Launched this week
shim-cli
See what your coding agent sends. Mask what you can.
334 followers
See what your coding agent sends. Mask what you can.
334 followers
An open-source hook and local proxy for Claude Code, Codex, Copilot CLI and VS Code. In Claude Code it masks secrets and personal data in tool results before the model reads them, and shim watch shows what a session sent and cost. No account, no telemetry.
Hi Product Hunt, I'm Mertcan, one of the makers of shim-cli.
We built it because we wanted to see what our own coding agents send to the model. A request carries a lot more than your prompt: the system prompt and the tools array, plus every file the agent read along the way. When the agent opens a .env, the keys in it go to the model too, and nothing in the session tells you.
shim-cli sits next to the agent you already use and runs on your machine:
• shim install claude adds hooks to Claude Code. When a tool result holds an API key, a password, an email, an IBAN, a phone number or a Turkish ID number, the model gets a placeholder like <SECRET_1> instead.
• shim watch -- claude runs one session through a local proxy and prints where the input tokens went, what the session cost (or would cost on an API key), and which sensitive values were in the request and the response. It forwards every byte unchanged.
There's no account and no telemetry, and the hook adds no network destination. Codex, GitHub Copilot CLI and VS Code are supported too, with less coverage.
What it cannot do, so you know before you install:
• A prompt you type into Claude Code or Codex is not masked, because neither client lets a hook rewrite it. shim reports it, or stops it under enforce. Copilot CLI does get the masked prompt.
• In Claude Code, shell commands, the output of a failed command and files attached with @ are reported, not masked.
• Codex and Copilot CLI tool traffic is not inspected, and VS Code only reports.
• Detection is best effort and misses some values. It is not a DLP boundary.
• macOS and Linux only. Windows is first on our list.
Try it in a minute:
uv tool install --python 3.12 shim
shim demo claude
shim install claude
It's Apache-2.0 on GitHub. The feedback we want most: what shim missed in your own sessions, and which client we should go deeper on next.
@mertcansaglam The transparent lists of limitations is helpful and especially since some inputs are the reported rather than masked.
How often have you found the sensitive values slipping through that you didn't expect???
@vipul_kumar1280 Mostly from places we already list as "reported, not masked". The one that surprised me most on my own machine was the output of a failed command: if a command fails, Claude Code doesn't let a hook replace its output, so cat .env && cat missing-file reaches the model as is. shim tells you, but can't stop it. On the detection side, names, postal addresses and passwords without a key name are the usual misses.
@mertcansaglam shim watch is the part I'd try first. my claude code sessions read a spec file per feature at the start of each task and I've never checked how much of the input that ends up being. does it break input tokens down per file the agent read?
@mertcansaglam We run Claude Code on our own code every day, so seeing what a session actually sends, and what it cost, is the part I'd run first. Masking keys from an opened .env before the model reads them is the part that matters most.
@thesshguy Thanks, and great question!
Printing it: yes. When the script runs through the Bash tool, its stdout comes back as a tool result, and shim masks the secrets it detects there before Claude Code hands the output to the model. One honest edge case: if the command fails, Claude Code doesn't let hooks rewrite the output, so shim can only report it and tell the model not to repeat the values.
Sending them out: no. Once the script is running, its own network calls go straight from your machine, and shim-cli isn't in that path. It's not a sandbox or a firewall. We also don't parse or rewrite shell commands, because editing a command changes what actually runs. For that risk, Claude Code's permission settings or a sandboxed environment are the right layer.
Would egress checks for scripts the agent writes be useful to you, or do you already handle that with sandboxing?
Is it a router between me and the provider? Does it make it slower
@bengeekly Good question! No, it's not a router. Your agent still talks to the provider directly. shim-cli runs as a hook inside the agent itself, on your machine, so it only steps in at tool calls: it checks what a tool returns before the model gets it.
On speed: the check runs locally on each tool call, so there's no extra network hop and nothing touches the model's streaming. If you turn on the local ledger, it records how long each check took, so you can see the overhead on your own sessions instead of taking our word for it.
The only proxy-like part is optional: shim watch -- claude runs a loopback proxy on your own machine if you want to see tokens and cost per session.
Which agent are you on? I can tell you exactly where it hooks in for that one.
Coding agents today are reading files, executing commands, and sending all of that information to a model on every step, and in most cases, not many people know what left the machine. This is a new channel of data collection in the development process, and it's barely studied right now.
From my point of view, working at GTM at shim, it's a small niche, but a vital one. It should be a default layer in your stack, like secret scanning and network logging. It will not be a magic solution, but a minimum for every team to enable without creating an account or going through the procurement cycle.
Congrats on the launch! Not seen it mentioned yet, but it feels like this is also useful for observability and avoiding leaking secrets when pushing logs to things like Grafana or SigNoz.
@mertcansaglam - great addition to anyones agentic workflow. Best of luck with the launch.
@codeandsea Thank you! Which agent are you using day to day? Claude Code gets the full masking right now, and Codex and Copilot CLI support is a bit lighter, so I'm curious where people want us to go next.
@mertcansaglam I don't use much agentic coding at the moment, and if I do I mainly use opencode.