Redact secrets and PII before they reach the model— locally, with a metadata-only, tamper-evident audit trail

How it works

One local gate between your AI coding tools and the model API. No root certificate, no system-wide interception.

1. 01

   Point your tool at the gateway

   Start tokenhush run (it listens on 127.0.0.1:8787 by default), then set the base URL for Claude Code, Codex CLI, Aider, Cline, or Roo Code to the local address.

2. 02

   Requests are redacted locally

   The gateway walks the full JSON body and runs six deterministic detectors. Matches become session-scoped placeholders such as __PII_email_9f2c8a4b6d1e__before the request is forwarded upstream.

3. 03

   Originals come back, the audit stays local

   Placeholders in the response are restored and sent only to the client. Every request appends a metadata-only record to a local HMAC hash chain, and the gateway fails safe rather than open.

Supported tools

Any client that accepts a custom base URL can use the gateway.tokenhush env prints ready-to-paste snippets for five tools.

• Claude Code CLI

  ANTHROPIC_BASE_URL

  API-key path supported. Subscription (OAuth) sign-in is still pending a human test.

• Codex CLI

  base_url in config.toml

  Supported in API-key mode.

• Aider

  OPENAI_API_BASE / ANTHROPIC_API_BASE

  Supported.

• Cline

  OpenAI Compatible base URL

  Configure the base URL in settings; supported.

• Roo Code

  OpenAI Compatible base URL

  Configure the base URL in settings; supported.

Install

One CGO-free binary for macOS, Linux, and Windows on amd64 and arm64. Start the gateway, then point your tool at it.

brew install --cask fregie/tap/tokenhush

curl -fsSL https://raw.githubusercontent.com/fregie/tokenhush/main/install.sh | bash

scoop bucket add fregie https://github.com/fregie/scoop-bucket && scoop install tokenhush

Quick start

tokenhush run
eval "$(tokenhush env claude)"
tokenhush status

Full instructions and per-tool setup live in thepublic quick start.

Privacy posture

• No telemetry by default

  The gateway runs on your machine, and the product sends no telemetry by default.

• Metadata-only audit

  Audit records store metadata such as provider, path, byte counts, and detector hits. Content logging is off by default and requires explicit opt-in plus encryption.

• Loopback with guards

  The gateway binds 127.0.0.1 and [::1] only, enforces a Host allowlist, and fails safe rather than open.

• Cookieless site analytics

  This website uses cookieless analytics. See the privacy pagefor details.