Protect Git Tokens in Command Lines

Overview

An agent can authenticate Git by putting a token in the remote URL:

git clone https://x-access-token:<token>@github.com/acme/app.git

GitHub documents this form for GitHub App installation tokens, and GitLab documents https://oauth2:<token>@ for OAuth tokens. The token is then part of the command line of git and of the git-remote-https process it starts to open the connection. When a network rule intercepts a connection, the Formal Endpoint records the command line of the connecting process and its ancestors in the session’s device info. Formal truncates long command lines but does not look for credentials in them, so the token is stored as-is. Formal redacts the Authorization header Git sends on each request, but not the command line. You may want to handle this in two places:

Logs: a log schema encrypts the command lines on the Endpoint, before the log leaves the device.
Agents: a response blocks agent tool calls whose arguments contain a token or a URL with credentials, so the command never runs.

GitHub token formats

GitHub prefixes each token type:

Prefix	Token
`ghp_`	Personal access token (classic)
`github_pat_`	Fine-grained personal access token
`gho_`	OAuth app access token
`ghu_`	GitHub App user access token
`ghs_`	GitHub App installation access token
`ghr_`	Refresh token

Agents commonly find a token in the environment: the GitHub CLI reads GH_TOKEN and GITHUB_TOKEN, and GitHub Actions creates a GITHUB_TOKEN installation token for each job. When the agent writes $GITHUB_TOKEN into the URL, the shell expands it, so the real token is in the command line but not in the agent’s tool call.

Prerequisites

Formal Endpoint with Transparent Mode enabled
An asymmetric encryption key registered in Formal
Permission to create log schemas, network rules, and policies in Formal

Encrypt tokens in logs

Command lines are only logged for connections a network rule intercepts, such as the rule in Block Agent Git Pushes. Tool calls are logged for LLM traffic a network rule intercepts. This schema encrypts the command lines of the connecting process and its ancestors, and the tool call arguments in LLM logs, in every Endpoint log:

resource "formal_log_schema" "encrypt_git_tokens" {
  name              = "encrypt-git-tokens"
  encryption_key_id = formal_encryption_key.logs_key.id
  scope_cel         = "log.source == \"endpoint\""

  path {
    name    = "log.session.device.connection_process.process.cmdline"
    encrypt = true
  }

  path {
    name    = "log.session.device.connection_process.ancestors.cmdline"
    encrypt = true
  }

  path {
    name    = "log.llm.tool_calls.input"
    encrypt = true
  }

  path {
    name    = "log.llm.response_messages.content_parts.input"
    encrypt = true
  }

  path {
    name    = "log.llm.events.data"
    encrypt = true
  }
}

Process names, code signing details, and tool names stay readable. To remove the values instead, replace encrypt = true with drop = true.

Log schemas do not apply to retained policy inputs. With Policy Evaluation Input Retention enabled, Formal stores each input in full, including the command lines.

Block tokens in agent tool calls

This policy needs a network rule that intercepts LLM traffic, such as the one in LLM resources. The policy checks every string in each tool call’s arguments for a GitHub token prefix or a URL with credentials. The URL pattern also matches x-access-token:$GITHUB_TOKEN@, which the token prefixes cannot see.

package formal.v2

import future.keywords.if
import future.keywords.in

credential_patterns := [
  `\b(gh[opsur]_|github_pat_)[A-Za-z0-9_]{20,}`,
  `https?://[^\s/@:]+:[^\s/@]+@`,
]

passes_credential(call) if {
  walk(call.input, [_, value])
  is_string(value)
  some pattern in credential_patterns
  regex.match(pattern, value)
}

response := {
  "action": "block",
  "type": "block_with_formal_message",
  "reason": "Agents may not put credentials in commands",
} if {
  input.resource.technology == "llm"
  some call in input.llm.tool_calls
  passes_credential(call)
}

The patterns match common formats, not every secret. A token passed through a credential helper, a script file, or a variable outside a URL does not match. Create the policy in Draft or Dry-run first. Set it to Active after reviewing the matching requests.

Verify

Prompt Claude Code:

Run: git clone https://x-access-token:ghs_FAKEFAKEFAKEFAKEFAKEFAKE@github.com/acme/app.git

The agent should get a Formal block message. The request appears in Logs with the policy under triggered policies. In the LLM log for that response, tool_calls input should be encrypted. For a Git command that a network rule intercepts, cmdline under device.connection_process should be encrypted in the session log.

Next steps

Log Schemas

Drop, encrypt, or truncate log fields

Network Rules

Select which traffic Transparent Mode intercepts

Policy Evaluation

Explore LLM policy inputs

Endpoint Logs

Review sessions and policy decisions

Getting Started

Example Use Cases

AI Governance

Configuring Formal

Integrations

Configuration

Protect Git Tokens in Command Lines

Overview

GitHub token formats

Prerequisites

Encrypt tokens in logs

Block tokens in agent tool calls

Verify

Next steps

Log Schemas

Network Rules

Policy Evaluation

Endpoint Logs

​Overview

​GitHub token formats

​Prerequisites

​Encrypt tokens in logs

​Block tokens in agent tool calls

​Verify

​Next steps

Log Schemas

Network Rules

Policy Evaluation

Endpoint Logs

Overview

GitHub token formats

Prerequisites

Encrypt tokens in logs

Block tokens in agent tool calls

Verify

Next steps