Radar / AI security / shim-cli
shim-cli
Open-source hook and local proxy that shows what your coding agent sends to the model and masks secrets in tool results before they reach it.
Why it matters
First tool to pair per-session token and cost visibility with automatic secret masking in tool results for Claude Code - no account, no telemetry, everything runs locally.
What you could build with it
A freelance developer or small agency team could add shim-cli to their standard Claude Code setup so that API keys and client PII read from project files never reach the model, while the watch mode gives them a per-session token and cost breakdown to bill clients accurately.
Does it hold up?
Too early to judge - launched hours ago; the maker's own docs flag it as alpha software and best-effort detection, explicitly not a DLP boundary.
Built with shim-cli
- shim on PyPIPyPI · Official PyPI distribution page for the shim package with install instructions and release history.
- shim 1.2.2 on Libraries.ioLibraries.io · Third-party package metadata page tracking shim's dependencies, release cadence, and maintenance statistics.
- GetSHIM/shim-cligithub · 35 ★ · The shim-cli source itself: local hooks for Claude Code, Codex, Copilot CLI and VS Code plus a session proxy that reports token spend and masks secrets in tool results.
Learn more
First spotted on github: source.
More AI security
iFixAi: independent auditing of AI agentsIndependent AI-agent auditor: 250+ inspections across 69 misalignment categories (red teaming + operational assurance)…security · JEV 0.76Cloudflare security-audit-skill: six-phase agent-driven security audits with independently verified findingsOpen-source MIT coding-agent skill that runs a codebase through six audit phases — reconnaissance, coverage-led…security · JEV 0.74OpenAI, Anthropic and Google DeepMind jointly unveil cyber-focused safety models and safeguardsThe three rival labs disclosed weeks of behind-the-scenes coordination and jointly released a set of cyber-focused AI…security · JEV 0.73OpenAI textGrain watermarking for ChatGPT and Codex in the EUOpenAI will roll out its invisible textGrain watermarking system to ChatGPT/Codex users in the EU over the coming…security · JEV 0.65Cloudflare security-audit-skill: multi-phase security audits for coding agentsA coding-agent skill that runs multi-phase security audits with independently verified, machine-checkable findings.security · JEV 0.63LiveNerf: a pre-registered benchmark for post-release model driftOpen-source, pre-registered 30-day benchmark that detects whether Claude Opus 5.5 quietly gets worse after launch.security · JEV 0.61
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.