# veil

> Local privacy proxy that replaces PII and secrets with consistent pseudonyms before AI coding agent requests reach the model provider.

veil is an open-source (Apache-2.0) local privacy proxy for AI coding agents such as Claude Code, Codex CLI, Aider and DeepSeek Harness. It replaces real names, emails, phone numbers, addresses, ID numbers and secrets with consistent pseudonyms before a request leaves the developer's machine, then restores real values locally when the agent runs commands or edits files. The README marks it as alpha software.

## What It Is

veil is a proxy that runs on 127.0.0.1 and sits between a coding agent and its model provider. It learns real values from the project's own data sources (databases, fixtures, git history, schema declarations in code) and then finds them in logs, JSON, stack traces, query output and free text. Pseudonyms are deterministic HMAC-derived codes, one per person, so conversations stay stable and prompt caching keeps working.

## How the Workflow Runs

Running `veil init` on a project finds database URLs, SQLite files, fixture folders and git contributors, seeds the vault, and configures Claude Code to use the proxy. `veil service install` keeps the proxy running in the background. Tool policy then decides what comes back: shell, read and grep tools get real values escaped for their context; edit and write tools only receive values already present in the target file; web and network-capable tools receive none. If redaction fails, the request is refused rather than forwarded raw, and a second guard scans outgoing bytes.

## Database Tool and Data Sources

`veil mcp-db` is a read-only database tool served over MCP. The agent queries with pseudonyms, and veil converts them into bound parameters carrying the real values. It supports SQLite, Postgres, MySQL/MariaDB, SQL Server and MongoDB for querying. Seeding sources also include Redis, Elasticsearch/OpenSearch, DynamoDB, Snowflake, BigQuery, fixture files, git history and code schemas.

## Clients and Teams

One proxy serves Anthropic Messages, OpenAI Responses and Chat Completions clients, plus Claude Code on Bedrock, Vertex, Microsoft Foundry and Claude Platform on AWS. Tool aliases let other agents map their tool names onto veil's roles. Teams can share the pseudonym secret through a secrets manager and push managed settings requiring Claude Code to go through veil.

## Current Status

The README describes veil as alpha. Its test figures come from the project's own runs, and the cloud-provider rows have not yet been run against live cloud accounts. Images are passed through unscanned.

## Features
- Local proxy that pseudonymizes PII and secrets before requests reach the model provider
- Restores real values locally per tool policy with context-aware escaping
- Seeds real values from databases, fixtures, git history and code schemas
- Read-only database tool over MCP using bound parameters
- Optional NER model for free text about third parties
- Quasi-identifier detection with warn, redact or off modes
- Fails closed with an independent guard on outgoing bytes
- AES-256-GCM encrypted local vault with OS keychain keys and rotation
- Display modes plus share and reveal commands
- Team secret sharing and managed-settings enforcement
- Tool aliases for other agents' tool names
- Request capture and audit harness to verify what the model sees

## Integrations
Claude Code, Claude Agent SDK, Codex CLI, Aider, Continue, OpenAI SDK, LiteLLM, DeepSeek Harness, Amazon Bedrock, Google Vertex, Microsoft Foundry, Postgres, MySQL/MariaDB, SQL Server, SQLite, MongoDB, Redis, Elasticsearch, DynamoDB, Snowflake, BigQuery, Homebrew

## Platforms
WINDOWS, MACOS, LINUX, API, CLI

## Pricing
Open Source

## Version
0.3.2

## Links
- Website: https://github.com/lemonadesaltbagel/veil
- Documentation: https://github.com/lemonadesaltbagel/veil/blob/main/docs/DESIGN.md
- Repository: https://github.com/lemonadesaltbagel/veil
- EveryDev.ai: https://www.everydev.ai/tools/veil