Metadata-Version: 2.4
Name: veil-proxy
Version: 0.3.0
Summary: Privacy middleware for AI coding agents: the model sees consistent pseudonyms, your machine keeps the real values
Keywords: privacy,pii,llm,proxy,pseudonymization,claude-code,coding-agent
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-Expression: Apache-2.0
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
License-File: LICENSE
Requires-Dist: cryptography>=50.0.2
Requires-Dist: httpx>=0.27
Requires-Dist: pyahocorasick>=2.3.1
Requires-Dist: veil-proxy[postgres, mysql, mongo, redis, bedrock] ; extra == "all"
Requires-Dist: botocore>=1.43.115 ; extra == "bedrock"
Requires-Dist: pymongo>=4.19.0 ; extra == "mongo"
Requires-Dist: pymssql>=2.3 ; extra == "mssql"
Requires-Dist: pymysql>=1.2.3 ; extra == "mysql"
Requires-Dist: gliner>=0.2.29 ; extra == "ner"
Requires-Dist: onnxruntime>=1.31.0 ; extra == "ner"
Requires-Dist: psycopg[binary]>=3.3.6 ; extra == "postgres"
Requires-Dist: redis>=8.1.0 ; extra == "redis"
Requires-Dist: snowflake-connector-python>=3.12 ; extra == "snowflake"
Project-URL: Homepage, https://github.com/lemonadesaltbagel/veil
Project-URL: Issues, https://github.com/lemonadesaltbagel/veil/issues
Project-URL: Repository, https://github.com/lemonadesaltbagel/veil
Provides-Extra: all
Provides-Extra: bedrock
Provides-Extra: mongo
Provides-Extra: mssql
Provides-Extra: mysql
Provides-Extra: ner
Provides-Extra: postgres
Provides-Extra: redis
Provides-Extra: snowflake

# veil

Privacy middleware for AI coding agents. The model sees consistent pseudonyms
(`user_ab12@example.test`, `First_Ab12 Last_Ab12`); your machine keeps the real values,
and commands the agent runs locally get the real values back (shell- and SQL-safe).

```sh
pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, all
                                      # (installs the `veil` and `veil-hook` commands; import name `veil`)
veil init ~/code/myapp                # seed from .env DB URLs, SQLite, fixtures; wire Claude Code
veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux)
veil status ~/code/myapp
```

Evidence from our own test runs (details and the harness to re-run them are on GitHub:
https://github.com/lemonadesaltbagel/veil):

- 39 requests from real agent sessions against a live model leaked **0** real values (checked with
  a scanner that also decodes escaped and transformed text), and every session still found the bug.
- Seeding from your own data lets **1.8%** of names and contact details through, versus 80.4% for
  pattern matching (1,000 labelled records).
- **21/21** one-command bypass transforms are contained. Restored values are escaped for every
  language layer they pass through (shell, heredocs, `python -c`, `node -e`, SQL, `bash -c`...):
  35/35 injection tests, and 55,000 fuzzed nested commands executed with 0 code executions.
- Prompt caching keeps working (74–89% cache hits); about 19 ms overhead per request at 40k seeded
  values, and 37 + 68 ms per 234 KB request at 1.2 million seeded values (1.1 GB).

One local proxy (default `127.0.0.1:8787`) serves every client, routed by path:
Anthropic Messages (Claude Code, Agent SDK), Amazon Bedrock InvokeModel (binary eventstream),
Google Vertex rawPredict, Microsoft Foundry (`/foundry`), Claude Platform on AWS (`/anthropic-aws`),
OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and OpenAI Responses (Codex CLI).

Seeds from Postgres, MySQL/MariaDB, SQLite, SQL Server (native sensitivity labels), MongoDB, Redis,
Elasticsearch/OpenSearch and fixture files, plus personal fields declared in code (Prisma, Django,
Rails, SQLAlchemy, OpenAPI, protobuf), and re-seeds automatically when the data changes.

Also seeds git history, DynamoDB (personal data inside keys), Snowflake and BigQuery (their privacy
tags). `veil mcp-db` gives the agent a read-only database tool in which pseudonyms become **bound
parameters**, so real values are never SQL text.

```sh
veil init ~/code/myapp --mcp   # also register the database tool with Claude Code
veil display tokens        # screen sharing: answers keep pseudonyms (veil display real to undo)
veil quasi redact          # also pseudonymise rare cities, postal codes, birth dates, employers
veil keys rotate           # re-encrypt the vault; --token-secret for new pseudonyms
```

Teams: `veil team export | join` shares the pseudonym secret (never the vault key);
`veil team managed-settings` writes a Claude Code `managed-settings.d/` drop-in that pins the
proxy with `allowedProviders: ["customEndpoint"]`.

Optional NER for free text: `pip install "veil-proxy[ner]"` then `veil ner-model fetch`.

License: Apache-2.0. Status: alpha. Keys: macOS Keychain / Linux Secret Service (`secret-tool`) / Windows Credential
Manager, or `VEIL_VAULT_KEY` / `VEIL_TOKEN_SECRET` (base64). State: `~/.veil` (encrypted vault).

