shim-cli launches privacy layer for coding agents
shim-cli is an Apache-2.0 local hook and proxy that masks secrets and personal data before coding agents send tool results to models. It supports Claude Code, Codex, Copilot CLI, and VS Code, while reporting session tokens, costs, and detected exposures.
shim-cli tackles a real blind spot in agentic coding: developers often do not know how much context their tools transmit. Its local-first design is compelling, but coverage gaps and best-effort detection mean it complements rather than replaces robust data-loss prevention.
- –Claude Code gets the strongest protection, including masking eligible tool results before model access.
- –Codex, Copilot CLI, and VS Code currently offer reporting or prompt controls with materially less tool-result coverage.
- –Enforce mode can block sensitive prompts, but the default behavior reports some exposures after the fact.
- –No account, telemetry, or shim network call makes the tool attractive for privacy-conscious developers.
- –The open-source detector and performance tests improve trust, though custom workloads still need independent validation.
DISCOVERED
2h ago
2026-10-18
PUBLISHED
8h ago
2026-10-18
RELEVANCE
AUTHOR
[REDACTED]