shim-cli is an open-source command-line tool that runs on your machine next to Claude Code, Codex, Copilot CLI and VS Code. Its purpose is to show developers what their coding agent actually sends to the model, to find secrets and personal data in that traffic, and to mask those values wherever the client allows a hook to rewrite content. The tool is distributed under Apache-2.0 at version 1.2.1, runs on macOS and Linux, and requires Python 3.10 or newer. It is aimed at developers who use AI coding agents on real codebases and want a local, inspectable layer between the agent and the model rather than a hosted service.
AI coding agents read files, run commands and send tool results to remote models, which means API keys, database URIs, customer records and personal identifiers can leave a developer's machine as a side effect of ordinary work. That exposure is hard to see: the agent's request is assembled behind the scenes, and few clients offer a way to inspect or redact it. shim-cli addresses that gap by attaching to the agent itself. It does not require an account, an API key or a network call to shim, and it adds no telemetry, so the inspection happens entirely locally. The product's own framing is deliberately modest: it narrows exposure and is not a data-loss prevention boundary.
At the core is a detector that scans the content an agent sends. It recognizes email addresses, phone numbers, credit cards, IBANs, Turkish national IDs, Turkish tax IDs, API keys and secrets, passwords in config and commands, database URIs, IP addresses, MAC addresses and US SSNs, with Turkish licence plates available as an opt-in. IBANs and Turkish IDs are verified by checksum, so a mistyped number is not reported as a finding. Users can also add their own project names or host formats as patterns, extending the detector to identifiers specific to their environment. A `shim demo` command runs the detector on a made-up sentence and shows the before and after, without installing anything, so the behaviour can be evaluated before any change is made.
Masking is delivered through a native hook installed into the agent. In Claude Code, when the agent reads a file or a tool result holding a key, an IBAN or an email, the model receives a placeholder such as `` instead of the value. The masking happens before the model reads the content. In Copilot CLI the prompt the model receives is replaced with the redacted text, so the original values never reach it. Codex reports what it found in the prompt and lets it through by default, with an enforce mode that blocks it instead. VS Code reports, and with enforcement on it can stop a prompt or deny a tool call before it runs, though a tool result that has already reached the model is only reported.
Visibility is the second half of the product. `shim watch -- claude` runs a local proxy for one command and reports tokens, spend and every secret or personal value that went past. It changes nothing, writes no request to disk and leaves nothing behind. `shim audit` reads the Claude Code session history already stored on disk and counts what reached the model, broken down by kind, by project and by the way it came in, for example a value found in a .env file, in a failed Bash command or in the user's own prompt. It prints no values, keeps nothing and sends nothing. At the end of a turn in Claude Code, a summary shows counts of masked values and flagged items such as an instruction override or hidden text, along with median and p95 overhead.
Overall the approach is local instrumentation rather than a gateway in the cloud. shim-cli is installed with uv (`uv tool install --python 3.12 --compile-bytecode shim`) or pipx, which adds shim to ~/.local/bin. `shim install ` previews the hook change with `--dry-run` and then writes it, while `shim doctor ` checks the result and reports any check that is not passing along with a code and a fix. Claude Code can alternatively be connected through the Claude Code marketplace plugin, and users are told to pick one method, not both. Codex requires a trust step in /hooks before the hook runs. VS Code is configured only through a cloned plugin added to `chat.pluginLocations` in user settings.json.
The project publishes measurements from its released build: more than 2,300 tests run on every release, a median hook cost of 70 ms including interpreter start, and 727 detector cases graded on exact output. The session summary quoted in the documentation shows 62 ms median and 119 ms p95 overhead. These numbers make the cost of running the hook concrete, since it sits in the path of every file read and tool result. The code is on GitHub under Apache-2.0 and can be read, tested and contributed to.
Because shim-cli runs locally and requires no account, the people using it keep control of the inspection. Nothing is uploaded to shim, and the audit output deliberately avoids printing the values it counts. The tool is transparent about its boundaries: a prompt typed into Claude Code or Codex is not masked because neither client lets a hook rewrite it, Codex and Copilot CLI tool traffic is not inspected at all, VS Code masks nothing, and shell commands and file writes in Claude Code are reported or denied rather than masked. Windows is not supported, WSL is not yet verified, and detection is best-effort.
A typical use is a developer working in a repository that contains a .env file. They run `shim audit` first to see what past Claude Code sessions already sent, then install the Claude Code hook so subsequent file reads deliver placeholders instead of credentials. A team reviewing an agent session can run `shim watch -- claude` on a single command to see the token count, the spend and the categories of sensitive values involved, without persisting a request. Before rolling anything out, a developer runs `shim demo` to see the detector's output on a made-up sentence, and `shim doctor` afterwards to confirm the hook is wired correctly. Organisations that need the same detection in front of their own product's AI calls can look at the AI Gateway on Enterprise, which adds audit, budgets and roles.
shim-cli is for developers and teams using Claude Code, Codex, Copilot CLI or VS Code who want local visibility into what their coding agent sends. It is free and open source under Apache-2.0, with the whole CLI on GitHub. The only stated requirements are macOS or Linux and Python 3.10 or newer; the package is installed with uv or pipx, and the VS Code route needs a git clone of the release tag.
In short, shim-cli makes the agent's outbound content inspectable and, where the client permits it, masks secrets and personal data before the model sees them, while showing what a Claude Code session sent and cost. It is a narrow, local, open-source tool that measures its own overhead and states plainly what it does not cover.