TL;DR
- See what leaves your session. shim-cli is a local hook and proxy that shows token flow, costs, and sensitive information in requests from your coding agent.
- Mask tool results before the model reads them. The hook masks detected secrets and personal data. The watch proxy forwards requests unchanged.
- Know the boundaries. No account, no telemetry; macOS and Linux only. Directly typed prompts in Claude Code/Codex and shell output are outside its masking coverage. Detection is best effort, not DLP.
What is shim-cli
shim-cli is an open-source privacy tool for AI coding assistants, licensed under Apache-2.0. It provides a local hook and proxy for Claude Code, Codex, Copilot CLI, and VS Code.
It helps answer a practical question: what is my coding agent actually sending to the model? You can inspect token flow, costs, and sensitive information in requests. Its hook can also mask secrets and personal data in tool results before the model reads them.
It runs locally, requires no account, and has no telemetry.
Why now
On , OpenCode disclosed an incident in which some users’ AI-provider API keys may have been exposed.
That disclosure gives this review a specific focus: visibility into what a coding agent sends, and the boundaries of local masking. Seeing sensitive information and preventing it from reaching a model are different capabilities. Both matter when evaluating shim-cli.
How it works
There are two behaviors to keep separate when trying the tool.
The local proxy
shim watch -- claude sends one session through a local proxy. It shows token flow, costs, and sensitive information, while forwarding requests unchanged.
The local hook
The hook masks detected secrets and personal data in tool results before the model reads them. The limitations below define where that protection stops.
The diagram describes the hook’s masking path. Watch mode observes and forwards unchanged; shell output is reported but not masked.
Hands-on test
Testing note. This is a walkthrough to run, not a record of completed tests. Screenshots and observed results are still to be added.
01 Install shim
On macOS or Linux, use the supplied installation command:
uv tool install --python 3.12 shim02 Run the Claude demo
Start with the demo command, then capture the terminal output for this review.
shim demo claude
03 Install the Claude hook
Use the installation command for Claude. Evaluate tool-result masking separately from watch mode.
shim install claude04 Observe a session
Route one Claude session through the local proxy:
shim watch -- claudeInspect the token flow, costs, and sensitive-information reports. Remember that this command forwards requests unchanged; it is an observation step, not evidence of masking.
Limitations
The author acknowledges the following boundaries:
- Direct prompts are not intercepted. Content typed directly into prompts in Claude Code or Codex is not caught.
- Shell output is not masked. It is reported, but sensitive content in shell command output is not masked.
- Platform support is limited. shim-cli supports macOS and Linux only.
- Detection is best effort. This is not a data loss prevention (DLP) system.
Evaluate visibility and masking separately. A report of sensitive data is not the same as a guarantee that it was blocked.
FAQ
Is shim-cli open source?
Yes. shim-cli is open source and licensed under Apache-2.0.
Which coding tools does shim-cli support?
shim-cli is a local hook and proxy for Claude Code, Codex, Copilot CLI, and VS Code. It supports macOS and Linux.
Does shim-cli require an account or collect telemetry?
No. shim-cli requires no account, has no telemetry, and runs locally.
Does shim watch mask sensitive information?
No. shim watch -- claude routes one session through a local proxy to show token flow, costs, and sensitive information. It forwards requests unchanged. Masking of secrets and personal data in tool results is handled by the local hook.
Can shim-cli protect everything I send to a coding agent?
No. It cannot intercept content typed directly into prompts in Claude Code or Codex. Shell command output is reported but not masked. Detection is best effort, not DLP.