PrivAiTe CLI
A local proxy that replaces secrets and personal data in agent requests before they leave, then restores them in the reply
- 66 ★ on the repository
- Last commit
- BSD-3-Clause
Extended access
Why this level
- The proxy sees all outbound agent traffic, system prompts included, and the detector can miss some values
- Gateway routes are open by default and bind all interfaces, so close the port or bind it to localhost
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/privaiteDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The proxy sees all outbound agent traffic, system prompts included, and the detector can miss some values
- Gateway routes are open by default and bind all interfaces, so close the port or bind it to localhost
This is third-party code. Review the repository files before installing.
What it does
PrivAiTe is a Python proxy that sits between your coding agent and a model provider and scrubs every request. An agent reads `.env` files, logs and command output, and all of it goes to the provider. PrivAiTe finds secrets and personal data, replaces them with placeholders such as `[SECRET]` before they leave the machine and puts personal data back into the reply, streaming included. Secrets do not come back: the shipped configs redact them and mask card numbers for good. Detection is local with no telemetry: Presidio and OpenAI's open privacy-filter model catch names and emails, and since 0.8.0 it ships its own `crp4222/privaite-pii-minilm` model behind two presets, `ultrafast` (Apple Neural Engine, 17 ms median) and `minilm` (CPU). Gateway mode speaks the native protocols of agent CLIs, scrubs tool results and tool-call arguments and relays the CLI's own auth upstream untouched. A quick check is `docker run --rm ghcr.io/crp4222/privaite:0.8.2 python -m privaite verify`: it starts a throwaway provider on 127.0.0.1 and shows which planted values leak directly and which the proxy cleans. For Claude Code, run `ANTHROPIC_BASE_URL=http://localhost:8400 claude` and enable `gateway.enabled` in the config.
Who it is for. Developers and teams whose agents read `.env` files, logs and customer data while requests go to a cloud model provider.
Good fit when
- An agent opens an `.env` with keys that must not reach the provider request
- Logs and test output contain customer names and emails that have to become placeholders
- You need a single gateway for Open WebUI, LiteLLM or any OpenAI client on `localhost:8400`
- You need to confirm without API keys that the replacement works, using `verify` in Docker
Not a fit when
- You need a no-leak guarantee: detection is statistical and some values pass
- You need to protect the agent itself: the CLI keeps the real values in its own context and transcripts
- You need to protect system prompts such as `CLAUDE.md`: the system field passes unscanned
Example request
Before sending a request through PrivAiTe, show which values from .env and the log will be replaced with placeholdersLimitations
- Detection is statistical: a value the detector does not recognize reaches the provider. Unknown secret formats, encoded or split values and bare values without their field name may pass.
- It protects the egress, not the agent: the CLI keeps real values in its context and transcripts, and its system prompt and `CLAUDE.md` pass through unscanned.
- The gateway routes accept a request that carries no `PRIVAITE_API_KEYS` value, and the server binds `0.0.0.0` by default with no rate limit: bind it to localhost or keep the port closed.
- This is pseudonymization, not anonymization: the value-to-placeholder mapping lives in memory for a request and surrounding text can remain identifying.
How to disable. Stop the proxy like any process or container and unset `ANTHROPIC_BASE_URL` for the agent. Remove the package with `python -m pip uninstall privaite`.
FAQ
How do I try PrivAiTe without API keys?
Run `docker run --rm ghcr.io/crp4222/privaite:0.8.2 python -m privaite verify`. It starts a throwaway provider and prints which planted values leak directly and which are cleaned.
How do I run the proxy for an OpenAI client?
Run `docker run -d -p 8400:8400 -e PRIVAITE_API_KEYS=change-me -e OPENAI_API_KEY=sk-... ghcr.io/crp4222/privaite:0.8.2` and point the client at `http://localhost:8400/v1`. Replace `change-me` with your own key.
How do I connect Claude Code?
Enable `gateway.enabled` and set the Anthropic `base_url` in the config, then run `ANTHROPIC_BASE_URL=http://localhost:8400 claude`. Also set `pii.detection_cache.enabled: true` so the whole conversation is not rescanned every turn.
Do secrets come back in the reply?
No. The shipped configs redact secrets and mask card numbers for good, while personal data is restored. Per-type behavior changes through the entity overrides setting.
Which preset should I pick?
`onnx` is the default. `light` is faster and needs no model download but misses names. `minilm` and `ultrafast` are opt-in and run the project's own model.
Discussion
No questions or reviews yet.
Related
CLI toolsLocal privacy proxy for coding agents: swaps names, emails and secrets for pseudonyms before anything reaches the model
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Probe finds the network calls of an agent tool run without network and prepares a least-privilege policy draft
Local reversible PII redaction for Traditional Chinese documents: placeholder codes and exact restoration after AI processing
agent-secrets lends keys to an AI agent for a limited time: age encryption, TTL leases, an access log and an emergency revoke.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| PrivAiTe (this card) | no | 66 | |
| DataFog | no | 80 | DataFog masks data through a hook and a LiteLLM guardrail, while PrivAiTe is a standalone proxy and agent protocol gateway that restores data in the reply. |
| gate | no | 214 | Gate redacts database and MCP results before the model, while PrivAiTe scrubs the agent's outbound request to the provider. |
README in short
The README explains that secrets and personal data from `.env` files and logs go to the provider, shows a replacement example, a quick `verify` run, installation, Claude Code and Codex setup, benchmarks, integrations, a threat model and docs.