Skip to content

keepmum 0.1.0 alpha 1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@blueandhack blueandhack released this 03 Nov 09:13
· 53 commits to main since this release
v0.1.0a1
This tag was signed with the committer’s verified signature.
blueandhack Yujia Lin
GPG key ID: 8A066254F143D31D
Verified
Learn about vigilant mode.
cc2fe1f

The first alpha of keepmum: a local proxy that keeps secrets and personal data on your Mac while you use Claude Code, Codex, Gemini CLI, pi or opencode. Before a request leaves your Mac, keepmum replaces each secret with a placeholder; when the model answers, it puts the real values back. The provider only ever sees placeholders.

Alpha. keepmum works end to end, but it has not been audited and things will change. Treat it as a safety layer, not a guarantee, and see Limitations.

Install

  1. Download Keepmum-0.1.0a1.dmg below, open it, and drag Keepmum into Applications.
  2. Open Keepmum and follow Settings › Setup: download the local model (1.6 GB, once), start the background service, and switch on protection for the coding agents you use.

Needs a Mac with Apple silicon and macOS 14 or later. The app is signed and notarized by Apple and bundles everything it needs (keepmum, its Python runtime and pf-serve).

To check the download: shasum -a 256 -c Keepmum-0.1.0a1.dmg.sha256

What's in it

  • Detection on your Mac: 96 rules with entropy and checksum checks, and OpenAI Privacy Filter running locally on the GPU (or the rules alone, keepmum model off). Personal data (names, emails, phones, addresses) is optional.
  • Masking and restoring: placeholders stay stable across a session, so prompt caching keeps working; real values come back in streamed text and in the edits and commands your agent runs.
  • Values go back only where they belong:
    • web search and web fetch keep placeholders
    • an MCP server gets back only the values it returned itself, and never a secret
    • a placeholder inside a web address in a reply stays, so a link or an image cannot leak it
    • a shell command can send a token only to the hosts its issuer uses: a GitHub token reaches github.com, not attacker.example
  • Fails closed: a request keepmum cannot scan is blocked, never sent raw.
  • Every agent: Claude Code (terminal, VS Code, desktop app), Codex, Gemini CLI, pi and opencode, through the Anthropic, OpenAI and Gemini APIs. The app's Setup (or keepmum protect on) switches on Claude Code, Codex, pi and opencode; Gemini CLI goes through keepmum one run at a time with keepmum gemini.
  • In front of another gateway: an agent already pointed at a gateway (LiteLLM, OpenRouter, a company proxy) keeps using it, with keepmum in front, so the gateway gets placeholders too.
  • An audit log of every request and every settings change that weakens protection, with no values in it, and checked for tampering.
  • The Mac app: menu bar status, live flow diagrams per agent and provider, what was masked by type, a searchable log, settings for what gets masked, and the audit log.

Known limitations

  • Shell commands still receive real values (so git push works). The host check above stops the common case, but a command built to hide where it sends things gets past it. Use a sandbox with a network allowlist alongside keepmum.
  • Your agent's local transcripts hold real values: keepmum protects what leaves your Mac, not what is stored on it.
  • The local model is strongest on English.

Feedback and bug reports are welcome in Issues.

Assets 4
Loading