keepmum 0.1.0 alpha 4

The fourth alpha of keepmum can answer flagged requests with a model on your Mac instead of the cloud, lets you tune how sensitive the optional checks are, and shows what a check flagged on the Logs page.

Alpha. keepmum works end to end, but it has not been audited and things will change. Treat it as a safety layer, not a guarantee, and see Limitations.

Install

1. Download Keepmum-0.1.0a4.dmg below, open it, and drag Keepmum into Applications.
2. Open Keepmum and follow Settings › Setup.

From 0.1.0a2 or 0.1.0a3: Keepmum updates itself if you allowed update checks (Settings › General › Updates › Check now). From 0.1.0a1: quit Keepmum and drag the new version into Applications, once.

Needs a Mac with Apple silicon and macOS 14 or later. The app is signed and notarized by Apple.

To check the download: shasum -a 256 -c Keepmum-0.1.0a4.dmg.sha256

What's new

• Local mode for the injection and harm checks. Besides Off, Warn and Block, each check can be set to Local. A request it flags then goes to a model on your Mac instead of the cloud provider, and your agent gets that model's answer.

  • The local model gets the request with its real values, which never leave your Mac. It never gets your API key, and it gets no tools, so it can only answer in text.
  • Later requests that still carry the flagged text stay local too, until you rewind or /clear.
  • Works with Claude Code and Codex. Gemini CLI's flagged requests are refused, as in Block.

• Several local servers. Ollama, LM Studio, llama.cpp's llama-server, MLX or another server on your Mac, each with its own model, for both checks or just one. A flagged request goes to the first server that answers; if none does, it is refused, never sent. Ollama, LM Studio and llama.cpp take the agent's request as it is. Other servers get it as Chat Completions, and the answer goes back in the agent's own format. Settings › Checks › Local servers, or keepmum guard local add.

• Sensitivity for the checks. If a check flags too much, turn it down: Settings › Checks › Sensitivity, or keepmum guard sensitivity injection|harm <level>. Each level shows what it caught and flagged on keepmum's test sets.

  • Prompt injection: High (the default), Medium, Low or Lowest, or a number of your own. Medium catches 97% of the test injections instead of 99%, and flags 5% of security code instead of 7%.
  • Harmful requests: High, Medium (the default), Low or Lowest. Lower levels miss more harmful requests; see the README for each model's numbers.

• Check details on the Logs page. Click a check's hit to see:

  • what happened and what to do next
  • the score against the threshold, the check's mode and model
  • where the request was going, and which local model answered
  • what was flagged and what you had asked, with every masked value shown as its type, like ‹EMAIL›

  The text is kept in memory only, never in the audit log or on disk, and only while Text around values is on (Settings › General › Logs page). The Outcome column now says Refused, Local, Replaced or Warned.

• Settings in panes. Setup, Masking, Tools, Checks, General and Check this Mac, each on its own pane, in two columns on a wide window.

• A new installer window. The DMG shows where to drag Keepmum, and the mounted disk carries Keepmum's icon.

Fixes

• File names such as guard-20261104-231405.md are no longer taken for secrets. The model and the entropy check flagged some, which filled the Logs page with masked names that were never sensitive. A key whose format keepmum knows is still masked, even inside a file name.
• Claude Code's AskUserQuestion results, which hold your own answers, are no longer checked for prompt injection.
• Settings › Tools now shows progress on Trust again and Keep these, and an error if one fails, instead of doing nothing visible.

Known limitations

• Local mode is only as good as your local model. A small one may repeat a planted instruction as advice, or help with what the harm check flagged. Use a capable model (8B or larger).
• Lower sensitivity means fewer false alarms and fewer real catches; the harm check gives up catches quickly below Medium.
• Shell commands still receive real values (so git push works), and your agent's local transcripts hold real values: keepmum protects what leaves your Mac, not what is stored on it.

Feedback and bug reports are welcome in Issues.

keepmum 0.1.0 alpha 3

The third alpha of keepmum adds a check on what comes back: the shell commands a model asks your agent to run. The flow diagram also shows what the optional checks did.

Alpha. keepmum works end to end, but it has not been audited and things will change. Treat it as a safety layer, not a guarantee, and see Limitations.

Install

1. Download Keepmum-0.1.0a3.dmg below, open it, and drag Keepmum into Applications.
2. Open Keepmum and follow Settings › Setup.

From 0.1.0a2: Keepmum updates itself if you allowed update checks (Settings › Updates › Check now). From 0.1.0a1: quit Keepmum and drag the new version into Applications, once.

Needs a Mac with Apple silicon and macOS 14 or later. The app is signed and notarized by Apple.

To check the download: shasum -a 256 -c Keepmum-0.1.0a3.dmg.sha256

What's new

• A risky-commands check (optional, off by default). keepmum reads the shell commands in the model's replies before your agent sees them: Claude Code's Bash, Codex's shell tools, and Gemini CLI's run_shell_command. It checks them against seven rules:

  • a download run as a script (curl … | sh)
  • decoded text run as a script
  • deleting your home folder or the system
  • erasing a disk
  • a fork bomb
  • credential files sent over the network
  • environment variables sent over the network

  Warn logs a hit and lets the command through. Block hands the agent, in its place, a command that prints why keepmum refused it and fails, so the model can explain or ask you. No model and no download: Settings › Checks › Risky commands, or keepmum guard commands warn.

• The checks in the flow diagram. Requests sent with a warning get a Flagged band, and requests a check stopped get a Refused band, each naming which check. Blocked now means only keepmum's own refusals.

Known limitations

• The commands check covers the clear cases. A command built to hide what it does gets past it; the rules on where real values may be sent still apply.
• Official one-line installers (curl … | bash) are flagged too. If you install tools through your agent often, use warn rather than block.
• Shell commands still receive real values (so git push works), and your agent's local transcripts hold real values: keepmum protects what leaves your Mac, not what is stored on it.

Feedback and bug reports are welcome in Issues.

keepmum 0.1.0 alpha 2

The second alpha of keepmum adds two optional checks that run on your Mac, a switch for personal data, and updates: from this version on, the app updates itself.

Alpha. keepmum works end to end, but it has not been audited and things will change. Treat it as a safety layer, not a guarantee, and see Limitations.

Install

1. Download Keepmum-0.1.0a2.dmg below, open it, and drag Keepmum into Applications.
2. Open Keepmum and follow Settings › Setup.

From 0.1.0a1: quit Keepmum, then drag the new version into Applications to replace it. That is needed once: 0.1.0a1 cannot update itself, and this version can.

Needs a Mac with Apple silicon and macOS 14 or later. The app is signed and notarized by Apple.

To check the download: shasum -a 256 -c Keepmum-0.1.0a2.dmg.sha256

What's new

• Updates. On its first launch the app asks whether to check for updates once a day. A check downloads keepmum's update list from github.com, so GitHub sees your IP address and keepmum's version; nothing else is sent. Updates are signed by keepmum and notarized by Apple, and both are checked before one is installed. Settings › Updates has "Check now", and can download and install updates automatically.
• A prompt-injection check (optional, off by default). It looks at what tools return (web pages, files, MCP replies) for instructions planted for your agent. Warn logs a hit and sends the request; Block refuses it. It uses Horizon Labs' Prompt Injection Guard Small (Apache-2.0), a 164 MB download that runs locally on the GPU.
• A harm check (optional, off by default). It looks at what you type for requests a company policy may not allow, and names their categories. Three model sizes are available: Small (164 MB, the default), Qwen3Guard 0.6B, and Qwen3Guard 4B (the most accurate).
• Settings › Checks sets both checks up. What they flag shows on the Logs and Activity pages, and keepmum guard does the same on the command line.
• Personal data has its own switch in the app and keepmum pii on|off. Every setting that used to need config.toml now has a place in the app.

Known limitations

• The checks are an early warning on top of masking, not a replacement for it. The injection check flags about 9% of security writing that quotes attacks, so warn suits security work better than block.
• Shell commands still receive real values (so git push works). The host check stops the common case, but a command built to hide where it sends things gets past it. Use a sandbox with a network allowlist alongside keepmum.
• Your agent's local transcripts hold real values: keepmum protects what leaves your Mac, not what is stored on it.

Feedback and bug reports are welcome in Issues.

keepmum 0.1.0 alpha 1

The first alpha of keepmum: a local proxy that keeps secrets and personal data on your Mac while you use Claude Code, Codex, Gemini CLI, pi or opencode. Before a request leaves your Mac, keepmum replaces each secret with a placeholder; when the model answers, it puts the real values back. The provider only ever sees placeholders.

Alpha. keepmum works end to end, but it has not been audited and things will change. Treat it as a safety layer, not a guarantee, and see Limitations.

Install

1. Download Keepmum-0.1.0a1.dmg below, open it, and drag Keepmum into Applications.
2. Open Keepmum and follow Settings › Setup: download the local model (1.6 GB, once), start the background service, and switch on protection for the coding agents you use.

Needs a Mac with Apple silicon and macOS 14 or later. The app is signed and notarized by Apple and bundles everything it needs (keepmum, its Python runtime and pf-serve).

To check the download: shasum -a 256 -c Keepmum-0.1.0a1.dmg.sha256

What's in it

• Detection on your Mac: 96 rules with entropy and checksum checks, and OpenAI Privacy Filter running locally on the GPU (or the rules alone, keepmum model off). Personal data (names, emails, phones, addresses) is optional.
• Masking and restoring: placeholders stay stable across a session, so prompt caching keeps working; real values come back in streamed text and in the edits and commands your agent runs.
• Values go back only where they belong:
  • web search and web fetch keep placeholders
  • an MCP server gets back only the values it returned itself, and never a secret
  • a placeholder inside a web address in a reply stays, so a link or an image cannot leak it
  • a shell command can send a token only to the hosts its issuer uses: a GitHub token reaches github.com, not attacker.example
• Fails closed: a request keepmum cannot scan is blocked, never sent raw.
• Every agent: Claude Code (terminal, VS Code, desktop app), Codex, Gemini CLI, pi and opencode, through the Anthropic, OpenAI and Gemini APIs. The app's Setup (or keepmum protect on) switches on Claude Code, Codex, pi and opencode; Gemini CLI goes through keepmum one run at a time with keepmum gemini.
• In front of another gateway: an agent already pointed at a gateway (LiteLLM, OpenRouter, a company proxy) keeps using it, with keepmum in front, so the gateway gets placeholders too.
• An audit log of every request and every settings change that weakens protection, with no values in it, and checked for tampering.
• The Mac app: menu bar status, live flow diagrams per agent and provider, what was masked by type, a searchable log, settings for what gets masked, and the audit log.

Known limitations

• Shell commands still receive real values (so git push works). The host check above stops the common case, but a command built to hide where it sends things gets past it. Use a sandbox with a network allowlist alongside keepmum.
• Your agent's local transcripts hold real values: keepmum protects what leaves your Mac, not what is stored on it.
• The local model is strongest on English.

Feedback and bug reports are welcome in Issues.