shutapp-cli 0.1.0

Local Claude Code privacy wrapper: value-first secret redaction proxy.

Shutapp CLI

Shutapp CLI is a local privacy wrapper for Claude Code. It runs claude through a localhost Anthropic-compatible proxy so secrets are redacted before they reach Anthropic, then rehydrated only for local tool execution.

It is separate from the Shutapp hosted API/SDK flow. The CLI is for developers who want local value-first redaction around Claude Code sessions.

Install

py -m pip install --user pipx
py -m pipx ensurepath
py -m pipx install "git+https://github.com/Itaib24/Guardom.git#subdirectory=shutapp"
shutapp-cli --version

pipx install shutapp-cli is the intended PyPI command, but it only works after the public PyPI package is published.

For local development:

pip install -e .[dev]
shutapp-cli status

Run Claude Code

shutapp-cli claude

Useful commands:

shutapp-cli session list
shutapp-cli session show <session-id>
shutapp-cli session purge <session-id> --yes
shutapp-cli detectors list --batch A
shutapp-cli status

Security Model

• Shutapp never needs your Anthropic provider key.
• Anthropic-bound text receives stable placeholders such as [ANTHROPIC_KEY_1].
• The reversible vault stays local and session-scoped.
• Normal assistant text remains placeholdered; local tool inputs are rehydrated so Bash, Write, and similar tools can still run.
• --no-redact is a debug escape hatch and should not be used for real secret handling.

Detector Coverage

The bundled registry uses value-first rules:

• Strong vendor prefixes redact immediately.
• Checksum-backed financial, identity, crypto, and regulated values use validators.
• Weak shapes require context within the engine window.
• Generic fallbacks are last-resort only.

Start with:

• docs/CLI.md
• docs/SECURITY.md
• docs/DETECTORS.md
• docs/PACKAGING.md
• docs/DETECTOR_VERIFICATION.md

Build And Test

python -m pytest tests -q
python -m build
python -m twine check dist/*