by Shanjeev Rajendran
Cloakroom review, pricing and verdict
Masks secrets and personal data before your coding agent sees them.
- Best for
- Developers using coding agents on real configs
- Not for
- Teams that need a hard sandbox or Windows support beyond Claude Code
Should you use Cloakroom?
Pick Cloakroom if you let a coding agent read real config files and want secrets masked on your machine first. Its own benchmark reports no keys leaking among 77 vendor-format keys. Skip it if you need a sandbox or cannot spare a large model download: it is not one and has known gaps.
Real values return only in local writes and commands, so the agent can still edit config files that hold secrets.
The edge is a benchmarked detection model plus per-agent hook coverage, which others could replicate, and it is maintained by one person.
Also for
- Freelancers with client data
- Developers who let Claude Code, Codex or Cursor read real .env files and logs
Show 2 more
- Freelancers handling client data in code repositories
- Security-minded teams auditing what coding agents have already seen
Main trade-off
False alarms, and gaps the author lists, such as failed-command output and Cursor Tab completion.
Cloakroom pricing
Apache-2.0 licence. Free and open source, with no paid tier or hosted service listed. The one-time model download is the only cost.
Install Cloakroom
/plugin marketplace add shanjeevrajendran/cloakroom
Before you start
- In Claude Code, run the marketplace line above, then /plugin install cloakroom@cloakroom, and restart it
- For the other three agents (Mac or Linux): uv tool install "cloakroom[model,torch,ocr]", then cloakroom install codex (or gemini, or cursor)
- Codex skips new hooks until you trust each Cloakroom entry once with /hooks
- Run cloakroom doctor afterwards; every line should say ok
Works with
- Claude Code
- Codex CLI
- Gemini CLI
- Cursor (editor and command-line agent)
Required runtime
- Claude Code on Mac, Windows or Linux, or Codex, Gemini CLI or Cursor on Mac or Linux
- Python 3.10 or newer (the plugin installs the program with uv, pipx or Python)
- A one-time model download, unless you run rules-only
Where it runs
- Desktop
- CLI
Data it can reach
- File reads, command output and MCP results seen by the agent
- Typed prompts, which are stopped when they hold a secret
- Images and PDFs, read locally with OCR
- A local encrypted vault of placeholder pairs, with its key in the OS keystore
The permissions this connector asks for, as its own documentation states them.
What Cloakroom can do
13 actions an agent can call. Open one for its parameters and an example.
doctorChecks this machine: Python, the vault key store, the model and the local service, printing ok or warn for each line.
Example call
cloakroom doctor
Returns
| Field | Type | Description |
|---|---|---|
| report | text | One ok or warn line per check, with the fix for each warning. |
check, explain and maskPreviews what would be masked in a file and why; mask prints the masked copy.
Example call
cloakroom check config/prod.env
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| file | string | Required | Path of the file to preview. |
Returns
| Field | Type | Description |
|---|---|---|
| summary | text | Counts of what would be masked by kind, for example SECRET x2, or the masked text for mask. |
exposureLists the keys and passwords your coding agents saw, from the Cloakroom log and old agent transcripts, with a rotate list; hints only, never the values.
Example call
cloakroom exposure --since 2026-10-01 --personal
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| --since | string | Optional | First day to look at, as YYYY-MM-DD. |
| --personal | booleandefault false | Optional | Also look for personal data you typed in old chats; slow and uses the model. |
| --format | stringdefault text | Optional | text or json. |
Returns
| Field | Type | Description |
|---|---|---|
| exposure | text | Which keys and passwords were seen, and which to rotate. |
giveHands the agent a key without typing it into a prompt: you type it hidden, the agent gets a placeholder, and local files and commands get the real value.
Example call
cloakroom give STRIPE_KEY --hours 8
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| name | string | Optional | What to call the value, such as STRIPE_KEY. |
| --list | booleandefault false | Optional | Show names and hints for this project, never values. |
| --forget | string | Optional | Remove one stored name. |
| --hours | numberdefault 24 | Optional | How long the value stays available. |
Returns
| Field | Type | Description |
|---|---|---|
| placeholder | string | The placeholder the agent can use in place of the value. |
installAdds Cloakroom hooks to Codex, Gemini CLI or Cursor, or installs this repository git hook that checks what a commit or push adds.
Example call
cloakroom install gemini
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| target | string | Required | codex, gemini, cursor or git-hook. |
Returns
| Field | Type | Description |
|---|---|---|
| status | text | What was set up; Codex asks you to trust each new hook once with /hooks. |
dashboardOpens the local dashboard in your browser, with recent alerts you can label Correct or Missed something and turn into rules.
Example call
cloakroom dashboard
Returns
| Field | Type | Description |
|---|---|---|
| page | web page | Alerts with the tool, the file and what was masked. |
scanLists the commands this repository agent and editor configuration would run, across Claude Code, Codex, Gemini CLI and VS Code tasks, and flags the npm-worm shape.
Example call
cloakroom scan
Returns
| Field | Type | Description |
|---|---|---|
| commands | text | Each command the config would run, with flags on suspicious ones. |
proxyRuns a local proxy that masks what a tool sends to its AI company, or points Claude Code, Codex CLI or Gemini CLI at it.
Example call
cloakroom proxy install codex
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| install | string | Optional | Which tool to point at the proxy: claude, codex or gemini. |
Returns
| Field | Type | Description |
|---|---|---|
| proxy | service | A local masking proxy on your machine. |
Show all 13 actions
allowLets the one command Cloakroom last held run once; it refuses to run in an agent shell or without a terminal.
Example call
cloakroom allow
Returns
| Field | Type | Description |
|---|---|---|
| result | text | Confirmation that the held command may run. |
updateUpdates Cloakroom with the installer you used (uv, pipx or pip), then sets up the checks again for Codex, Gemini CLI and git where they were set up.
Example call
cloakroom update
Returns
| Field | Type | Description |
|---|---|---|
| result | text | The new version and the hooks set up again. |
reportPrints counts per day and session from the event log, with no values; verify checks the log.
Example call
cloakroom report --verify
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| --verify | booleandefault false | Optional | Check the log itself. |
Returns
| Field | Type | Description |
|---|---|---|
| counts | text | Counts of masked items and skipped checks per day and session. |
clean-historyFinds keys and passwords in old Claude Code transcripts and replaces them.
Example call
cloakroom clean-history
Returns
| Field | Type | Description |
|---|---|---|
| result | text | The transcripts changed. |
cr: prompt commandsTyped by you at the start of a prompt: cr! sends one prompt unchecked, cr: pause and cr: resume control prompt checks, and cr: allow approves a held hook or MCP server.
Example call
prompt: "cr: pause 10m"
Parameters
| Parameter | Type | Needed | Description |
|---|---|---|---|
| pause | string | Optional | A duration such as 10m, after which checks resume. |
Returns
| Field | Type | Description |
|---|---|---|
| effect | text | These never reach the model; tool output stays masked throughout. |
What Cloakroom is for
Cloakroom is an open-source plugin and hook set that replaces API keys, passwords and personal data with placeholders before Claude Code, Codex, Gemini CLI or Cursor read them, and restores the real values only in local writes and commands. It runs a local vault and model, and version 1.4.0 shipped on 8 November 2026.
Placeholders in, real values out
Secrets and personal data become stable placeholders for the session, and the real values return only in writes and commands that run locally.
Four agents, with a coverage table
The README lists per agent what is masked, held or not covered, from prompts to images and PDFs.
Fails closed
When a check cannot run, the agent file reads and commands wait instead of passing unchecked.
Local vault
Placeholder pairs live in an encrypted vault on your machine, with the key in the OS keystore.
Show all 6 features
Learns from corrections
Mark a harmless item once in the dashboard and a rule stops it next time.
Rules-only mode
Setting CLOAKROOM_MODE=rules skips the model, at the cost of missing names and addresses.
What people use it for
Let an agent read a production .env
The agent sees DATABASE_URL with PII_SECRET_1 where the password is, while the file on disk keeps the real value.
Find out which keys your agents already saw
cloakroom exposure lists the keys and passwords from your log and old transcripts as a rotate list, with hints and never the values.
Give the agent a key without pasting it
cloakroom give STRIPE_KEY asks for the value in a hidden prompt and hands the agent a placeholder that local commands expand.
Audit a repository before trusting its agent config
cloakroom scan lists the commands the config would run and flags the npm-worm shape.
Keep keys out of git commits
The README marks key-free commits as covered for all four agents, and the install command can add a git hook.
Strengths and limits
Strengths
- The agent still gets the job done: it knows a person, an email and a password exist and where, so edits and commands work, and real values are restored locally.
- It holds an action when it cannot check, and the shell an agent uses is blocked from running the approve command or switching Cloakroom off.
- The documentation is frank about gaps: the README has a section called What it isn't, and a limits file lists what it does not catch.
- The benchmark method is public in bench/RESULTS.md, including competitor adapters and the false-alarm cost.
Limits
- False alarms are the author's main open problem: in the author's own benchmark it masked 60 harmless items among 200 clean ones.
- It is not a sandbox, and some paths are uncovered: Cursor Tab completion, vendor-side web search, and the error output of failed Claude Code commands (limits file).
- Setup is heavy: a model download of about 1 GB on a Mac and up to about 4 GB elsewhere, and Codex, Gemini CLI and Cursor support is Mac and Linux only.
- It is a one-person project (SECURITY.md) and its benchmarks are run by its author; no independent test was found.
Cloakroom alternatives
The nearest AI agent skills on Hokai for the same job.
| Skill | Works with | Connects by | Checked |
|---|---|---|---|
| Cloakroom This page | Claude · Codex · Cursor · Gemini | Skill file | 11 Nov |
 AisyncAdvisory file claims and a shared journal for your AI coding agents. | Claude · Codex · Cursor | Skill file | 11 Nov |
 FactIQGives an agent read-only SQL over 100M+ official economic and financial series. | Claude · ChatGPT · Codex | MCP | 21 Oct |
 KrolikSelf-hosted MCP server that gives coding agents a call graph and review memory | Claude · Cursor · Windsurf | MCP | 21 Oct |
Cloakroom facts
- Protocol
- Custom
- Latency class
- Fast
- Open source
- Yes
- Maintainer founded
- 2026
- Team size
- 1
What changed
Questions about Cloakroom
What does Cloakroom cost?
Nothing: the README says it is free and open source under Apache-2.0, and no paid plan or hosted service is listed. Your cost is disk space and bandwidth for the detection model, which the project site sizes at roughly 1 GB for a Mac and as much as 4 GB on other systems.
Can I run Cloakroom without the model download?
Yes, set CLOAKROOM_MODE=rules to use pattern rules only. The author's results show the cost: on one held-out set of 320 planted values, rules-only let through 138 and full mode 15, because names and addresses with no fixed pattern need the model.
Does Cloakroom send my secrets anywhere?
The README says nothing leaves the machine except the one-time model download. Placeholder pairs are kept in an encrypted local vault. In proxy mode for Codex signed in with ChatGPT, masked requests are forwarded to chatgpt.com, according to the 1.2.0 changelog.
Can the agent switch Cloakroom off or approve its own held command?
Not by the routes the author tested: since 1.3.0 the agent shell cannot run cloakroom allow or uninstall, and a hook or MCP server it writes into agent config is held until you type cr: allow. The 1.4.0 notes still list a known limit: a command built piece by piece at run time can read the vault key.
What happens when I paste a key into a prompt?
The prompt is stopped and a safe copy with placeholders is offered for Claude Code, Codex and Gemini CLI, because hooks can block a prompt but not rewrite it. Claude Code still keeps the blocked text in its local session records on disk, and starting a prompt with cr! sends it unchecked.
About Cloakroom
Cloakroom is an open-source privacy gate for AI coding agents, made by one developer, Shanjeev Rajendran. It is a skill rather than an app: a Claude Code plugin, plus hooks for Codex, Gemini CLI and Cursor, that the agent runs before and after each tool call. It swaps API keys, passwords and personal data for placeholders such as PII_SECRET_1, and puts the real values back in the files and commands the agent writes. The repository was created on 11 October 2026 and the current version is 1.4.0, released on 8 November 2026.
Read the full background
Rules and a small local detection model find the values, and the pairs sit in an encrypted vault whose key is held in the operating system keystore. If Cloakroom cannot check something it holds the action instead of letting it through. A typed prompt that contains a key is stopped rather than rewritten, because agents let a hook block a prompt but not change it. On 11 November 2026 Hokai installed 1.4.0 from PyPI without the model and ran check and mask in rules-only mode on a made-up file: it masked two secrets, an email address and a street address, and left a person's name and a 555 phone number alone.
The numbers below come from the author's own repository and are self-published. On held-out sets of made-up agent traffic, first runs, Cloakroom let through 0 of 1,005 personal details and 4 of 334 critical values while masking 60 harmless items among 200 clean ones; the other tools tested let through 119 to 992 personal details. On 77 keys in real vendor formats it let through none, with 3 false alarms among 15. The author names false alarms as the main open problem.
Look elsewhere if you need a sandbox: the README says it is not one, and an agent still runs as you. The limits file lists gaps, including the error output of failed commands in Claude Code, which can reach the model unmasked. The author's benchmark compares it with maisecrets, sensitive-canary, claude-code-redact and redact-hook, none of which Hokai lists yet. More connectors are on the developer skills list.
Version 1.2.0 added Cursor editor coverage and 1.3.0 stopped an agent from approving its own held call, both on 1 November 2026 per the changelog, and 1.4.0 added a search for personal data in old Codex, Cursor and Gemini CLI chats.
Sources and guides
Official sources
- Cloakroom official site Vendor
- GitHub repository GitHub
Protocol, authentication, permissions and the call contracts on this page are read from Shanjeev Rajendran's own documentation. The verdict is Hokai's reading of them, not the maintainer's claim.
Lists that include Cloakroom
More Agent Skills on Hokai
Dryplate MCPLocal image tools for agents: convert HEIC, resize, strip metadata.
MantisA local browser for agents that returns compact numbered text, not screenshots.
Mitra MCPLets Claude or ChatGPT ask your Mitra assistant to make calls and report back.
Resend MCP ServerOfficial MCP server that lets an AI agent send mail and work Resend inboxes
Personal Agent ProtocolOpen standard for how personal AI agents sign in and act for customers.Pocket Invoice MCPLets an AI assistant draft, export and email invoices from your account