llms.txt git:20261031.22e00b6A

Immutable. This exact content never changes and is served at /api/v1/blob/0ce3bb60c8b4410e.

# Cloakroom

> A privacy layer for Claude Code. A plugin with hooks swaps names, emails, addresses, API keys and IDs in tool output for placeholders (PII_PERSON_1, PII_SECRET_1) before the model sees them, and puts the real values back when Claude writes files or runs commands, on the user's machine. Detection is a local model (PII-Tracer) plus rules; nothing is sent anywhere. Runs on macOS, Windows and Linux. Apache-2.0.

Install: `/plugin marketplace add shanjeevrajendran/cloakroom`, then `/plugin install cloakroom@cloakroom`. The plugin installs the Python package (`cloakroom` on PyPI) itself on first start. Prompts that contain a secret are blocked (Claude Code hooks cannot rewrite a prompt); `cr!` sends one anyway, `cr: pause 10m` / `cr: resume` pause and resume checks.

Where data goes: `cloakroom report --destinations` lists the hosts commands, web fetches and MCP calls sent data to, with the kinds of data carried (never values). `cloakroom allow-host example.com` builds an opt-in approved-sites list; a call to any other site is held. See the README section "See where your agent sends data".

Other agents: `cloakroom install codex`, `cloakroom install gemini` and `cloakroom install cursor` add Cloakroom's hooks to Codex CLI, Gemini CLI and Cursor's command-line agent (Mac and Linux). See the README sections "Codex", "Gemini CLI" and "Cursor".

Proxy: `cloakroom proxy` runs a local server (127.0.0.1 only, off until started) that masks the request bodies of any tool that lets you set its API address (Claude Code via ANTHROPIC_BASE_URL, Codex CLI, Gemini CLI); `cloakroom proxy install claude|codex|gemini` sets the address, and `cloakroom doctor` shows whether it runs. See the README section "Point any tool at Cloakroom".

## Docs

- [README](https://github.com/shanjeevrajendran/cloakroom/blob/main/README.md): what it does, install, results, FAQ
- [How it works](https://github.com/shanjeevrajendran/cloakroom/blob/main/docs-HOW-IT-WORKS.md): detectors, known-safe filter, vault, restore
- [Setup](https://github.com/shanjeevrajendran/cloakroom/blob/main/docs-SETUP.md): install options, uninstall
- [Handbook](https://github.com/shanjeevrajendran/cloakroom/blob/main/docs-HANDBOOK.md): exceptions, backends, CI, dashboard, troubleshooting
- [Known limits](https://github.com/shanjeevrajendran/cloakroom/blob/main/docs-LIMITS.md): what it does not catch or protect
- [Security policy](https://github.com/shanjeevrajendran/cloakroom/blob/main/SECURITY.md): reporting a bypass privately

## Results

- [Benchmark](https://github.com/shanjeevrajendran/cloakroom/blob/main/bench/RESULTS.md): leaks and false alarms on fresh holdout sets, next to other tools
- [Public datasets](https://github.com/shanjeevrajendran/cloakroom/blob/main/bench/public/RESULTS.md): TAB and Gretel

## Optional

- [Changelog](https://github.com/shanjeevrajendran/cloakroom/blob/main/CHANGELOG.md)