Pentect is an open-source, local protection layer for AI coding agents. It replaces detected credentials and sensitive data with opaque handles before supported requests reach the model provider, then restores known values for supported local tool calls.

Keep your usual coding workflow: launch with pentect codex, pentect claude, pentect opencode, or pentect pi. Detection runs locally. Pentect does not replace your agent's permissions or sandbox, and it cannot guarantee that every secret will be detected. Understand the security boundary.

Install

All options →

OS

Method

irm https://pentect.dev/install | iex

Installed?Continue to Quick start→

Updated for v0.0.85

Version 0.0.85 fixes excessive masking when source code contains a sensitive assignment. Ordinary code is no longer treated as an environment-variable dump for that reason alone; detected secrets remain protected. Update Pentect or troubleshoot excessive masking.

Clients

Pentect currently focuses official support on four AI coding clients: Codex CLI, Claude Code, OpenCode, and Pi.

CLI + DesktopCodexProtect Codex CLI or launch Codex App through Pentect.→Code + DesktopClaudeProtect Claude Code or supported Claude Desktop traffic.→CLIOpenCodeRun OpenCode through a temporary protected provider.→CLIPiRun Pi through a temporary protected provider.→StatusNot implementedSee clients that are documented but not currently available.→

Explore

Prompts and tool resultsProtect pasted secrets, accidental output, MCP results, and browser screenshots.→How it worksSee how Pentect protects and restores a value.→HandlesLearn how references, environment bindings, lifetime, and recovery work.→Structured dataProtect dotenv, Terraform, Kubernetes, and other supported formats.→Files and imagesLearn how Pentect checks uploads, images, and documents.→Custom upstreamsUse Pentect with a compatible gateway or local model.→PluginsBuild, test, and publish custom checks with regex or Wasm.→Everything Pentect can doBrowse clients, protected content, commands, settings, and plugins.→

Common tasks

5 minutesProtect your first agent sessionInstall Pentect, launch Codex or Claude, and confirm a handle.→RecipesUse Pentect in real workMask a file, use a custom gateway, keep aliases, and apply project policy.→HelpFix a blocked requestFind the protected path first, then use compatibility mode only when needed.→TrustUnderstand the boundarySee what stays local, what plugins can access, and what Pentect does not cover.→