shim Guard

Local, offline privacy protection for coding-agent prompts.
getshim.tech

shim Guard scans prompts through native client hooks before they reach the model. Safe prompts continue silently; detected values are replaced with typed placeholders such as <EMAIL_1>.

[!WARNING] shim Guard is alpha software and a best-effort guard, not a data-loss prevention boundary. Read the privacy limitations before using it with sensitive data.

Supported clients

shim Guard detects email addresses, phone numbers, credit cards, IBANs, IP and MAC addresses, US SSNs, Turkish national and tax IDs, secrets, and database URIs. Detection runs locally without an account, API key, network request, daemon, telemetry, or prompt history.

Install

shim Guard supports CPython 3.13 on macOS and Linux. Choose one package manager:

uv tool install --compile-bytecode shim-guard
# or
pipx install shim-guard

Preview and install the hook for your client:

shim install codex --dry-run
shim install codex
shim doctor codex

Replace codex with claude or copilot as needed. Run shim help for all commands.

Marketplace plugins

Codex and Claude Code users can install the repository's marketplace plugin after installing the CLI:

codex plugin marketplace add GetSHIM/shim-guard
codex plugin add shim-guard@shim-guard

/plugin marketplace add GetSHIM/shim-guard
/plugin install shim-guard@shim-guard

The marketplace plugin and shim install are alternative installation methods. Do not use both for the same client.

Use

Once the hook is installed, use your client normally. To inspect text directly, pipe it through scan or redact:

printf '%s' 'Contact me at alice@example.com' | shim scan
printf '%s' 'Contact me at alice@example.com' | shim redact

Both commands read standard input. Do not pass real prompts as command-line arguments, where they may be recorded in shell history or process listings.

Configure detection

All supported entity types are enabled by default. View or change the local policy with:

shim config
shim config --only EMAIL --only SECRET
shim config --disable IP_ADDRESS --disable MAC_ADDRESS
shim config --reset

Changes are previewed before they are saved. The CLI, installed hook, scan, and redact all use the same policy.

Privacy limitations

• The host client receives the raw prompt before its hook runs, and other hooks may receive it concurrently.
• Detection is best-effort and may miss sensitive values.
• A disabled, untrusted, crashed, or timed-out hook may fail open according to client behavior.
• Clients, providers, and other tools may retain data independently of shim.
• Redacted temporary files may still contain missed sensitive content. Review them before resubmission and delete them when finished.

See Privacy for the full trust boundary and Compatibility for tested versions and evidence.

Uninstall

Remove shim Guard's hook before uninstalling the package:

shim revert codex

Replace codex with the client you installed.

Project documentation

• Architecture
• Compatibility
• Privacy
• Contributing
• Security policy

License

Apache-2.0. See LICENSE.