deeCtxData Compliant Token Xchange
Apache-2.0Local-firstRust · single binaryZero raw-PII telemetry

Keep PII out of your AI coding agent's prompts.

A local-first proxy between your AI coding tool and the model API. It masks personal data and secrets before they leave your machine, then rehydrates the response: full context, no exposure.

Install free View source
100%
Local, zero egress
1 cmd
Install-and-forget setup
OpenAI + Anthropic
Wire formats
setup · doctor · status
New CLI commands
terminal
deectx setup          # discover tools, wire them, install autostart daemon
deectx doctor         # check which tools are guarded
tool ──▶ [ deeCtx /v1 ] ──mask──▶ upstream (OpenAI | Anthropic | /v1/responses WS)
        [      /\      ]
        └──────┘ rehydrate
01Why it matters

Every prompt you send is a data-export you don't control.

Cursor, Claude Code, Codex, and other AI coding tools send your code and context straight to a remote model API: emails, IBANs, API keys and all, the moment you hit enter. deeCtx strips that out first, without changing how you work.

01Setup that gets out of the way

Guarded in a single command, not a manual config hunt.

deectx setup finds your installed coding agents, wires them to the local proxy, and installs an autostart daemon, backing up every file it touches to .bak. One proxy handles both OpenAI and Anthropic traffic.

deectx setup

Auto-wire Claude Code, Codex, opencode + autostart daemon.

deectx doctor

See which tools are wired at a glance.

deectx status

Live masked / redacted counts from the running proxy.

deectx unwrap

Restore every original config from its backup.

02Live status, always visible

A dashboard and a tray icon, so masking is never a guess.

The local dashboard shows what the proxy has caught today. The Windows tray icon shows whether it is running, right now, without opening a terminal.

deeCtxv0.2.6
559
PII entities kept off the wire today
1,204
requests
486
masked
73
redacted
5
alerts
0
errors
Detected today, by type
email
42%
api_key
27%
credit_card
18%
person
13%
deeCtx: masking active
3:41 PM
  • Green tray icon means masking is active for every wired tool.
  • Hover shows the one-line status; right-click opens start, stop, dashboard, and quit.
  • Headless or Linux machines use deectx status or the dashboard instead of a tray.
03What it solves

Built around the failure modes that actually happen.

Sensitive data uploaded to 3rd-party model APIs
Detects and masks PII / secrets before the request ever leaves your machine.
Conversation context lost when you redact it yourself
Reversible, in-session masking: [EMAIL_1] resolves back to jane@example.com in the response.
Proving what data was processed, for DPIA / compliance
A hash-only, append-only ledger plus an `audit` command; never stores raw PII.
Detector misses or false positives
Pluggable packs: regex + checksum validation, entropy heuristics, and optional NER.
A required classifier going down mid-session
Fail-closed gate: the request is refused (HTTP 503) rather than ever leaking.
A masking bug corrupting a request the model then rejects
Fails open on a masked 400: auto-retries unmasked and logs an error, so your session keeps working.
04How it works

A detector chain runs on every request, in milliseconds.

Regex + checksum validators catch structured identifiers (emails, IBANs, TFNs). A secrets scanner catches API keys. An optional NER model catches free-text PII like names and addresses. Everything merges, gets filtered by your allowlist, then masked and logged to a hash-only audit ledger.

detection pipeline
text → DetectorChain ─┬─ Regex (email, IBAN, cards, … + Luhn/Mod97/ATO-TFN checks)
                      ├─ Secrets (API keys, … + entropy filter) ──► Allowlist ─► Masker ─► tuned text
                      └─ NER (optional, GLiNER: names, addresses, Art.9 health…) ─┘      └► ledger
See supported tools →GDPR & CDR coverage →
05For teams

deeCtx Core is free forever. deeCtx Pro is for proving compliance across a whole org.

A fleet-wide, signed compliance ledger for SMBs and enterprises, currently in active development.

Learn about Pro

Two minutes from install to your first masked prompt.

Cargo, Homebrew, Scoop, or a plain binary: pick whichever fits your machine.

Get startedMeet the developer