LLM-Redactor

A local transparent proxy to redact secrets (API keys, PII) before they leave your machine.

• Automatic Redaction: Detects 100+ secret types using Gitleaks-compatible rules.
• Zero Configuration: No need to modify your existing workflows.
• Zero-Latency Streaming: Intercepts and filters SSE streams in real-time.
• Deep JSON Scanning: Recursively traverses nested structures (e.g., Anthropic content blocks).
• Local Audit: Records detected leaks to detections.jsonl.

This is the easiest way to use LLM-Redactor. Just prepend the command to your existing CLI tool. It will automatically set up the proxy and configure environment variables for the session.

go install github.com/wangyihang/llm-redactor/cmd/llm-redactor-exec@latest

Prepend llm-redactor-exec -- to your existing command:

llm-redactor-exec -- claude
llm-redactor-exec -- gemini
llm-redactor-exec -- codex

Upon exiting the session, a comprehensive audit summary will be displayed.

Use this if you want to run a persistent proxy server that multiple tools or background processes can use.

go install github.com/wangyihang/llm-redactor/cmd/llm-redactor-proxy@latest

1. Start the proxy server:

   llm-redactor-proxy --port 4000

2. Configure your environment or tools to use the proxy:

   export HTTP_PROXY=http://localhost:4000
   export HTTPS_PROXY=http://localhost:4000
   # Now run your tools normally
   claude

Email addresses are automatically detected and replaced with stable fake addresses generated for the session. The LLM's response is transparently unredacted before it reaches you, so you see real addresses in replies.

Input:  "Please review john.doe@acme-corp.com's PR"
Sent:   "Please review olivia.walker@example.net's PR"
Output: "Please review john.doe@acme-corp.com's PR"  ← restored automatically

Self-hosted Git repository URLs (HTTPS and SSH) are pseudonymized. The hostname, org, and repo name are each replaced with stable fakes. Responses referencing the fake URL are restored to the real one before display.

Public forges (github.com, gitlab.com, bitbucket.org, etc.) are not anonymized.

Input:  "git clone https://git.acme-internal.com/platform/auth-service.git"
Sent:   "git clone https://randomhost.io/fakeorg/fakeword.git"
Output: "git clone https://git.acme-internal.com/platform/auth-service.git"  ← restored

Input:  "git remote add origin git@git.acme-internal.com:platform/auth-service.git"
Sent:   "git remote add origin git@randomhost.io:fakeorg/fakeword.git"
Output: "git remote add origin git@git.acme-internal.com:platform/auth-service.git"  ← restored

These are not detected automatically. Add them to a custom rules file passed via --redactor-rules (TOML, Gitleaks-compatible format):

# ~/.acme-redactor.toml

[[rules]]
id = "company-name"
description = "Acme Corp brand name"
regex = "(?i)\\bacme[- ]corp\\b|\\bacme corporation\\b"
replace_engine = "company"   # replaced with a realistic fake company name

[[rules]]
id = "employee-name"
description = "Employee full names"
regex = "(?i)\\bjohn doe\\b|\\bjane smith\\b"
replace_engine = "name"      # replaced with a realistic fake person name

[[rules]]
id = "employee-email"
description = "Employee email addresses"
regex = "john\\.doe@acme\\.com|jane\\.smith@acme\\.com"
replace_engine = "email"     # replaced with a realistic fake email address

# exec mode
llm-redactor-exec --redactor-rules ~/.acme-redactor.toml -- claude

# proxy mode
llm-redactor-proxy --redactor-rules ~/.acme-redactor.toml --port 4000

The replace_engine field controls how matches are replaced:

When a replace_engine is set, the same real value always maps to the same fake value within a session, and the LLM's response is automatically unredacted before it reaches you.

All detected leaks are logged to detections.jsonl with full metadata for post-session review.