◆ LocalMask

AI reads your code,
not your secrets.

LocalMask scans your repo and replaces every secret, API key, and PII with a reversible token — locally, before anything reaches Claude, GPT, or Copilot.

Install free CLI VS Code Cursor / Windsurf JetBrains

Watch demo ↓ Pro plans →

pip install localmask click to copy

Free, open source, runs offline. Try the interactive demo below →

Local-first privacy for AI coding

This is what the AI
actually sees.

Scan the repo, mask credentials and PII into reversible tokens, and send only tokens to Claude, GPT, or Gemini. Answers come back and rehydrate on your machine. Try the sensitivity levels on the real .env file →

Sensitivity level

          
          payments-service / .env
          
            scanning…
            8 secrets masked · safe to send
            no masking · secrets exposed
          
# payments-service/.env — sent to ClaudeDATABASE_URL=postgres://payments_rw~[DB_USER_0]~:pV9$kQ2!zR~[PASSWORD_0]~@db-prod-01.acme.internal~[HOST_0]~:5432~[PORT_0]~/payments~[DB_NAME_0]~STRIPE_SECRET_KEY=sk_live_51MspeZv8Klo2CqR7xY~[API_KEY_0]~JWT_SIGNING_KEY=hs256-9f3a7c1e8b2d4061~[API_KEY_1]~AWS_ACCESS_KEY_ID=AKIA5J7QX9P2M4RTUVWX~[AWS_KEY_0]~ONCALL_EMAIL=[email protected]~[EMAIL_0]~INTERNAL_API=https://vault.acme.internal~[HOST_1]~/v2

real secret becomes → token the AI sees

What you get

Mask in your editor, or hand the AI a masked mirror.

LocalMask doesn't decide what may reach the AI — it helps make what reaches the AI safe to send. And with your reviews and teaching, it keeps getting better.

Masked repo mirror

Scan a repo, publish a private masked copy the AI reads
Every secret becomes a stable ~[TOKEN]~
Git sync keeps the mirror current
Works with GitHub, GitLab, Bitbucket, self-hosted

Local, learning, yours

Persistent encrypted vault — stable tokens across restarts
Editable detection rules, no code
Finds secrets, PII, and customer data: DOB, CVV, passport, national ID, GPS, VIN, license plates, URL query secrets, and more
9 language packs — national IDs (CNP, ת״ז, DNI, PAN, Aadhaar), plus customer, order, invoice & booking IDs, checksum-validated

Pro & Team extras

AI proxy — masks prompts before they reach your AI / gateway (Pro)
Local AI model that learns from your reviews (Pro)
Web dashboard (Pro)
Team-shared vault, LDAP/AD, SSO, audit trail (Team)

See pricing →

Free & open source on GitHub ↗ — run it entirely offline with the CLI + MCP server.

Free IDE extensions

Mask and review without leaving your editor.

Toggle real ↔ masked view with a keystroke, review detections inline, and teach the model — right where you code. The extensions are free and open source. Pro and Team unlock extra features like the AI proxy, learning model, shared vaults, and SSO.

IntelliJ · PyCharm · WebStorm

Also works as a CLI + MCP server — no IDE required. See pricing →

Watch the demo

See the full workflow in 2 minutes.

0:00 / 0:00

Click to unmute 🔇

Pricing

Free forever. Pro is one-time. Team & Enterprise are annual, per seat.

Free · OSS

open source

Regex + entropy engine
Finance Mode: mask money amounts
9 language packs
Masked-repo mirror the AI reads
CLI + MCP server
Edit detections

Get the CLI

Pro

€49

one-time · 12 months of updates · +VAT

Everything in Free
Local AI model + learning
Web dashboard
AI proxy — masking before your AI / gateway
Finance Mode: you choose what the AI sees

Buy Pro

Team

€199

per seat / year · +VAT

Everything in Pro
Shared org rules + seat management
LDAP/AD + SSO sign-in
Tamper-evident audit trail
Closed environment — lock all egress
Lock security settings org-wide
Priority support

Buy Team

Enterprise

Custom

let's talk

Everything in Team — same features
Unlimited seats
Dedicated support & SLA
Procurement, invoicing, DPA

Contact sales

✓ 14-day money-back guarantee — no questions asked.

Pro is a one-time purchase: every version released within your 12-month update window is yours to keep and run forever. Validated offline — no phone-home, no monthly re-activation. Team & Enterprise are annual, per seat.

By purchasing you agree to our License Terms · Refund Policy · Privacy.

Palantir CEO on CNBC · July 2026

Are you keeping the data?
LocalMask makes the question irrelevant.

Alex Karp told CNBC that enterprises fear one thing about AI vendors: they pay for tokens and hand over their IP. He's right about the worry. Here's the architecture that removes it.

The worry — watch the clip

Karp says something has gone completely wrong with how AI is sold: enterprises send their data and their alpha to model vendors and can't answer the most basic governance question — who ends up holding it?

Clip: CNBC Squawk Box, July 1 2026 (official CNBC YouTube channel)

The answer — mask before it ever leaves

sk-live-4f9d… → ‹API_KEY_01› // the real value never leaves your machine

Secrets and PII are detected and masked locally, before any prompt reaches Claude, GPT, or any model.
Only metadata travels — file path, line number, pattern type. Never the value.
The token map stays on your disk, encrypted, git-ignored. No phone-home. Ever.
Keep using frontier AI. Stop shipping your IP with every prompt.

See how the pre-gate works

LocalMask Pro is not affiliated with, or endorsed by, Palantir, Alex Karp, or CNBC. The clip is embedded from CNBC's official YouTube channel and quoted for commentary.

Get started

Lock it down before you ship it to AI.

Free, open source, runs entirely on your machine. Install in one command and scan your first repo in under a minute.

pip install localmask

Download tarball Read the docs

Want more? Pro is a one-time €49 — adds the AI proxy, learning model, and dashboard.

Get notified about updates and new features:

AI reads your code,not your secrets.

This is what the AIactually sees.