Veil

Try it

Edit the text on the left. Detection and swapping run in your browser and nothing is sent anywhere. The reply in step 3 is simulated, to show how restoring works.

Why use it

Prompts collect sensitive data without anyone deciding to send it. A stack trace includes an API key. A support ticket includes a phone number and a card. A retrieved document includes an email address. Each of these goes to a third-party service in plain text.

You can clean every code path by hand, but each team ends up rewriting the same fragile pattern matching, and one missed path is enough. Veil does it in one place, for every request, with no change to your application logic.

Why placeholders instead of deleting

Veil replaces a value with a stable name, so Claude can still reason about it. The same email is always ‹EMAIL_1› within a request, so a question like who reported this and when did they last write in still makes sense. When Claude mentions ‹EMAIL_1› in its answer, Veil puts the real address back before your app sees it.

How it works

1. 1

   Your app calls Veil

   Your SDK sends a normal Messages API request to Veil on your own machine, using your own Anthropic key.
2. 2

   Veil scans the request

   Every string in the request body is scanned, including the system prompt, messages, tool definitions, tool results and tool inputs. Structural fields such as roles, ids and the model name are left alone.
3. 3

   Values become placeholders

   Each detected value is replaced with a placeholder such as ‹EMAIL_1›. The mapping lives in memory for the length of that one request and is then discarded.
4. 4

   Veil forwards the clean request

   The redacted request goes to the Claude API with your headers. Your key is passed through and never stored.
5. 5

   Veil restores the reply

   Placeholders in the reply from Claude, in normal responses and in streams, are replaced with the original values. A placeholder split across two stream chunks is held back until it is complete.
6. 6

   Veil writes an audit line

   One line per request records the time, model and how many values of each kind were swapped. It never records the values.

Set it up

You need Node 22.18 or newer. The proxy has no runtime dependencies and no build step.

1. Run the proxy

git clone https://github.com/tcvdh/leakybyte.git
cd leakybyte
npm install
npm run proxy
# LeakyByte proxy on http://127.0.0.1:8787

2. Point your SDK at it

Change the base URL. Nothing else in your code changes.

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  baseURL: "http://127.0.0.1:8787", // the only change
});

const msg = await client.messages.create({
  model: "claude-sonnet-5-5",
  max_tokens: 300,
  messages: [{ role: "user", content: "Why did the deploy for dana@acme.io fail?" }],
});

import anthropic

client = anthropic.Anthropic(base_url="http://127.0.0.1:8787")

Or test with curl

curl -i http://127.0.0.1:8787/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-5-5","max_tokens":200,
       "messages":[{"role":"user","content":"Email dana@acme.io about the outage"}]}'

The response includes a header, x-leakybyte-redacted: 1, with the number of distinct values that were swapped, and the reply contains the real address.

Example

This is real output from the command line tool, using the same engine as the proxy.

Customer dana.reyes@northwind.example called from +1 415-555-0134.
Card 4242 4242 4242 4242, server 10.4.2.19.

Customer ‹EMAIL_1› called from ‹PHONE_1›.
Card ‹CARD_1›, server ‹IP_1›.

The audit log gets one line like this for the request:

{"ts":"2026-03-02T09:14:07.512Z","model":"claude-sonnet-5-5","stream":false,"redacted":{"EMAIL":1,"PHONE":1}}

What it detects

Reference

Settings

Routes

Errors

Limits to know about

• Detection is pattern-based. It does not find names, street addresses or other free-text personal details.
• A secret split across two separate text blocks is not matched.
• Error responses from the upstream are passed through as they are.
• Tested against a mock Claude server, including streaming and tool calls. Not yet validated at scale against the live API.
• If Claude writes a placeholder it was never given, it stays as written.