shim-cli is an open source command line tool that runs on your own machine next to Claude Code, Codex, Copilot CLI and VS Code. Its purpose is stated plainly on the website: see what your coding agent sends, and mask what you can. The CLI finds secrets and personal data in what an agent sends, masks those values where the client allows it, and shows what each Claude Code session sent and cost. It is built for developers who use AI coding agents every day and want visibility into the files, tool results and prompts that reach the model, without adding an account, an API key or a network call to shim.
Claude Code keeps every session on your disk, and an agent at work reads files, runs commands and pulls in tool results. Some of those files hold API keys, database URIs, customer email addresses, IBANs and other personal values. Once a value is in a request, it has reached the model. shim-cli starts from that reality: before you install anything, it can show what already went out, and after installation it can place a placeholder between the file and the model. The project describes itself as narrowing exposure rather than acting as a data-loss prevention boundary, so it is positioned as a practical layer of containment and measurement for everyday agent work rather than a compliance guarantee.
Masking is handled by shim install , which installs a native hook in your agent. When the agent reads a file or a tool result holding a key, an IBAN or an email, the model receives a placeholder such as instead of the value. The detector covers email addresses, phone numbers, credit cards, IBANs, Turkish national IDs, Turkish tax IDs, API keys and secrets, passwords in config and commands, database URIs, IP addresses, MAC addresses and US SSNs, plus Turkish licence plates as an opt-in. IBANs and Turkish IDs are verified by checksum, so a mistyped number is not reported. You can add your own patterns, including your own project names or host formats. Where the client allows it, masking happens before the model reads the content; where it does not, shim reports the finding or, in enforce mode, stops it instead.
Two commands answer two different questions. shim install claude masks sensitive data in every session. shim watch -- claude runs a local proxy for one command and reports tokens, spend and every secret or personal value that went past; it changes nothing, writes no request to disk and leaves nothing behind. For history, shim audit reads the Claude Code sessions already stored on your disk and counts what reached the model, broken down by kind, by project and by the way it came in, for example @.env, a failed Bash command or your own prompt. The sample output shows counts for SECRET, EMAIL and DB_URI, a per-project breakdown, values already masked by shim, and model output that repeated an email. shim audit prints no value, keeps nothing and sends nothing, and it reads Claude Code history only, only when you run it. shim watch currently supports Claude Code only.
Supporting commands make the setup auditable. shim demo runs the detector on a made-up sentence and shows the before and after lines without installing anything. shim install --dry-run previews the hook and shows the target file and the fragment before you commit, and --json returns machine-readable output that branches on a code and a fix. shim doctor checks the installation and reports every check that is not PASS along with its code and its fix. shim keys .env --json lists the names in a .env file without printing values. At the end of a turn, Claude Code users see a summary: how many values were masked and from which read, which items were flagged, and the overhead. The website shows a real session on a customer file with 60 emails, 60 IBANs, 60 phone numbers and 60 Turkish national IDs masked from Read customers.csv, one INSTRUCTION_OVERRIDE and one HIDDEN_TEXT flagged from Read runbook.md, and 62 ms median overhead.
Support for each client differs, and the documentation is explicit about it. In Claude Code, a native hook masks secrets and personal data in the files and tool results the agent reads before the model sees them, and the tool can also be installed from the Claude Code marketplace as a plugin, using one method and not both. In Codex, shim reports what it found in your prompt and lets it through, and you switch to enforce mode to block it instead; Codex also skips a hook until you open /hooks, review the shim entry and trust it. In Copilot CLI, shim replaces the prompt the model receives with the redacted text, so the original values never reach it, and there is no trust step. In VS Code there is no shim install vscode; the plugin is the whole route, added through the chat.pluginLocations user setting with an absolute path, and it reports findings, stops a prompt or denies a tool call under enforcement, and never masks a result that has already reached the model.
The outcome the project promises is narrower exposure with measurable cost. Values that would otherwise travel in plain text become placeholders, prompts can be blocked under enforce mode, and the end-of-turn summary shows how much overhead the hook adds. The website reports that these numbers are measured on the released build: 2,300+ tests run on every release, 70 ms median hook cost including interpreter start, 727 detector cases graded on exact output, and zero accounts, API keys or telemetry added by shim. The same page is candid about the boundary: a prompt typed into Claude Code or Codex is not masked because neither client lets a hook rewrite it, Codex and Copilot CLI tool traffic is not inspected at all, VS Code masks nothing, in Claude Code shell commands and file writes are reported or denied rather than masked, the output of a failed command and a file attached with @ are reported rather than masked, Windows is not supported and WSL is not yet verified, and detection is best-effort and can miss a value.
Concrete use cases follow from those mechanics. A developer reading a customer file with an agent sees 60 email addresses, 60 IBANs, 60 phone numbers and 60 Turkish national IDs replaced with placeholders before the model reads the CSV. A runbook containing text that tries to give the agent orders is flagged as an instruction override, alongside hidden text in the same document. A team that wants to know what already leaked runs shim audit over past Claude Code sessions to count secrets by project before changing any settings. A developer who wants to understand where tokens and money went runs shim watch -- claude for a single command and gets a report without anything written to disk. Someone who only wants to list the names in a .env file uses shim keys .env --json so no value is printed, and someone wiring the tool into a new machine runs shim demo, shim install --dry-run and shim doctor in sequence.
shim-cli is distributed as an open source CLI under Apache-2.0, currently at v1.2.1, and runs on macOS and Linux with Python 3.10 or newer. Installation is a single command through uv or pipx. It integrates with Claude Code, Codex, Copilot CLI and VS Code through native hooks or a plugin, and requires no account, no API key and no network call to shim. The whole CLI is on GitHub, so you can read the detector, run the tests, open an issue or send a pull request. For teams that need the same detection in front of the AI calls their own products make, the site points to the AI Gateway, which adds audit, budgets and roles on Enterprise.
The takeaway is straightforward: shim-cli makes the traffic between your coding agent and the model visible, masks what the client allows it to mask, measures what a Claude Code session sent and cost, and states its limits openly. It is a practical, local-first way to reduce what your agent exposes without adding an account or telemetry.
Publisher
A
admin
Launch Date2026-10-19
Platformdesktop
Pricingfree
Tech Stack
#Python#uv#pipx