, passwords, API keys, and other things you really don't want going to an AI company.

100% on-device. No prompt text, no URLs, no page content ever leaves your browser. Zero telemetry by default.
217 regex patterns + ML. Sub-millisecond regex detection plus ~5-50ms ML inference for adversarial prompt injection.
10 AI providers. ChatGPT, Claude, Gemini, Copilot, DuckDuckGo, Perplexity, Mistral, Grok, DeepSeek, Meta AI.
Fail-visible. Every detection is shown to you — you decide to cancel, edit, or proceed.
Free. Forever. Apache 2.0, no account required, no upsell gate.
Rampart bridge (optional). Relay detected threat signals to AegisGate Rampart's local proxy for cross-layer correlation with network-level detection. Air-gap compatible — no-op when not configured.
IOC pull (optional). Fetch indicators of compromise from Platform's telemetry endpoint for enhanced on-device detection. Air-gap compatible — no-op when not configured.

Installation

It takes 10 seconds. No account needed.

Browser	Link
Google Chrome	Install from Chrome Web Store →
Mozilla Firefox	Install from Firefox Add-ons →

Supported AI tools (10): ChatGPT, Claude, Gemini, Microsoft Copilot, DuckDuckGo, Perplexity, Mistral, Grok, DeepSeek, Meta AI

📦 Install from source (development / testing)

git clone https://github.com/aegisgatesecurity/aegisgate-lens.git
cd aegisgate-lens
# No npm install needed — zero external dependencies

Load in Chrome:

Navigate to chrome://extensions
Enable Developer mode (top right)
Click Load unpacked
Select the aegisgate-lens directory

Load in Firefox:

Navigate to about:debugging#/runtime/this-firefox
Click Load Temporary Add-on
Select manifest.json from the aegisgate-lens directory

What does it look like?

When you're about to send sensitive data, Lens shows a warning banner at the top of the page:

⚠️ AegisGate Lens detected potential risks in your prompt:

🔐 Credit Card Number — A 16-digit card number was detected. Sending this to an AI service may expose your financial data.

What would you like to do?

Cancel — Don't send this prompt

Edit & Resend — Go back and remove the sensitive data yourself

Send Anyway — I understand the risks, send it

The banner is non-blocking — it doesn't prevent you from sending. It just makes sure you know what you're about to share. You're always in control.

Detection Flow

flowchart LR
    User["👤 You type a prompt"] -->|"Keystroke<br/>(debounced 250ms)"| Lens["🛡️ Lens<br/>Content Script"]
    Lens -->|"Regex facets<br/>(sync, ~0.3ms)"| Regex{"217 regex<br/>patterns"}
    Lens -->|"ML facet<br/>(async, ~5-50ms)"| ML["🧠 Char CNN-BiLSTM"]

    Regex -->|"PII detected"| PII["🔒 PII<br/>(77 patterns)"]
    Regex -->|"Secret detected"| Secret["🔑 Secrets<br/>(57 patterns)"]
    Regex -->|"XSS detected"| XSS["💉 XSS<br/>(12 patterns)"]
    Regex -->|"Compliance risk"| Comp["📋 Compliance<br/>(62 patterns)"]
    Regex -->|"OT/ICS detected"| OT["⚙️ OT Protocols<br/>(9 patterns)"]
    ML -->|"Adversarial detected"| Adv["⚠️ ML Adversarial<br/>(score ≥ 0.5)"]
    ML -->|"Suspicious"| Sus["🟡 ML Suspicious<br/>(0.3 < score < 0.5)"]

    PII & Secret & XSS & Comp & OT & Adv & Sus --> Decision{"Any<br/>findings?"}
    Decision -->|"Yes"| Banner["⚠️ Banner<br/>Cancel · Edit · Dismiss"]
    Decision -->|"No"| Pass["✅ Pass-through"]

    style Lens fill:#1e40af,stroke:#3b82f6,color:#fff
    style ML fill:#7c3aed,stroke:#8b5cf6,color:#fff
    style Banner fill:#dc2626,stroke:#ef4444,color:#fff
    style Pass fill:#16a34a,stroke:#22c55e,color:#fff

What It Detects

Lens runs 6 detection facets — 5 regex (synchronous) + 1 ML (asynchronous) — on every keystroke (debounced 250ms).

Facet	What it catches	Example	Patterns	Latency
PII	Email, phone, SSN, credit card (Luhn-validated), DOB, address, driver's license, passport, tax ID, bank account, IP address	`[email protected]`, `4111-1111-1111-1111`	77	~0.3ms
Secrets	API keys (AWS, GitHub, OpenAI, Stripe, Slack), OAuth tokens, RSA private keys, database credentials	`ghp_abc123...`, `AKIA...`, `-----BEGIN RSA PRIVATE KEY-----`	57	~0.3ms
XSS	Cross-site scripting payloads	`<script>alert(1)</script>`	12	~0.3ms
Compliance	OWASP LLM Top 10, MITRE ATLAS, EU AI Act, NIST CSF, ISO 27001, CCPA, LGPD, PIPEDA, POPIA	"patient SSN:", "credit card:"	62	~0.3ms
OT/ICS Protocols	Modbus, DNP3, OPC-UA control manipulation	"Modbus function code 06..."	9	~0.3ms
ML Threat	Adversarial prompt injection (instruction override, roleplay, obfuscated commands)	"Ignore all previous instructions..."	1 model	~5-50ms
Total	—	—	217 regex + 1 ML	—

Security Posture

Metric	Value
Prompt data sent to servers	0 bytes (all on-device)
External dependencies	0 (no npm, no node_modules)
WASM binaries	0 (removed in v0.3.0, pure JS instead)
Telemetry by default	Off (opt-in FP reporting sends hashes only)
Content Security Policy	MV3 strict (`script-src 'self'`; no inline, no remote, no eval, no wasm-unsafe-eval)
Commit signing	Ed25519 on all commits
Vulnerability disclosure	RFC 9116 ([email protected])

Performance

Metric	v0.5.3	v0.3.0	v0.2.0
Regex detection (p99)	<1ms	<1ms	<1ms
ML inference (p50, Chrome est.)	~5-50ms	~5-50ms	n/a
ML inference (p50, Node.js)	~420ms	~420ms	n/a
Model load time	~120ms	~120ms	n/a
Extension size	4.2MB	4.2MB	~2MB
Regex patterns	217	151	86
PII detection (in-scope)	100% (30/30)	n/a	n/a
XSS detection (in-scope)	75% (9/12)	n/a	n/a
Secrets detection (in-scope)	48.6% (18/37)	n/a	n/a
FPR (regex, WildChat)	2.31%	2.31%	2.31%
ML adversarial detection	100% (10/10)	100% (10/10)	n/a
ML benign pass-through	81.8% (9/11)	81.8% (9/11)	n/a

Source: docs/MODEL-CARD.md — detection metrics and evaluation data

ML Threat Detector

v0.5.3 includes a Char CNN-BiLSTM with Attention model that detects adversarial prompt injections — the kind of attacks that regex can't catch (paraphrased instructions, roleplay injection, obfuscated commands).

Property	Value
Architecture	Char CNN-BiLSTM with Attention
Parameters	1,597,570 (1.60M)
Input	Character-level, max 256 chars, Latin-1 vocab (256)
Output	Sigmoid score [0, 1]
Threshold	0.5 (adversarial), 0.3 (suspicious)
Weight format	float16, gzip+base64 JSON (~3.75MB)
Inference	Pure JavaScript (no WASM, no ONNX)
CSP requirement	`script-src 'self'` only

The ML detector runs asynchronously alongside the regex facets. Regex detections appear immediately (~0.3ms); ML detections update the banner when ready (~5-50ms in Chrome). This gives defense-in-depth: regex catches known patterns, ML catches paraphrased and obfuscated variants.

🧠 ML Evaluation Results

Metric	Value
Adversarial detection rate	100% (10/10 prompt injections)
Benign pass-through rate	81.8% (9/11; 2 FPs on creative writing)
Score separation	0.82 (adversarial avg 0.988 vs benign avg 0.171)
Score determinism	100% (20/20 identical calls)

See docs/MODEL-CARD.md for full evaluation data.

How Lens Compares

Capability	Lens	Browser-native warnings	Enterprise DLP
PII detection (77 patterns)	✅	❌	✅
Secret detection (57 patterns)	✅	❌	✅
XSS detection (12 patterns)	✅	❌	⚠️ Web-only
Compliance risk flagging (62 patterns)	✅	❌	⚠️ Limited
ML adversarial detection	✅	❌	⚠️ Rare
Works on 10 AI providers	✅	❌	⚠️ Requires proxy
100% on-device, zero telemetry	✅	✅	❌ Cloud-based
Zero dependencies, no WASM	✅	✅	❌ Requires agent
Free (Apache 2.0)	✅	✅	❌ Proprietary
Fail-visible (user sees every detection)	✅	✅	❌ Silent block

Supported AI Providers

Provider	Hosts
ChatGPT	chat.openai.com, chatgpt.com
Claude	claude.ai
Gemini	gemini.google.com
Microsoft Copilot	copilot.microsoft.com, copilot.cloud.microsoft
DuckDuckGo (Duck.ai)	duck.ai
Perplexity	perplexity.ai, www.perplexity.ai
Mistral Le Chat	chat.mistral.ai, le-chat.mistral.ai
Grok	grok.com, www.grok.com
DeepSeek	chat.deepseek.com
Meta AI	meta.ai

How It Works

Content script is injected into each supported AI provider page (per the MV3 manifest)
On every keystroke (debounced 250ms), the prompt value is read from the textarea
5 regex facets run synchronously: PII (77), Secrets (57), XSS (12), Compliance (62), OT/ICS (9) = 217 patterns
1 ML facet runs asynchronously: Char CNN-BiLSTM detects adversarial prompt injection
PostProcess filters false positives: Luhn validation for credit cards, 4-4-4 CC pattern rejection, ID-label context check
Banner shows with severity color (critical = red, high = orange, medium = yellow, low = blue)
User chooses: Cancel / Edit & Resend / Send Anyway / Dismiss for 24h
Dismissal is stored in chrome.storage.local for 24h

Test Coverage

Suite	Count	Status
Node unit tests (`node:test`)	505	✅ all pass
E2e manifest validation	25	✅ all pass
ML perf/stress tests	12	✅ all pass
Go unit tests (`go test`)	3	✅ all pass
Headless smoke in real Chrome (via CDP)	16	✅ all pass
Platform FPR test (6,500 WildChat prompts)	1	✅ 2.31% FPR
Total	530	✅

Privacy: The 12 Non-Negotiables

AegisGate Lens never sends or stores:

❌ Prompt text (input or output)
❌ URLs
❌ Page content
❌ Personal identifiers (PII is rewritten in your browser, never sent)
❌ Account credentials
❌ Browser fingerprinting
❌ Cross-site tracking
❌ AI provider metadata
❌ Keystroke timing
❌ Mouse movement
❌ Session identifiers
❌ IP addresses (when self-hosted)

The only opt-in path is false-positive reporting: when you click "Submit & Dismiss" on a banner, Lens sends hashed metadata only (detection category, pattern ID, domain hash) — no prompt text, no URLs, no page content. You can dismiss without reporting (no data sent).

See docs/SECURITY.md for the full privacy policy and security model.

Security

Apache 2.0 license (inference code; model weights included but not open source)
Zero external dependencies (no npm, no node_modules, no bundled libraries)
Zero WASM (removed in v0.3.0; pure JS inference)
MV3 strict CSP (script-src 'self'; no inline scripts, no remote code, no eval, no wasm-unsafe-eval)
Ed25519 commit signing on all commits
RFC 9116 vulnerability disclosure (contact [email protected])

See docs/SECURITY.md for the full security model and docs/NO-EXTERNAL-DEPS.md for the dependency policy.

📦 What's New in v0.5.3

33 new PII patterns — international IDs (Brazil CPF, India Aadhaar, UK NHS, Canada SIN, Germany/Spain/France/Italy/Japan national IDs), crypto wallets (BTC, ETH, BNB, LTC, SOL), digital payment IDs (PayPal, Stripe, Venmo, Cash App), international passports and residence permits.
16 new secrets patterns — GitLab, Bitbucket, Linode, DigitalOcean, Rackspace, Salesforce, Shopify, Travis CI, Jenkins, CircleCI, WordPress, npm, PyPI, Supabase, Azure DevOps, Gitea.
8 OT/ICS protocol patterns — Modbus function codes (5), DNP3 control relay operations, OPC-UA method calls and write value (critical infrastructure protection).
10 AI providers supported — ChatGPT, Claude, Gemini, DeepSeek, Meta AI, Perplexity, Grok, Copilot, Mistral, HuggingChat.
Welcome page updated — accurate pattern counts, OT/ICS facet card, v0.5.3 changelog.

📦 What's New in v0.3.2

🔒 23 New SOC Detection Patterns — SWIFT/BIC banking codes (3), CPT/HCPCS medical billing codes (11), and OT/ICS protocol patterns (9: Modbus, DNP3, OPC-UA). Parity with Platform v4.1.0 and Rampart v0.6.1.
🦊 Firefox MV3 Support — Firefox 142+ via Manifest V3 with browser_specific_settings.gecko.
🔧 Dynamic injection fix — Background.js content script file list corrected to match manifest.
✅ 530 tests — 518 passing + 12 skipped (ML perf tests). All green.

📦 What's New in v0.3.0

🧠 ML Threat Detector — Char CNN-BiLSTM with Attention, running in pure JavaScript. No WASM, no ONNX Runtime, no external dependencies. Detects adversarial prompt injections (instruction override, roleplay injection, obfuscated commands) in ~5-50ms.
🔍 DeepSeek + Meta AI — Two new AI providers with live-verified DOM selectors (10 providers total).
📦 6x smaller — Extension reduced from 25MB (WASM) to 4.2MB (pure JS).
🔒 Stricter CSP — script-src 'self' only. No wasm-unsafe-eval, no eval(), no Function().
✅ 504 tests — 492 unit + 12 ML perf/stress tests. All passing.

For Enterprise Teams

AegisGate Lens is the consumer-facing layer. The same team builds AegisGate Platform™ — the server-side gateway with central policy, team-wide analytics, MCP/A2A/ACP/RESPONSE protection, the Trust Framework, MITRE ATLAS enforcement, OWASP LLM Top-10, the EU AI Act Compliance Module, and SIEM export.

Use case	Recommendation
Individual developers, security researchers, journalists, privacy-conscious users	Lens alone (free)
Teams of 2–10 who need a shared detection policy	Lens + Platform (self-hosted, free)
Enterprises needing SIEM, compliance modules, central policy	Platform + Enterprise support (contact us)

Roadmap

v0.6.0: Public benchmark dataset, expanded in-scope efficacy testing
v0.7.0: Third-party security audit (Cure53 / Trail of Bits / NCC Group)

Community & Support

Discord: https://discord.gg/cvJ4QcY9B
X/Twitter: https://x.com/aegisgate
Telegram: https://t.me/+imsWrOY4QpcxYzIx
Mastodon: https://mastodon.social/@aegisgate
Email: [email protected]

License

Apache 2.0 for source code — see LICENSE for the full text. The trained ML model weights are licensed under the Apache License 2.0, same as the source code.

Contributing

See CONTRIBUTING.md.

IP Notice

AegisGate's core technologies are patent pending with the USPTO (Provisional App. Nos. 64/153,573–64/153,577, filed September 12, 2026; 64/174,824, filed October 12, 2026; and 64/180,722, filed October 20, 2026; and 64/184,057, filed October 26, 2026). Source code is © 2024-2026 AegisGate Security, LLC. Licensed under Apache 2.0. Trained ML model weights are licensed under the Apache License 2.0.

🌐 AegisGate Security · 💬 Discord · ✉️ [email protected] · 𝕏 @aegisgate · 📱 Telegram · 🐘 @[email protected]

Made with 🖤 by AegisGate Security developers to secure the AI attack surface.

Name		Name	Last commit message	Last commit date
.githooks		.githooks
.github		.github
dist/aegisgate-lens-v0.5.3/models		dist/aegisgate-lens-v0.5.3/models
distribution		distribution
docs		docs
icons		icons
models		models
src		src
test		test
testkit		testkit
tools		tools
util		util
.gitignore		.gitignore
.gitleaks.toml		.gitleaks.toml
CHANGELOG.md		CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
THANKS.md		THANKS.md
THIRD-PARTY-LICENSES.md		THIRD-PARTY-LICENSES.md
VERSION		VERSION
managed_schema.json		managed_schema.json
manifest.json		manifest.json

Navigation Menu

Repository navigation

About

Repository files navigation

🛡️ AegisGate Lens

Why AegisGate Lens?

Installation

What does it look like?

Detection Flow

What It Detects

Security Posture

Performance

ML Threat Detector

How Lens Compares

Supported AI Providers

How It Works

Test Coverage

Privacy: The 12 Non-Negotiables

Security

For Enterprise Teams

Roadmap

Community & Support

License

Contributing

IP Notice

About

Releases

Sponsor this project

Packages

Used by

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

🛡️ AegisGate Lens

Why AegisGate Lens?

Installation

What does it look like?

Detection Flow

What It Detects

Security Posture

Performance

ML Threat Detector

How Lens Compares

Supported AI Providers

How It Works

Test Coverage

Privacy: The 12 Non-Negotiables

Security

For Enterprise Teams

Roadmap

Community & Support

License

Contributing

IP Notice

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Sponsor this project

Packages

Used by

Contributors

Languages