ContextVeil

ContextVeil is a free, open-source CLI tool written in Rust that prevents accidental credential exposure when using AI coding agents. It intercepts model-bound text locally and replaces exact enrolled secret values — such as API keys, tokens, and passwords — with safe placeholders before they reach the LLM. The project is maintained by daniel-sc on GitHub under the MIT OR Apache-2.0 dual license, with no account, hosted service, or network calls required at runtime.

What It Is

ContextVeil sits between your coding agent and the LLM, performing local exact-text replacement on model-bound output. When a coding agent reads a .env file or runs printenv, the output still flows through — but any enrolled secret value is swapped for a labeled placeholder like <SECRET:API_TOKEN>. The tool is deliberately narrow: it does not scan arbitrary text for secret patterns at runtime, does not block file reads or commands, and does not act as a general security boundary. It is a guardrail against accidental exposure, not a comprehensive secrets management system.

How the Workflow Works

Setup is interactive and guided. Running contextveil setup walks through:

• Global secrets used across projects
• Project-specific secrets from .env, JSON, Java properties, npmrc, and INI files
• Coding-agent integration installation
• An offline verification step (contextveil doctor)

ContextVeil stores where to find each value (e.g., "the API_TOKEN environment variable" or "the STRIPE_KEY entry in .env.local") rather than copying the value itself. At runtime, it reads the current value from the enrolled source for each supported event, performs literal case-sensitive matching, and exits. There is no daemon, no persistent logging, and no telemetry.

Configuration is split between a global file at ~/.config/contextveil/config.toml and a per-project .contextveil.toml. The two files are additive.

Coding Agent Integrations

ContextVeil supports four coding agents at varying stability levels:

• Claude Code — Production support; replaces string values in successful tool results that Claude allows hooks to replace; fails open if the hook crashes
• OpenAI Codex CLI — Experimental; covers supported successful tool results; replacement becomes plain text and may lose structure
• GitHub Copilot CLI — Experimental; covers transformed user prompts and successful text tool results
• OpenCode — Experimental; covers new user text and successful standard tool output on the V1 plugin API; a detected problem stops the covered operation

All fail-open integrations (Claude, Codex, Copilot) allow the coding agent to continue with original content if the hook is bypassed, disabled, or crashes.

Known Source Rules and Secret Discovery

During setup, ContextVeil applies a maintained vocabulary of secret-like name patterns — including terms like token, secret, password, key, apikey, and clientsecret — to automatically suggest candidates from environment variables, dotenv files, Java properties, npmrc, and INI files. It also detects credential-bearing URLs regardless of key name. Common literals (true, yes, null, none, template references like ${NAME}) are excluded from automatic suggestions to reduce false positives. Manual enrollment is also supported for any of the covered file types.

Platform and Security Limits

V1 supports Linux (including WSL on Windows) and macOS on x86_64 and arm64. The tool explicitly documents its boundaries:

• Only current, exact enrolled values are matched; encoded, split, hashed, or transformed variants are not detected
• Coverage applies only when the coding agent loads and honors the installed integration
• Cloud, remote, container, and company-managed agent setups require their own working installation
• Short or common enrolled values can produce false-positive replacements in ordinary text

Update: ContextVeil 1.1.0

The latest release is v1.1.0, published on 2026-09-16, following the initial v1.0.0 stable release. The project was created in August 2026 and is under active development, with 5 open issues and recent pushes to the main branch. The changelog, specification, limitations, and architecture documents are maintained alongside the source in the repository.