aiproxy

At a glance

aiproxy is a self-hosted Python proxy that sits between Claude Code (or another AI tool) and the Anthropic or OpenAI API. A small local model running in Ollama finds names, companies, emails and phone numbers, and a separate regex filter catches secrets. Each value is swapped for a token before the request leaves your machine, and the originals are restored in the reply. Detection is best-effort, so treat it as risk reduction rather than a guarantee.

Good fit

Noncommercial users or teams who want to use Claude Code on material containing client names or customer PII without the provider seeing the real values. It also masks text in images, PDFs and Office files. An organization mode adds per-user isolation, a shared Postgres store and identity from an SSO gateway header.

Consider something else when

You need guaranteed redaction, or you plan commercial use without negotiating a separate license. Skip it too if you only need to keep API keys and credentials out of coding prompts: Nenya is a lightweight, zero-dependency Go gateway built to redact secrets from coding tools' requests.

Start here

Clone the repo, run ./install.sh (install.ps1 on Windows), then python -m aiproxy doctor --config config.yaml to confirm Ollama, Tesseract and the model are ready. Start it with python -m aiproxy serve, send a sample message to the /dryrun endpoint and check that names come back as tokens. Only then point ANTHROPIC_BASE_URL at the proxy.

Cost and requirements

Free under the PolyForm Noncommercial license; a commercial license is available on request. Needs git, Python 3.11 or newer, Ollama and Tesseract, about 6 GB free RAM and 4 GB disk. It runs on CPU, but a GPU with 4 GB VRAM makes detection much faster. Your own API key or Claude subscription passes through; the proxy stores no key.

Limits to know

The default 3B model can miss an entity, letting a real value reach the provider; run fail_closed mode and add known names to the allowlist, denylist or name gazetteer. Masked images and PDFs cannot be restored, and PDFs go upstream as image-only pages. The Claude Code system prompt and CLAUDE.md are not redacted by default. The README says it has only been verified against a local echo server, not live providers.

Related work

• Nenya (alternative)
• Presidio (context)

Still unclear

• How often the default local model misses names in real documents; no recall figures are published.
• How much delay redaction adds to each request on a CPU-only machine.