---

✨ Why Redact Restore

Every prompt you type, every file Claude reads and every command output goes to the model. Customer names, internal hostnames, API keys, the email in your git config: all of it is context.

Redact Restore sits inside Claude Code as a native Mod:

• 🛡️ The model sees placeholders, such as {{PRIVATE:EMAIL#3fa1c09e8b2d}}, never the value.
• 🔁 You see the real thing. Messages render with the original values on your screen.
• 🧰 Your tools still work. Bash, Edit, Write, Grep and local MCP tools receive the real values, so builds, scripts and file edits are correct.
• 🔑 Nothing changes about your login. Official Claude Pro/Max OAuth, no API gateway, no proxy, no custom base URL.

🧭 How It Works

sequenceDiagram
    autonumber
    actor You
    participant RR as Redact Restore<br/>(on your machine)
    participant Model as Claude model API
    participant Tools as Local tools

    You->>RR: Email [email protected] about Project Phoenix
    RR->>Model: Email {{PRIVATE:EMAIL#35;3fa1…}} about {{PRIVATE:CUSTOM#35;9c2e…}}
    Model-->>RR: Run a command with {{PRIVATE:EMAIL#35;3fa1…}}
    RR->>Tools: Command runs with [email protected]
    Tools-->>RR: Output (may contain originals)
    RR->>Model: Output masked again
    Model-->>RR: Reply with placeholders
    RR-->>You: Reply shown with the original values

Everything that leaves is masked, then audited

flowchart LR
    subgraph Local["🖥️ Your machine"]
        P[Your prompts]
        C[CLAUDE.md and account email]
        A[Mentioned files and reminders]
        S[System prompt]
        R[Tool results]
        M{{"Mask<br/>your values · email · 240+ detectors"}}
        AU{"Pre-send audit"}
        P --> M
        C --> M
        A --> M
        S --> M
        R --> M
        M --> AU
    end
    AU -->|placeholders only| API[("Claude API")]
    AU -.->|value still visible| X["⛔ Request refused"]

Local tools get real values; model-bound tools never do

flowchart TD
    Call["Tool call from the model"] --> Kind{"Where does its input go?"}
    Kind -->|"To another model or service:<br/>Agent, WebFetch, WebSearch, Workflow, …"| Keep["Placeholders kept"]
    Kind -->|"Stays on this machine:<br/>Bash, Edit, Write, Grep, local MCP"| Mode{"restore_mode"}
    Mode -->|"all (default)"| Real["Original values restored"]
    Mode -->|"files"| Files["Only file edits restored"]
    Mode -->|"none"| Refuse["Placeholders kept; file edits refused"]

🚀 Features

🆚 Compared With

📦 Quick Start

1. Install from isandrel/redact-restore. At a Claude Code prompt, in the terminal or the desktop app's Code tab (answer y to add the marketplace, then pick a scope):

/plugin install redact-restore --marketplace isandrel/redact-restore

Or from a shell:

claude plugin marketplace add isandrel/redact-restore

claude plugin install redact-restore@redact-restore

2. Tell it what is private, without typing values in chat:

• /redact-restore scan finds your git identity, coworkers, remotes, machine and account names, and .env values. Pick Add or Ignore in the pane.
• /redact-restore rules adds your own in a form: the private value (Acme Corp), then a label (CUSTOMER) or a fixed alias (CLIENT_A), with a preview of what the model sees.
• For your most sensitive values, use the keychain instead: /plugin → Installed → redact-restore → Configure options → Exact private values.

3. Start clean and check. Run /clear, then /redact-restore session or look at the status line under the prompt. Ask Claude to spell a protected value character by character: it can only spell the placeholder.

Update later with claude plugin update redact-restore@redact-restore. The plugin also ships skills you can ask for by name: /redact-restore:protect, :scan, :status, :policy, :placeholders, :troubleshoot, :import and :export.

Requires Claude Code 2.1.287 or newer with Mods support (the desktop app's Code tab from 2.1.286). A user-scope install is active in every CLI and Desktop Code session; --scope local limits it to one folder.

📚 Documentation

⚠️ Status

Redact Restore is experimental. It is tested live in the Claude Code CLI 2.1.287 (including subagents, compaction, /resume and concurrent sessions); In the desktop app's Code tab the status line is confirmed; the rest is kit-tested only so far. It is not a data-loss-prevention product: it protects the paths described in the security model, and tools that run locally act on real values by design. Try it with synthetic data first.

🤝 Contributing

Contributions are welcome: new detectors, false-positive fixes, docs and tests. Read the contributing guide, and report leaks privately through SECURITY.md, never in a public issue. This project follows a Code of Conduct.

🌐 Community

Thanks to LINUX DO for supporting open-source developers and community sharing.

📄 License

GNU Affero General Public License v3.0. The vendored gitleaks rules in hooks/vendor/ are MIT-licensed; see hooks/vendor/LICENSE-gitleaks.txt.