A local privacy firewall for AI agents.

AI agents read for you: your code and its .env, databases, logs, mailboxes, the web. Coding agents such as Claude Code and Codex do it at your request. Autonomous agents such as Hermes Agent, OpenClaw, Goose and OpenHands do it on their own, for hours, with no one reading each step. Everything they read is sent to a model in the cloud.

Latet stands between the agent and the model. It masks secrets and personal data before a request leaves your machine and restores them locally in the answer, so the agent keeps working normally and the provider never sees the real values.

The best models for your sensitive work too. Without it, work on customer data, health records or credentials stays away from cloud models, or goes to a weaker local one. With it, the cloud model gets the work, not the values.

At the office too. When your company reaches Claude or GPT through its own gateway, Amazon Bedrock, Google Vertex, Microsoft Foundry or Azure OpenAI, Latet reads that route from the agent's settings and goes in front of it: Company endpoints.

See it at work first. Once it is installed, latet tutorial opens a sandbox in your browser: a pretend agent sends requests full of invented secrets and personal data through the real Latet, and chapter by chapter the dashboard shows what Latet did with each value. Nothing leaves your computer, and none of your settings change: Tutorial.

Website: https://latet.ai/ · Documentation: https://docs.latet.ai/, also in Italiano, Deutsch, Français and Español

What it protects

Every request is checked before it leaves, whatever put the text in it: you, a file, a tool, the agent's own instructions.

A key in .env, for example: the agent reads the file to learn the configuration, and the model receives pk_3a8d1f6b0e9c2a7d4b5e instead of pk_9f2c4e7a1b3d5f8e0a6c. It writes the code that reads the key from the environment, as it should; if a fake does come back, in a reply or in a command the agent runs, Latet puts the real key back on your machine. See How it works.

How it protects

• Detects secrets (API keys, tokens, passwords, .env values, private keys, connection strings) and personal data (emails, phone numbers, IBANs, card numbers, VAT numbers of 30 European countries and national ID and tax numbers of 15 countries, each confirmed by its check digits or a nearby keyword, and names and street addresses with the optional local name model). Your own terms and formats too: a client's name, or every badge number written AB-123456 (custom recognizers, with a guide for AI agents to write them).
• Replaces each value with a deterministic, format-preserving fake of the same shape, so code and configuration still make sense to the model.
• Restores the originals locally, in responses, streaming output and tool-call arguments, so files written by the agent contain the real values.
• Adapts to each project: a latet.yaml in a repository adds the project's own terms, formats and stricter rules, shared with everyone who works on it, and can never turn protection down; your own settings for a project may also loosen it, or turn Latet off there (projects).
• Reads production data by its structure: the secret columns of a query result are always masked, and strict data mode masks every value of the tables, JSON and logs an agent reads; the dashboard proposes the columns that can stay in clear, such as ids, dates and states (production data).
• Reviews, if you want, everything the model did not write before it leaves, with a language model on your own computer: the names, health details and secrets in prose that no pattern finds (below).
• Asks you, if you want, before anything new leaves: every prompt, file and tool output waits in the dashboard until you approve it, mask more in it, or stop it (below).
• Shows exactly what was sent upstream and how it was masked, in a local dashboard (latet dashboard).

Everything runs on your machine. There is no Latet cloud service, no telemetry and no analytics.

Beyond patterns: the local reviewer and the Live Reviewer

Detectors find what has a shape: a key, an email address, an IBAN, an ID number with its check digits. A good deal of what matters has none. "Mark from sales is quietly interviewing at a competitor", a client named in passing in a log, a password written in a sentence, the details of a contract in a customer's email: no pattern recognises them, and an agent that reads files and tools for you brings plenty of them along. Latet has two more layers for these, and each adds to what the one before masked; neither can take anything away.

flowchart LR
  T["A text about to leave:<br/>prompt, file, tool output"] --> D["Detectors<br/>secrets, personal data,<br/>your terms and formats"]
  D --> R["Local reviewer<br/>a language model<br/>on your own computer"]
  R --> L["Live Reviewer<br/>you, in the dashboard"]
  L --> M["The model"]

The local reviewer is a language model that runs on your own computer, or on a server of yours (llama.cpp, Ollama, LM Studio). Before a text leaves, it reads what the detectors left in clear, with their replacements shown as placeholders, and points out the names, health details, addresses and secrets in prose. Latet masks them like any other value, wherever they appear from then on.

• Everything the model did not write is read before it leaves: your prompts and attachments, the agent's instructions, and above all what its tools fetch, the part nobody types.
• Nothing leaves without its review. When the reviewer cannot answer, because its server is off or its answer is not to be trusted, the request is stopped. You can choose to send it masked by the detectors alone instead.
• A text is read once, and its review is remembered across restarts: history the agent sends again with every turn costs nothing more.
• Your guidance: Latet's own instructions to the reviewer are fixed, and shown in the dashboard as they are sent. After them you can add what only you know of your work (ward names are confidential, PRJ- codes are internal projects), for everything or for one project.
• How much it finds: on 93 invented cases, counting only what the detectors missed, Qwen3.5-4B found 84% (a prompt in under a second on a graphics card) and Ternary-Bonsai-2-27B 97%. Which local model works best as a reviewer is still open, and measurements from the community are welcome: benchmarks/llm-review/README.md says how these were made, with scripts/llm_review_bench.py, and CONTRIBUTING.md how to send yours.
• The original texts stay on your machines. The server is on this computer, or on another machine of yours once you confirm it, reached over https (a self-signed certificate is trusted by its fingerprint).

The Live Reviewer is you, as the last check. Turn it on in the dashboard, and every new text waits on the Approvals page before it leaves: the original next to what will be sent, with what the detectors and the local reviewer masked, and what the reviewer only suggested.

• Approve it, mask more, or stop it. Select a value in the original and choose what it is; it leaves as a fake. A text you stop is never sent.
• You can only add masking. A value already masked cannot be put back in clear, and a value you mask stays masked from then on, everywhere.
• In Claude Code it waits inside the plugin, before Claude Code builds the request, piece by piece as prompts and tool outputs arrive; for the other agents, in the daemon, on the whole request. Nothing has a time limit unless you set one.
• It suits the moments that matter: a session on a customer's data, an agent you leave alone on a production system, the first days with a new project. Approve all waiting and letting texts with nothing found go by themselves keep it quick.

Without the local reviewer, what has no shape is only as safe as the detectors and the local name model make it: turn the Live Reviewer on, or keep such text out of the agent's reach. See Local reviewer and Live Reviewer.

Agents and services

Through the gateway, requests reach OpenAI (and ChatGPT, for Codex), OpenRouter (Claude, Gemini and hundreds of other models), Anthropic's API, and Google's Gemini API and Vertex AI. Not covered: Claude Desktop's Chat and Cowork signed in to Claude, cloud sessions (they run on the provider's infrastructure), and Cursor, Windsurf, Antigravity, Jules, Kiro, Warp and the ChatGPT app, whose requests leave from the vendor's servers (what Latet cannot protect).

• Client mode, for Claude Code: the plugin masks inside Claude Code, before the request is built. The daemon checks each request and forwards it unchanged; it stops one that would carry a sensitive value in clear.
• Gateway mode, for every other agent: the daemon on 127.0.0.1:5283 masks the request and restores the answer, streams included (SSE and WebSocket).

flowchart LR
  subgraph machine["Your machine"]
    direction TB
    CC["Claude Code<br/>+ Latet plugin<br/>(masks inside Claude Code)"]
    GW["Codex, OpenCode, Gemini CLI,<br/>Hermes Agent, OpenClaw, Goose,<br/>OpenHands, scripts and SDKs"]
    D["Latet daemon<br/>127.0.0.1:5283"]
    V[("Vault<br/>original ↔ fake<br/>encrypted")]
    UI["Dashboard"]
    CC -- "already masked" --> D
    GW -- "real values" --> D
    D --- V
    D --- UI
  end
  D -- "Claude Code's requests:<br/>checked, forwarded unchanged" --> P["Anthropic, OpenAI / ChatGPT,<br/>OpenRouter, Google Gemini"]
  D -- "every other agent's:<br/>masked, answers restored" --> P

Tested for real. Each of these runs through a real Latet to a fake provider, set up as its guide says, and its test checks that the provider never sees the secrets and that the agent gets them back: Claude Code (on Bedrock and Vertex too), Codex, Gemini CLI, Hermes Agent, OpenClaw, Goose, OpenHands, Aider, Qwen Code, Crush, the GitHub Copilot CLI, Junie CLI, and the CLIs of Cline, Kilo Code and Continue; the OpenAI, Anthropic and Google GenAI SDKs, LangChain, LangGraph, AutoGen and CrewAI. Tested live with real providers: the Claude Code CLI with a subscription and the Codex CLI signed in with ChatGPT (WebSocket), with local name detection and the dashboard, and the local reviewer with a model served by llama.cpp. GitHub Copilot in VS Code was tried by hand; Copilot in JetBrains IDEs, JetBrains AI Assistant, Zed, Android Studio and Claude Desktop on a gateway are documented, not tested. Every wire format is also tested in CI against a fake upstream. If an agent does not work through Latet, please open an issue.

Claude Pro and Max subscriptions

Latet works with Claude Code signed in with a Pro or Max subscription: no API key is needed. Anthropic allows a subscription in Claude Code and its own apps (Legal and compliance), and that is the only place Latet uses one:

• Claude Code is not modified. Latet extends it with a plugin, through Claude Code's own plugin system, and points it at the local daemon with ANTHROPIC_BASE_URL, the setting Anthropic documents for gateways, a subscription login included.
• Your sign-in stays Anthropic's. You log in with Claude Code's own login. Latet never asks for your credentials, never reads them for itself and never stores them.
• Each request is the one Claude Code built. The plugin masks inside Claude Code, before the request is built. The daemon then forwards it byte for byte, headers included, as Anthropic's gateway guide asks a gateway to do: it inspects without modifying. Your token passes through it and is never saved or logged.
• No one else uses your subscription. The other agents go through the gateway with their own API keys.

Latet takes no work away from your provider: it brings it the work you would otherwise keep from it.

This describes how Latet works; it is not legal advice.

Claude Code's auto mode: its reviewer is sent your OS user name and the paths of your home and working directories, which no plugin can mask. Latet blocks those reviews by default (auto mode then cannot approve actions by itself); auto_mode_review lets each detail through to the reviewer, or gives it a fake user name. See Claude Code.

Run your agent through Latet

The usual way is to start the agent through Latet, the session you want protected:

• latet claude, latet codex or latet opencode runs that agent through Latet. It starts the daemon and gives the agent what it needs for that session only: none of the agent's settings change, and when the session ends the agent works as before. Every argument passes through: latet claude --resume.
• claude started on its own does not go through Latet. That is the price of changing nothing.

For every session, once Latet fits your work: latet global-install points your agents at Latet for good, in the terminal and in the IDE, so no session can start without it. It is worth it once your terms, formats and projects are set and the false positives marked Not sensitive, and on a machine where a forgotten session would matter: a customer's data, an autonomous agent left alone. It shows everything it would change and asks once; it backs each agent's settings up first, and latet global-uninstall takes it all away, the settings restored byte for byte. latet agents apply routes one agent you install later.

Setting Latet up takes some time. The defaults protect at once what has a shape: keys, passwords, email addresses, IBANs, ID numbers. Making it fit you takes longer: your clients' names and internal codes as terms and recognizers (latet rules suggest finds the formats), the false positives marked Not sensitive from the dashboard, a project's own rules, and the local reviewer for what has no shape. The dashboard shows each request as it left, so you see what to add as you work.

latet run <command> is for scripts and SDKs: it runs the command with OPENAI_BASE_URL, ANTHROPIC_BASE_URL and GOOGLE_GEMINI_BASE_URL pointing at Latet, so a program that reads them goes through it (latet run python summarize.py). A program that does not read them runs as usual.

Install

Requirements: Windows, macOS or Linux. The installers set up uv, which also provides a Python Latet is tested on (3.12 or 3.13).

On macOS and Linux:

curl -LsSf https://raw.githubusercontent.com/Latet-AI/latet/main/scripts/install.sh | sh

On Windows (PowerShell):

irm https://raw.githubusercontent.com/Latet-AI/latet/main/scripts/install.ps1 | iex

Both install the latest release from GitHub with uv, local name detection and text in images included, and change nothing else: start your agent with latet claude as above, and run latet global-install when it fits your work. latet upgrade installs the next release the same way.

Recommended: names and images from day one. Patterns find what has a shape, such as a key, an email address or an IBAN. A name in a sentence has none (Emily Carter lives at 42 Mill Lane): the local name model finds it. The text in a screenshot needs text recognition, or the image leaves as it is. The installers install what both run on; download their models once:

latet ner install   # names and street addresses: about 1.6 GB
latet ocr install   # the text in images: about 31 MB

Both run on this computer only: the models come once from huggingface.co, checked against pinned hashes, and nothing is sent anywhere. latet global-install --ner --ocr downloads them with the rest of its setup.

With an AI agent: point it at llms-install.md. It installs Latet, which changes nothing on its own, then tells you how you can go on (try it one session at a time, have it on for every session, set up your other tools, download the local models) and waits for your choice: it runs latet global-install only if you choose every session. Later, llms-config.md lets it change Latet's settings for you: what adds protection applies, what lowers it waits for your approval in the dashboard. That is a guardrail against mistakes, not a lock: an agent runs as you, so it cannot hold against one misled by a prompt injection (Agents and your settings).

With Docker, if you prefer: docker compose up -d with compose.yaml, then docker exec latet latet agents print shows how to point each agent at the container. See Docker.

From a checkout (also needs Node.js 22.12 or newer, to build the dashboard; installed from the repository's address, git+https://..., Latet would come without it):

git clone https://github.com/Latet-AI/latet.git
cd latet
cd dashboard && npm ci && npm run build && cd ..   # the dashboard ships inside the package
uv tool install --force ".[ner,ocr]"               # or "." without names and images

To work on Latet itself, see CONTRIBUTING.md.

Quickstart

1. See it at work. New to Latet? latet tutorial shows it at work in about 30 minutes, in your browser: a pretend agent and a pretend model, the real Latet between them, and invented data. Nothing leaves your computer, and none of your settings change. See Tutorial.
2. Try it, changing nothing: in a scratch folder, put a made-up key in a .env file, start latet claude (or latet codex) there, and ask the agent to copy the key into another file. Then run latet dashboard: the request shows a fake, and the file on disk contains the original.
3. Work with it: keep starting your agent with latet claude, and look at the dashboard now and then. Add your own terms, mark the false positives Not sensitive, and turn on the local reviewer if you have a graphics card, or the Live Reviewer when the data matters.
4. Turn it on for good, once it fits: latet global-install detects your agents and shows what it would change: the Claude Code plugin in every session, each agent pointed at the local daemon, the daemon started at login, the profile (below). It asks once. Restart your agents afterwards.

Everyday commands

To uninstall: latet global-uninstall, then uv tool uninstall latet. Every command and option is in the CLI reference.

Latet on a server

For a team, one Latet can run on a server instead of on each computer: people's agents, and programs such as a CI pipeline, send their requests to it over HTTPS, and it masks them there. It runs on several instances, with PostgreSQL and Valkey behind them.

In practice:

1. The administrator starts the server, with the server profile of compose.yaml (PostgreSQL, Valkey, two instances and Caddy) or as a systemd or Windows service (latet server service install shows its plan first), and adds each person, which prints a one-time code: latet server --server https://latet.acme.lan people add "Emily Carter".
2. Emily installs Latet on her computer as usual and runs latet connect https://latet.acme.lan with that code. From then on her agents' requests go through the server, and latet dashboard opens her space there.
3. A program gets an API key instead: latet server --server https://latet.acme.lan keys add "Billing CI" --out billing.key.

What is whose. Each person and each API key has a separate space, with its own vault, history, settings and rules. The server shares with every space only what it needs to run: its destinations, its local reviewer, text recognition and how long history is kept.

Sharing rules. A team shares its rules by hand: one person exports them to a file with latet rules export, and the others import it. Rules set once for everyone, which nobody can lower, are planned for the Enterprise Edition.

Administration. The administration commands add and remove people and API keys, set the rules of each API key and the shared settings, and show the administration log. Metrics have a listener of their own, which asks for a token.

Trust. Original data can reach the server and the dashboards people sign in to: trust its administrators, and any reviewer it uses, accordingly. Gateway requests are masked on the server; Claude Code masks with its plugin, and the server checks each of its requests (the connected helper runs in Windows terminals). The server is a company control point only when network rules stop direct access to the providers.

An administrator sets the server up in their own terminal: its administration and latet connect refuse to run inside an AI agent, since they hold the keys to everyone's space. An agent can still explain the steps and check the machine: point it at llms-server.md.

See server setup, connection and administration and server operations.

Privacy guarantees and limits

For Latet running locally on your computer, the intended guarantees are:

• Values it detects are replaced before the request leaves your machine, and the mapping to the originals stays local.
• In client mode, the daemon never modifies a request; it can only block one that carries a value the detectors find in clear.

What it cannot do:

• Only what the detectors recognize is masked. Unusual formats, encoded values or personal data in free text can pass through. Names in free text need the optional local name model or the local reviewer, and both are best effort.
• The text in images is masked only with the optional text recognition, and best effort: text it does not read leaves as it is. PDFs and other documents are not read: they are sent as they are and flagged, or not sent at all with the max profile or images: block.
• claude.ai connectors (Gmail, Calendar, Slack...) run on Anthropic's servers, so Latet keeps the fakes in their arguments: a connector searching for a masked name searches for the fake one.
• Uncovered surfaces (Claude Desktop Chat and Cowork, cloud sessions, Cursor) are out of reach.
• Context still leaks: file names, code structure and the surrounding text are sent as they are, and fakes keep the shape of the original.
• Latet is not a sandbox.

For a connected deployment, see the server trust boundary. See What is and isn't protected and the threat model.

Roadmap

What comes next is on the roadmap, and what changed in each version is in the changelog.

Latet Enterprise

Latet Enterprise is for a company whose security team sets the rules for everyone. On top of the Community Edition it adds rules for everyone that nobody can lower, central approvals of changes that lower protection, single sign-on, audit reports and events for a SIEM. It is coming: join the waitlist to hear when it is out.

Bugs and feature requests

Found a bug, or missing a feature? Open an issue: bugs and feature requests are tracked there, and that is where you get an answer.

• A bug: what you did, what you expected and what happened instead, with the output of latet version and latet doctor, your agent and your operating system.
• A feature: what you are trying to do, and what Latet does today. A concrete case (the value that should be masked, the agent you use) says more than a general description.

Use invented values in an issue, never a real key, password or someone's data. A security problem is not an issue: report it privately, as SECURITY.md explains.

Contributing and security

Pull requests are welcome: CONTRIBUTING.md explains the development setup and the checks CI runs. For a new feature, open an issue first, so that what it does is agreed before the code. Your first pull request accepts the contributor license agreement: you keep your copyright. To report a vulnerability, follow SECURITY.md; please do not open a public issue for it.

License

Latet is source-available under the Latet Sustainable Use License. The Community Edition is free for everyone, companies of any size included, for their own work, for personal use and for any non-commercial use. Selling Latet, offering it to others as a service, building it into a product you sell or making a commercial fork of it needs a commercial license: write to info@latet.ai. The files in ee directories are the Enterprise Edition, under the Latet Enterprise License. LICENSING.md explains it in plain words, and THIRD_PARTY_NOTICES.md lists the third-party components and their license texts (generated by scripts/gen_notices.py).

Acknowledgements

Latet stands on the work of these projects. Thank you to their authors and contributors.

Vendored or ported code

Runtime dependencies

Optional local name detection (latet[ner])

Optional text in images (latet[ocr])

Optional Latet on a server (latet[server])

Dashboard and documentation site

Development

Prior art and inspiration

Latet learned from projects that explored the same space before it: Stacklok's CodeGate (now archived), a local gateway that redacted secrets for AI coding assistants; PasteGuard, a local-first privacy proxy; LiteLLM's Presidio guardrail for masking PII in LLM traffic; and two tools for looking at what Claude Code actually sends, claude-code-proxy by seifghazi and claude-trace by badlogic.