veil CLI
Local privacy proxy for coding agents: swaps names, emails and secrets for pseudonyms before anything reaches the model
- 195 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Sits in the path of all agent traffic to the model, keeps keys and grants read access to databases.
- Alpha software with documented limits; a proxy failure could expose or distort data.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/veilDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Sits in the path of all agent traffic to the model, keeps keys and grants read access to databases.
- Alpha software with documented limits; a proxy failure could expose or distort data.
This is third-party code. Review the repository files before installing.
What it does
veil sits between the agent and the model provider on `127.0.0.1:8787`. Before a request leaves, it replaces real names, emails, phone numbers, addresses, ID numbers and secrets with consistent pseudonyms. When the agent runs a command, queries a database or edits a file, veil restores the real values with proper escaping. The model reasons about the real bug but never sees personal data. The command `veil init ~/code/myapp --mcp` finds project data, points Claude Code at veil and adds the `veil mcp-db` tool: a read-only database the agent queries by pseudonym. Claude Code, Codex CLI, Aider and DeepSeek Harness are supported. Keys are kept in the OS keychain.
Who it is for. Developers whose agents read logs, dumps and databases that hold personal data and secrets.
Good fit when
- Production logs contain customer names and an agent should help debug.
- The agent needs database access but the model must not see the real records.
- Secrets and card numbers from the environment must not reach the model provider.
- A team works in Claude Code or Codex CLI and wants consistent privacy rules.
Not a fit when
- You need a guarantee that data never leaves the machine: this is an alpha project with documented limits.
- The agent often reads screenshots: images pass through unscanned.
- There is nothing personal in the data and a proxy would add a failure point.
Example request
Connect veil to the project so the model never sees real customers in logs and the database, and verify it with one request.Limitations
veil is alpha software. The machine is trusted: the vault, the agent's local transcripts and telemetry hold real values. An agent with a shell can invent transforms the authors did not anticipate, and a search on part of a pseudonym cannot match real data. Values shorter than 8 characters are matched verbatim only, and free text about third parties needs the optional NER model (`veil-proxy[ner]`). Cloud providers (Bedrock, Vertex, Microsoft Foundry) are verified against faithful fakes and not live accounts. Screenshots are not scanned.
How to disable. Stop the service with `brew services stop veil`, restore the provider address in the agent settings, uninstall the package with `pip uninstall veil-proxy` and remove the MCP entries from Claude Code.
FAQ
How do I install veil?
Run `pip install veil-proxy`. There is also `brew install lemonadesaltbagel/veil/veil` and a source install through `uv sync`.
How do I connect a database?
`veil init --mcp` registers the `veil mcp-db` tool. By hand: `claude mcp add veil-db --scope local -- veil mcp-db --source N`, with N taken from `veil sources`.
Where are keys stored?
In the OS keychain: macOS Keychain, Linux Secret Service or Windows Credential Manager. CI can use `VEIL_VAULT_KEY` and `VEIL_TOKEN_SECRET`.
Which clients are supported?
Claude Code, Codex CLI, Aider and DeepSeek Harness.
Does the provider see real values?
According to the description, no: names, emails, numbers and secrets are replaced before the request leaves. Screenshots and other limits are covered in the Limitations section.
Discussion
No questions or reviews yet.
Related
CLI toolsA local proxy that replaces secrets and personal data in agent requests before they leave, then restores them in the reply
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
Vahta lets an agent use your passwords and API keys from an encrypted vault without ever showing it the values
A utility keeps keys in the system keychain and injects them at the transport layer, so the agent never sees a value.
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
README in short
The Python project runs as a local proxy with a vault and an MCP tool for reading databases. End-to-end tests with a real Claude Code are described in the Prove it yourself section.