shim-cli
An open-source privacy protection tool for AI coding agents that intercepts and masks sensitive information through hooks and a local proxy before data leaves the machine, and provides a session-level audit view.
Timeline (last 90 days)
shim-cli is an open-source tool that provides a hook and a local proxy, intercepting data sent by AI coding agents to external services before it leaves the machine.
shim-cli runs as a hook in Claude Code, masking secrets and personal data matched in tool execution results so that the original sensitive values do not enter the model's context window.
The shim watch component provides a session-level audit view showing what was sent to the model during a session and how much it cost.
shim-cli states that it supports Claude Code, Codex, Copilot CLI and VS Code.
shim-cli explicitly states that it does not collect telemetry, requires no account registration, and stores audit data only locally.
shim-cli is released as open source and hosted on GitHub, and received 104 votes and 9 comments on Product Hunt, ranking 3rd that day.
shim-cli's masking rules rely on pattern matching and carry risks of both false positives and misses: excessive masking causes the model to lose key context, while insufficient configuration may let sensitive information leak out.
For Codex and Copilot CLI outside Claude Code, whether shim-cli equally implements "masking before reading" or only operates at the observation level requires developers to verify themselves.
Masking sensitive values produces placeholders and consumes tokens, and excessive masking may remove the clues the model needs to complete the task, causing the agent to retry repeatedly and raising costs, so a trade-off between privacy protection and task success rate is needed.
When evaluating zero-telemetry claims, it is advisable to verify with actual packet capture or firewall logs rather than relying solely on the product page description.
1 more timeline events
All Facts (11)
shim-cli is an open-source tool that provides a hook and a local proxy, intercepting data sent by AI coding agents to external services before it leaves the machine.
50%Unverifiedshim-cli runs as a hook in Claude Code, masking secrets and personal data matched in tool execution results so that the original sensitive values do not enter the model's context window.
50%UnverifiedThe shim watch component provides a session-level audit view showing what was sent to the model during a session and how much it cost.
50%Unverifiedshim-cli states that it supports Claude Code, Codex, Copilot CLI and VS Code.
50%Unverifiedshim-cli explicitly states that it does not collect telemetry, requires no account registration, and stores audit data only locally.
50%Unverifiedshim-cli is released as open source and hosted on GitHub, and received 104 votes and 9 comments on Product Hunt, ranking 3rd that day.
50%Unverifiedshim-cli's masking rules rely on pattern matching and carry risks of both false positives and misses: excessive masking causes the model to lose key context, while insufficient configuration may let sensitive information leak out.
50%UnverifiedFor Codex and Copilot CLI outside Claude Code, whether shim-cli equally implements "masking before reading" or only operates at the observation level requires developers to verify themselves.
50%UnverifiedMasking sensitive values produces placeholders and consumes tokens, and excessive masking may remove the clues the model needs to complete the task, causing the agent to retry repeatedly and raising costs, so a trade-off between privacy protection and task success rate is needed.
50%UnverifiedWhen evaluating zero-telemetry claims, it is advisable to verify with actual packet capture or firewall logs rather than relying solely on the product page description.
50%Unverifiedshim-cli is suitable for evaluation by teams in regulated industries or handling sensitive codebases as a local-first, open-source and auditable tool.
50%