Redactproxy

RedactProxy

A local, two-way redaction proxy for Claude Code,
or anything else that speaks the Anthropic Messages API. It sits
between the client and the real API: on the way out it replaces real
client data (domains, IPs, emails, credentials, and more) with stable
fake values, and on the way back it puts the real ones in again. Claude
only ever sees the fakes. Your tool calls still run against real
infrastructure.

Built for pentest and consulting teams who want to use Claude Code on a
live engagement without that client's data reaching the model provider.

Why

When you run an AI coding agent on a live engagement, everything it
touches ends up in the model: client domains, internal hostnames,
credentials out of a config dump, employee emails, the client's own
name. Almost none of it has any reason to leave your machine. The model
doesn't need the real hostname to reason about a finding. It needs one
that stays the same every time it sees it.

That is all redactproxy does. It rewrites the API traffic and nothing
else: no added prompts, no tool restrictions, no change to how Claude
Code behaves. It listens on loopback and refuses to start on any other
address.

How it works

A given real value always maps to the same fake one for the life of an
engagement (one client project), so Claude can still work out that
two hosts belong to the same organization without ever seeing which
organization. Each engagement keeps its own storage and shares nothing
with the others.

"Token" here means a redaction placeholder, not the unit an LLM's
context window is measured in.
Before you point this at real client data: --debug-level anything
above off writes real client values to debug.log in plaintext.
Leave it off unless you are actively debugging, and never share that
file. See…