Your AI assistant doesn't need your client's [FEIN_1]

The leak nobody budgets for

AI coding assistants log, cache, and sometimes retain what you paste. Client tickets, payroll runs, API keys, .env files — the moment they hit the chat, they're on someone else's servers, subject to someone else's retention policy.

Redaction tools that just delete the data kill the work: the model needs the shape of your data to help you. ClaimCheck keeps the shape and drops the exposure.

Mask → work → restore

1. Mask. Sensitive values become stable placeholders — [FEIN_1], [SSN_2], [PERSON_1] — before the request leaves your machine. The mapping stays in a local vault file.
2. Work. The model reasons over placeholders. Same value, same placeholder, every time — references and context stay consistent across the whole session.
3. Restore. The response crosses back through the vault and placeholders become real values again. Locally.

Three ways to run it: MCP tools your agent calls directly (Cline, Claude Code, OpenClaw), a CLI for files and pipes, or a scrubbing proxy that sits between any OpenAI-compatible client and its provider and sanitizes everything on the wire — with a fail-closed posture: if scrubbing fails, the request is held, not forwarded.

Cline integration

Cline users get ClaimCheck in one of two ways — both local, both reversible:

• MCP tools. Add the ClaimCheck MCP server to Cline's MCP settings; the model then reads files through it and receives scrubbed content with stable placeholders instead of raw identities. The exact mcpServers JSON is in the install guide.
• Scrubbing proxy. Install with -WithProxy and point Cline's model provider Base URL at http://127.0.0.1:8766/api/coding/paas/v4 — every request to the model is scrubbed on the wire, and every response is restored before the editor sees it.

What it catches

22 recognizer types, deterministic, validated, no cloud calls: SSNs · FEINs/EINs · emails · API keys (OpenAI, AWS, Slack, GitHub) · JWTs · passwords · PEM private keys · card numbers + CVV + expiry · IBAN · bank routing · bank accounts · phone numbers · IP addresses · street addresses · dates of birth · passports · driver's licenses · medical licenses · insurance member IDs.

An opt-in NER tier adds free-text names, organizations and locations via a local ONNX model — cached once, no uploads, no API calls.

Why trust it

• No account. No API key. No telemetry. Nothing phones home — ever.
• Fail-closed. A scrub failure holds the request instead of forwarding raw text.
• Open source. MIT-0. The whole engine is on GitHub — audit it, fork it, self-host it.
• Honest limits. ClaimCheck protects the model-provider hop. Whatever reached a chat surface before the sanitizer ran was already seen — the docs state this plainly instead of hiding it.

Roadmap

Shipped: scrubbing proxy · NER tier · MCP tools · atomic vaults · Windows installer · field-proven on three deployments.
Next: prompt-injection classifier tier · tool-call guard · team audit trail (Pro).

Why the name

The tool ran nameless through its first build night. The first candidate was Cloakroom — rejected on arrival, because a Claude Code tool with the identical concept had shipped under that exact name the very same week. Great minds.

The collision search landed on ClaimCheck, and it fit better anyway. A claim check is the stub you get when you hand your valuables over at the coat check: you work the room with a numbered ticket and redeem it for the real thing on the way out. That's the whole product — your AI assistant works the session with claim tickets like [FEIN_1], and the local vault redeems them at the door.

Software has a second meaning for the phrase, and it's the same idea: Claim Check is a named pattern in Enterprise Integration Patterns — store the payload in an external store, pass only a reference through the channel, redeem it at the destination. This tool is that pattern, applied to LLM traffic.