DataFog plugin
An offline personal-data firewall for agents: a Claude Code hook and a LiteLLM guardrail that mask emails, phones and cards.
- 80 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The hook runs on every tool call and may block it, and in no-confirmation modes ask gives no protection.
Install
- Works in
Manual install
pip install datafogThen hooks in `settings.json` or the plugin `/plugin marketplace add DataFog/datafog-claude-plugin`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The hook runs on every tool call and may block it, and in no-confirmation modes ask gives no protection.
This is third-party code. Review the repository files before installing.
What it does
DataFog is a Python library for detecting and masking personal data. Its agent side has two ready control points. The `datafog-hook` for Claude Code checks tool calls (shell commands, web requests, file writes, MCP) and warns the model when prompts or tool results carry personal data. A check takes about 70–90 ms including process startup. The second point is the `DataFogGuardrail` for the LiteLLM gateway: it masks or blocks data in requests and responses of any provider. By default it looks for `EMAIL`, `PHONE`, `CREDIT_CARD` and `SSN`, and noisier types are opt-in. Found values never reach logs or transcripts. Exceptions go through `allowlist`, and name detection with spaCy and GLiNER is optional.
Who it is for. Teams that let agents work with real customer data and do not want emails, phones and card numbers to leak into prompts and external services.
Good fit when
- The agent runs `curl` and a card number in the request body must stop the call.
- A file read with customer data enters the conversation and the model gets a warning.
- The LiteLLM gateway hides personal data in all requests to providers.
- Test timestamps must not count as phone numbers, so a regex exempts them from the check.
Not a fit when
- You need a guarantee with no exceptions: the check only catches the configured data types.
- The session runs without confirmations while the setting is `ask`.
- Data requires recognising names without installing NLP models.
Example request
Connect datafog-hook to Claude Code in deny mode and test it with a `curl` command carrying a test card number.Limitations
The core finds data with regular expressions, while names and addresses need the extra packages `datafog[nlp]` or `datafog[nlp-advanced]`. The hook asks for confirmation by default: in `--dangerously-skip-permissions` and auto-accept modes the question is approved silently, so those need `DATAFOG_HOOK_ACTION=deny`. The `EMAIL`, `PHONE`, `CREDIT_CARD` and `SSN` types are on from the start and the rest are off for precision. Claude Code hooks are set up by hand in `settings.json`, and the marketplace plugin lives in a separate repository. German identifiers switch on only with an explicit `de` locale.
How to disable. Remove the `datafog-hook` blocks from `PreToolUse`, `UserPromptSubmit` and `PostToolUse` in `settings.json`, then run `pip uninstall datafog`. The plugin comes off with `/plugin uninstall datafog`.
FAQ
How do I install the Claude Code hook?
Run `pip install datafog` and add `datafog-hook` to the `settings.json` hooks. The plugin is easier: `/plugin marketplace add DataFog/datafog-claude-plugin`, then `/plugin install datafog@datafog`.
What does the hook do with findings?
With `ask` it shows what it found and asks you. With `deny` it blocks the call and tells the model to redact values. The prompt and result hooks only warn.
Does it work offline?
Yes, the check runs locally and offline in microseconds inside the library. Found values are not written to logs.
How do I exempt a known safe value?
Pass `allowlist=[...]` for exact values or `allowlist_patterns=[...]` for regexes, for example `^\d{10}$` for timestamps.
How do I connect it to the LiteLLM gateway?
Use `DataFogGuardrail`: a setup example is in `examples/litellm_guardrail/`. It runs in-process with no separate service.
Discussion
No questions or reviews yet.
Related
PluginsA Codex plugin that shows in each session which personal data the agent sees and where it goes.
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
secure-llm-auditor: personal data scanner
secure-llm-auditor
A single-file Python script that finds personal data in text with regexes, anonymizes it and writes a report before a prompt goes to an AI
A Sysdig plugin for Claude Code: cloud onboarding, vulnerabilities, risk analysis and runtime threat investigation.
Local reversible PII redaction for Traditional Chinese documents: placeholder codes and exact restoration after AI processing
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
README in short
The README describes the library and two ready control points, installation with extra profiles, a quick start, an API for LLM applications, German identifiers and engine choice. Speed measurements reproduce with one command.