See what your coding agent sends. Mask what you can.
An open-source hook and local proxy for Claude Code, Codex, Copilot CLI and VS Code. In Claude Code it masks secrets and personal data in tool results before the model reads them, and shim watch shows what a session sent and cost. No account, no telemetry.
Hi Product Hunt, I'm Mertcan, one of the makers of shim-cli.
We built it because we wanted to see what our own coding agents send to the model. A request carries a lot more than your prompt: the system prompt and the tools array, plus every file the agent read along the way. When the agent opens a .env, the keys in it go to the model too, and nothing in the session tells you.
shim-cli sits next to the agent you already use and runs on your machine:
• shim install claude adds hooks to Claude Code. When a tool result holds an API key, a password, an email, an IBAN, a phone number or a Turkish ID number, the model gets a placeholder like <SECRET_1> instead. • shim watch -- claude runs one session through a local proxy and prints where the input tokens went, what the session cost (or would cost on an API key), and which sensitive values were in the request and the response. It forwards every byte unchanged.
There's no account and no telemetry, and the hook adds no network destination. Codex, GitHub Copilot CLI and VS Code are supported too, with less coverage.
What it cannot do, so you know before you install: • A prompt you type into Claude Code or Codex is not masked, because neither client lets a hook rewrite it. shim reports it, or stops it under enforce. Copilot CLI does get the masked prompt. • In Claude Code, shell commands, the output of a failed command and files attached with @ are reported, not masked. • Codex and Copilot CLI tool traffic is not inspected, and VS Code only reports. • Detection is best effort and misses some values. It is not a DLP boundary. • macOS and Linux only. Windows is first on our list.
Try it in a minute: uv tool install --python 3.12 shim shim demo claude shim install claude
It's Apache-2.0 on GitHub. The feedback we want most: what shim missed in your own sessions, and which client we should go deeper on next.
About shim-cli on Product Hunt
“See what your coding agent sends. Mask what you can.”
shim-cli launched on Product Hunt on October 18th, 2026 and earned 152 upvotes and 20 comments, earning #3 Product of the Day. An open-source hook and local proxy for Claude Code, Codex, Copilot CLI and VS Code. In Claude Code it masks secrets and personal data in tool results before the model reads them, and shim watch shows what a session sent and cost. No account, no telemetry.
On the analytics side, shim-cli competes within Open Source, Privacy, Developer Tools and GitHub — topics that collectively have 643.1k followers on Product Hunt. The dashboard above tracks how shim-cli performed against the three products that launched closest to it on the same day.
Who hunted shim-cli?
shim-cli was hunted by Mertcan Sağlam. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of shim-cli including community comment highlights and product details, visit the product overview.
Mertcan Sağlam
Hi Product Hunt, I'm Mertcan, one of the makers of shim-cli.
We built it because we wanted to see what our own coding agents send to the model. A request carries a lot more than your prompt: the system prompt and the tools array, plus every file the agent read along the way. When the agent opens a .env, the keys in it go to the model too, and nothing in the session tells you.
shim-cli sits next to the agent you already use and runs on your machine:
• shim install claude adds hooks to Claude Code. When a tool result holds an API key, a password, an email, an IBAN, a phone number or a Turkish ID number, the model gets a placeholder like <SECRET_1> instead.
• shim watch -- claude runs one session through a local proxy and prints where the input tokens went, what the session cost (or would cost on an API key), and which sensitive values were in the request and the response. It forwards every byte unchanged.
There's no account and no telemetry, and the hook adds no network destination. Codex, GitHub Copilot CLI and VS Code are supported too, with less coverage.
What it cannot do, so you know before you install:
• A prompt you type into Claude Code or Codex is not masked, because neither client lets a hook rewrite it. shim reports it, or stops it under enforce. Copilot CLI does get the masked prompt.
• In Claude Code, shell commands, the output of a failed command and files attached with @ are reported, not masked.
• Codex and Copilot CLI tool traffic is not inspected, and VS Code only reports.
• Detection is best effort and misses some values. It is not a DLP boundary.
• macOS and Linux only. Windows is first on our list.
Try it in a minute:
uv tool install --python 3.12 shim
shim demo claude
shim install claude
It's Apache-2.0 on GitHub. The feedback we want most: what shim missed in your own sessions, and which client we should go deeper on next.