Email addresses, phone numbers, credit cards, IBANs, Turkish national IDs, Turkish tax IDs, API keys and secrets, passwords in config and commands, database URIs, IP and MAC addresses, US SSNs, Turkish licence plates (opt-in), and your own custom patterns. IBANs and Turkish IDs are checksum-verified.

Is my typed prompt masked?

Not in Claude Code or Codex — neither client lets a hook rewrite a typed prompt, so shim reports it or stops it in enforce mode. Copilot CLI is the exception: the model receives the masked prompt.

What platforms are supported?

macOS and Linux, with Python 3.10 or newer. Windows is not supported, and WSL is not yet verified.

What is the performance overhead?

The released build shows a 70 ms median hook cost including interpreter start; a sample session showed 62 ms median and 119 ms p95 overhead.

shim-cli — See what your coding agent sends. Mask what you can.

shim-cli is a free, open source (Apache-2.0) command-line tool that runs locally next to AI coding agents — Claude Code, Codex, Copilot CLI and VS Code. It detects secrets and personal data (API keys, IBANs, emails, national IDs, database URIs, and more) in what your agent sends to the model, masks them where the client allows, and audits past Claude Code sessions to show what was already sent. It installs as a native hook in the agent, needs no account, API key, or network call to the vendor, and reports tokens and spend per session via a local proxy.

Key Features

Local secret and PII masking

Installs a native hook in your coding agent so the model receives placeholders like <SECRET_1> instead of real API keys, emails, IBANs, phone numbers, credit cards, Turkish national IDs, database URIs, IP/MAC addresses, and US SSNs found in files and tool results.

Checksum-verified detection

IBANs and Turkish IDs are verified by checksum so mistyped numbers aren't reported, and detector output is graded against 727 cases on every release.

Custom detection patterns

Add your own project names or host formats as patterns; Turkish licence plate detection is opt-in.

Session audit of past Claude Code history

shim audit reads Claude Code's local session history and counts what reached the model — by kind, by project, and by how it got there — without printing values, writing, or sending anything.

One-session watch mode

shim watch runs a local proxy for a single command and reports tokens, spend, and every secret or personal value that passed, without writing requests to disk.

Prompt-injection flagging

Flags suspicious content such as instruction overrides and hidden text in documents the agent reads (e.g. flagged INSTRUCTION_OVERRIDE and HIDDEN_TEXT in a runbook file).

Agent instruction bootstrap

Provides a copyable prompt that sets shim-cli up via your coding agent itself, with guardrails like --dry-run-before-yes, JSON output, and no sudo or permission-skipping flags.

Diagnostics and dry-run installs

shim install supports --dry-run preview of hook changes, and shim doctor reports per-check PASS/FAIL results with fix instructions.

How It Works

1. Install the CLI

Install via uv or pipx (requires Python 3.10+): uv tool install --python 3.12 --compile-bytecode shim. Takes about a minute, no account needed.

2. Preview what it catches

Run shim demo <client> to see the detector mask a made-up sentence. It installs nothing.

3. Connect your agent

Run shim install <client> --dry-run to preview the hook change, then shim install <client> to install it for Claude Code, Codex, or Copilot CLI. For VS Code, clone the release and point chat.pluginLocations at the plugin folder.

4. Verify and use normally

Start a new agent session (trust the hook in Codex via /hooks), run shim doctor <client>, and continue working — sensitive values in files and tool results are masked before the model sees them.

Pros & Cons

Pros

Free and fully open source under Apache-2.0, with the detector readable and 2,300+ tests run on every release
Runs entirely on your machine — no account, API key, or network call to the vendor, and zero telemetry added
Works with your existing clients (Claude Code, Codex, Copilot CLI, VS Code) via native hooks instead of replacing them
Very low overhead: 70 ms median hook cost including interpreter start (62 ms median, 119 ms p95 in the shown session)
Detection is checksum-verified for IBANs and Turkish IDs, reducing false positives on mistyped numbers

Who It's For

Best for

Developers using Claude Code who want secrets and PII in files and tool results masked before they reach the model
Teams that need to audit what their Claude Code sessions already sent and where tokens/spend went
Security-conscious developers who want a local, open source, account-free guard rather than a cloud gateway
Copilot CLI users who want the actual prompt text redacted before the model sees it

Not ideal for

Windows users (unsupported, and WSL is not yet verified)
Users of unsupported agents like Cursor, Windsurf, or Gemini CLI

Use Cases

Preventing API keys, .env contents, and database URIs from reaching the model through coding agent file reads and tool results

Auditing past Claude Code sessions to find out which secrets and personal data already reached the model, by project

Masking customer PII (emails, IBANs, phone numbers, national IDs) in agent workflows that read customer files like CSVs

Measuring token usage and spend of a single coding agent session without changing anything

Detecting prompt-injection attempts (instruction overrides, hidden text) in documents an agent reads

FAQ

What is shim-cli?

An open source (Apache-2.0) CLI that runs on your machine next to Claude Code, Codex, Copilot CLI, and VS Code. It finds secrets and personal data in what your coding agent sends to the model, masks them where the client allows, and shows what each Claude Code session sent and cost.

Which clients does it support?

Claude Code, Codex, Copilot CLI, and VS Code. If you use another agent (e.g. Cursor, Windsurf, or Gemini CLI), setup stops — they are not supported.

How much does it cost?

It is free and open source under Apache-2.0. The whole CLI is on GitHub; no account or API key is needed, and shim adds no telemetry.

Does it need an account or network access?

shim-cli