DataSentry

What it is

DataSentry, a GPL-3.0 Claude Code plugin (approaching 1.0) that redacts secrets from tool outputs before they reach the model context and blocks prompts containing live credentials. The summary covers the design; what follows is the operational detail needed to actually deploy and tune it.

What to do

Install from the marketplace:

/plugin marketplace add CaptainASIC/datasentry
/plugin install datasentry@datasentry

Operate and verify via slash commands:

/datasentry            # interactive config wizard
/datasentry status     # current level, active rule count, recent audit entries
/datasentry stats      # all-time audit summary
/datasentry test       # live end-to-end check with a fake secret
/datasentry level essential
/datasentry off

Config lives at ~/.claude/datasentry/config.json, re-read on every hook invocation (applies to all projects/sessions). Tunable fields: level, per-category toggles ("categories": {"web3": false}), custom_rules (id/name/pattern/severity), an allowlist of regexes, fail_mode, and audit_log. The audit log appends rule IDs and hit counts — never secret values — to ~/.claude/datasentry/audit.jsonl.

Preconditions

Requires python3 on PATH (stdlib only, no dependencies). If python3 is missing, hooks cannot run and redaction is silently inactive — a SessionStart check is the only thing that warns you, in every affected session. Verify that warning is absent before trusting redaction.

fail_mode defaults to "closed" (suppress data if the redaction engine errors). Setting "open" prefers availability over safety — passes data through on engine error. Placeholders are stable per value (sha1[:4], e.g. [DS:aws-access-key-id:3fa1]), so the model can preserve them across edits without seeing the value.

Caveats

• Scope shrank in 0.5.0. Regulated-data patterns (PII, financial, healthcare, network) were removed from this free tier and moved to a separate commercial "DataSentry Enterprise." This plugin covers vendor-format secrets/keys/tokens only. If you need PII/compliance coverage, this repo does not provide it.
• The roadmap items that give real transport-layer guarantees — the ANTHROPIC_BASE_URL redacting proxy, reversible placeholder vault, org-wide DLP — are all Enterprise (commercial), not free-tier.
• Contextual patterns produce false positives (password = variablename reads like a real assignment); tune with allowlist/category overrides.
• Redaction can blind the agent: workflows that genuinely need the secret value won't work at that protection level.
• A signed CLA is required before any PR is merged.

Test suite: python3 tests/test_datasentry.py (30 subprocess-level tests, no deps). The original Warp ADE ruleset is preserved at docs/WARP.md; scope reasoning at docs/rule-scope.md.