FAQ
Short, self-contained answers about what Tokenhush is, what it covers, how it handles your data, and where the project stands today.
Tokenhush is a local base-URL gateway for AI coding tools. Point a tool at its loopback address instead of a provider endpoint, and requests pass through one local gate: detected secrets and PII are replaced with placeholders before the request goes out, and placeholders are restored only on the response path back to your client. It installs no root certificate and performs no system-level interception.
Any tool that accepts a custom base URL or endpoint can route through the gateway, including Claude Code, Codex CLI, Aider, Cline, and Roo Code. tokenhush env prints ready-to-paste snippets for five tools. Continue and Open WebUI connect through a manual base-URL entry. Coverage is limited to traffic from the tools you point at the gateway; the gateway itself does not depend on a specific provider.
Tools that do not expose a configurable base URL are outside its scope: Cursor agent traffic, ChatGPT and Claude desktop apps, and browser web UIs need system-level interception, which Tokenhush does not perform. Detection is also deterministic and precision-first, so values the detectors do not flag still travel. The honest claim is high-confidence interception plus a full local audit trail.
Outbound requests are rewritten on your machine before they are forwarded to the provider you configured. Matches become session-scoped placeholders, and the mapping that can restore them stays in memory, dropped when the gateway restarts. The provider receives the redacted body; values the detectors missed travel as they normally would. Tokenhush runs no intermediary service, so traffic only flows between your machine and the provider you chose.
By default the local audit store keeps metadata only: provider, endpoint, time, byte counts, redaction counts, and sensitive types. Records are append-only and chained with an HMAC so tampering is detectable, and the key is held by the operating system's secure store. Request and response content is not stored unless you explicitly opt in. Default retention is 14 days, and it is configurable.
The core is open source under Apache-2.0, including the gateway, redaction engine, local audit, and CLI. Pro capabilities for teams are in development, and no release date has been announced. The public core stands alone: it builds and runs without any Pro component, and Pro code is kept out of the public repository.
Install the published core with Homebrew on macOS (brew install --cask fregie/tap/tokenhush), a Scoop bucket on Windows, or the signed install script on Linux. Then run tokenhush run to start the local gateway, and tokenhush env <tool> to print the base-URL snippet for your tool. Setup steps are documented in the public configuration guide.
No telemetry is sent by default. The gateway binds to loopback only (127.0.0.1 and [::1]) and keeps its audit data in a local store on your machine, so tokenhush status and tokenhush audit read from that local database. Any future feature that needs network access must be explicit and opt-in rather than a default.
These answers summarize material published in the open-source core: