cloakroom 1.4.0

cloakroom.sh · Install · How it works · Security · Commands · Releases

Cloakroom masks API keys, passwords and personal data on your machine before your AI coding agent sees them, and puts the real values back in the files and commands the agent writes. Works with Claude Code, Codex, Gemini CLI and Cursor. Free and open source.

The full guide, settings and FAQ live at cloakroom.sh. This README is the short version.

_{▶ 40-second demo}

Install

Claude Code (Mac, Windows, Linux). Inside Claude Code, one line at a time, then restart it:

/plugin marketplace add shanjeevrajendran/cloakroom
/plugin install cloakroom@cloakroom

The plugin installs the cloakroom program on first start. Until it is ready, the agent's file reads and commands wait instead of passing unchecked.

Codex, Gemini CLI, Cursor (Mac, Linux):

uv tool install "cloakroom[model,torch,ocr]"   # Python 3.10+
cloakroom install codex                         # or: gemini, cursor

Codex skips new hooks until you trust them once: start codex, type /hooks, trust each Cloakroom entry.

Check it: cloakroom doctor (every line should say ok).

Updates: Claude Code updates the plugin, and the plugin updates the program. Codex, Gemini CLI, Cursor, git commits, or a cloakroom you installed yourself: run cloakroom update in a terminal.

Step-by-step guide, updates and uninstall: cloakroom.sh/install.

How it works

Cloakroom runs as hooks: checks the agent calls before and after each tool call. On the way in, pattern rules plus a small local detection model find secrets and personal data, and each value is swapped for a placeholder such as PII_SECRET_1 that stays the same for the session. The pairs live in an encrypted vault on your machine, its key in the OS keystore (Keychain, Credential Manager, Secret Service). On a Mac there is no Keychain password prompt on first run or after a Python update, and the agent can't read the key. On the way out, placeholders in writes and commands get their real values back just before they run.

file or command output ──► Cloakroom (local) ──► model sees PII_PERSON_1, PII_SECRET_1
                                                         │
your disk gets the real value ◄── Cloakroom (local) ◄────┘ agent writes or runs with placeholders

Nothing leaves the machine except the one-time model download. If Cloakroom can't check something, it holds it instead of letting it through. More: cloakroom.sh/how-it-works · docs-HOW-IT-WORKS.md.

New in 1.4:

• Personal data in old chats, for every agent: cloakroom exposure --personal also finds personal data you typed in old Codex, Cursor and Gemini CLI chats, not only Claude Code (details).
• No Keychain password prompt on a Mac: none on first run or after a Python update, and an agent can't read the vault key (details).

What works where

✓ masked · ⛔ stopped or held · ✗ not covered

Every gap, with the reason: docs-LIMITS.md.

Results

On held-out test sets Cloakroom let through 0 of 1,005 personal details (the other tools tested let through 119 to 992) and 0 of 77 keys and passwords in real vendor formats. The trade-off is false alarms: it masks more harmless text than secret-only scanners. Method and raw numbers: bench/RESULTS.md.

Recent releases

• 1.4.0: cloakroom exposure --personal also finds personal data you typed in old Codex, Cursor and Gemini CLI chats (details). On a Mac there is no Keychain password prompt on first run or after a Python update, and an agent can't read the vault key (details).
• 1.3.0: an agent can't approve its own held call or switch Cloakroom off, and a hook or MCP server it writes into agent config is held until you type cr: allow.
• 1.2.0: Cursor's editor is checked with Cloakroom (Tab completion isn't covered). Codex signed in with ChatGPT is masked through cloakroom proxy. Fewer false alarms on Codex's plugin list.

All releases: cloakroom.sh/releases · CHANGELOG.md.

What it isn't

• Not a sandbox. It stops accidental leaks and contains prompt injection; it doesn't prevent it. An agent runs as you, so the agent's own sandbox is the outer wall.
• Not everything has a hook. Cursor's Tab completion and the vendors' own server-side web search aren't seen.
• Typed prompts are stopped, not rewritten. Agents let a hook block a prompt but not reliably change it.

Commands you'll use

All commands: cloakroom.sh/commands. Settings: cloakroom.sh/settings. Rules only, no model: CLOAKROOM_MODE=rules.

Develop

git clone https://github.com/shanjeevrajendran/cloakroom && cd cloakroom
uv sync
uv run pytest -q tests      # rules mode, no model download

See CONTRIBUTING.md. Found a way around it? Report it privately: SECURITY.md. Changes: CHANGELOG.md.

Credits

Detection model: PII-Tracer. The one-string hook command that runs in both bash and PowerShell comes from maisecrets (Apache-2.0).

Made by Shanjeev Rajendran · GitHub · LinkedIn · Apache-2.0