PrivAiTe — AI skill for Claude Code

PrivAiTe

Self-hosted PII redaction proxy for LLM APIs.

[](https://github.com/crp4222/PrivAiTe/actions) [](https://www.python.org/downloads/) [](https://github.com/crp4222/PrivAiTe/blob/main/LICENSE) [](https://pypi.org/project/privaite/)

**A drop-in LLM proxy that replaces PII before it reaches the provider, including inside tool-call arguments and multimodal content, with zero telemetry.**

Told in writing to report its config variables but **never their values**, Claude Code sent 3 of 4 secrets to its provider anyway: the same secrets also sat in a log file the task had it read. Over that session **23 of 24** planted values reached the provider; through PrivAiTe's agent gateway, **2 of 24**. Wire-level captures of real agent sessions, and the two that still get through are documented rather than rounded away: [the measurement](https://github.com/crp4222/PrivAiTe/blob/main/docs/agent-leak-measurement.md), [what it misses](https://github.com/crp4222/PrivAiTe#threat-model).

**Shipped in 0.5.0:** local rules now target the credential fields behind those historical log misses, and overlapping detections respect irreversible and block policies, so a secret overlapping a higher-scored email stays irreversible. See [formats and limits](https://github.com/crp4222/PrivAiTe/blob/main/docs/detection.md#structured-credentials-and-overlapping-types). In the [offline regression replay](https://github.com/crp4222/privaite-bench/blob/main/agent_workflow/STRUCTURED_SECRETS.md), 9 of 10 credential occurrences survived in a 69 KB log before the change; none survived afterward. Processing still takes about 25 seconds with `onnx`.

You type: "Je m'appelle Marie Dupont, email marie@acme.com"
LLM sees: "Je m'appell