Cloakroom
Masks API keys, passwords and personal data before your coding agent sees them, and puts the real values back when it writes or runs.
- AI tool
- Free
Pricing
Free and open source (Apache-2.0).
Overview
Cloakroom runs as hooks around a coding agent's tool calls in Claude Code, Codex, Gemini CLI or Cursor. When the agent reads a file, command output or an MCP result, pattern rules and a small local model swap secrets and personal data for placeholders such as PII_SECRET_1, and the real values stay in an encrypted vault on your machine. When the agent writes a file or runs a command, the placeholders get their real values back just before it runs. It also stops prompts that contain secrets, keeps keys out of git commits and can scan old agent chats for personal data you typed. Coverage differs from tool to tool, and its security results are the project's own tests rather than an outside audit.
Key features
- Local masking of keys, passwords and personal data
- Real values restored in writes and commands
- Encrypted local vault, key in the OS keystore
- Keeps keys out of git commits
- Scans old agent chats for personal data
- Plugin for Claude Code; installer for Codex, Gemini CLI and Cursor
Use cases
Show all 9Show fewer
Alternatives
Last updated 2026-11-11