Install Cloakroom

Works with Claude Code, Codex CLI and Gemini CLI.

Mac, Windows and Linux. You need Claude Code, installed and signed in.

Add Cloakroom. Inside Claude Code, type these two lines, one at a time. If it asks where to install, pick the option for all your projects (user scope).
```
/plugin marketplace add shanjeevrajendran/cloakroom
/plugin install cloakroom@cloakroom
```
Restart Claude Code. Type /exit, then claude again. Cloakroom now installs itself.

Check it. Open a new terminal window and run:

cloakroom doctor       # every line should say ok
cloakroom dashboard    # opens your alerts in the browser

Mac and Linux (tested with Codex 0.164).

Install the program by hand.

uv tool install "cloakroom[model,torch,ocr]"

Run cloakroom install codex. It adds four hooks to ~/.codex/hooks.json and leaves your own hooks alone.
```
cloakroom install codex
```
Start Codex (codex), type /hooks, open each of the four Cloakroom hooks and trust it. Until you do, Codex skips them. cloakroom doctor shows whether they’re installed.

Mac and Linux (built against Gemini CLI 0.65).

Install the program by hand.

uv tool install "cloakroom[model,torch,ocr]"

Run cloakroom install gemini. It writes one thing: a Gemini extension named cloakroom in ~/.gemini/extensions/cloakroom/. Your settings.json and your own hooks and extensions aren’t touched.
```
cloakroom install gemini
```
Gemini runs the hooks from its next start, in every folder; gemini extensions list shows it, cloakroom doctor too.

Pick how you’ll run it

Easiest: add the plugin (above) and let it install Cloakroom on the next start. It uses uv or pipx if either is installed, otherwise a private Python environment in ~/.cloakroom/venv (needs Python 3.10+). If the install fails, Claude Code says so and it retries after 10 minutes. The table is for installing by hand.

Your machine	Install	What you get
Apple Silicon Mac, or an NVIDIA GPU	`uv tool install "cloakroom[model,torch]"`	Full mode on the GPU, about 20 ms per check
Any other machine (Intel Mac, most Windows and Linux)	`uv tool install "cloakroom[model,torch]"`, then once: `cloakroom export-onnx`	Full mode on the CPU. Before the export it works but is slow (about 0.5 s per check); after it, about 60 ms on a modern CPU
Just trying it, or a CI box	`uv tool install cloakroom` and `CLOAKROOM_MODE=rules`	Rules only: instant, no model download, but misses names and free-text personal data

pipx install ... works the same way as uv tool install .... The model extras need about 1 GB of disk on a Mac and up to about 4 GB elsewhere (mostly PyTorch). Python 3.10 or newer.

To try it on one project first, install the plugin for that folder only. From inside the folder:

claude plugin marketplace add shanjeevrajendran/cloakroom --scope local
claude plugin install cloakroom@cloakroom --scope local

Other projects stay untouched.

Using it outside Claude Code

The same engine works on any file or pipe, which is handy for checking what it would do:

cloakroom check config.py        # what would be masked, by kind; never prints the values
cloakroom explain config.py      # every finding with the rule that found it, and what was skipped as safe
cloakroom mask config.py         # the masked text, as Claude would see it
cat app.log | cloakroom check -  # read from stdin
cloakroom check --mode rules .env

Other commands: Commands.

Headless machines, CI and testing

# just trying it, or a CI box: rules only, no model download
uv tool install cloakroom
CLOAKROOM_MODE=rules

Vault key: The vault key lives in the OS secure store (Keychain, Credential Manager, Secret Service). On a machine without one, set CLOAKROOM_VAULT_KEY (a 256-bit key, base64 or 64 hex characters), or Cloakroom falls back to a key file readable only by you, and doctor says so.
Dry run: CLOAKROOM_DRY_RUN=1 lets everything through and logs what Cloakroom would have done to ~/.cloakroom/dry-run.log. Useful for trying it on a real project before trusting it.
Separate homes: CLOAKROOM_HOME moves the config, vault and model files; CLOAKROOM_PORT moves the local service (default 37787).

If something looks wrong

`cloakroom` not found

Open a new terminal. The program lives in ~/.local/bin (on Windows, %USERPROFILE%\.local\bin); the installer adds that folder to your shell profile (~/.zshenv for zsh, ~/.bashrc and ~/.profile or ~/.bash_profile for bash) or, on Windows, to your user PATH.

Still setting up, or it failed

Progress, and numbered steps when something needs you, are written to ~/.cloakroom/bootstrap.log. More in Setup.

A Linux machine without curl

When neither uv nor pipx is there, Cloakroom fetches uv, which needs curl or wget. If a Linux machine has neither, Cloakroom tells you the steps: sudo apt install curl (Ubuntu/Debian) or sudo dnf install curl (Fedora/RHEL), then restart Claude Code.

Intel Mac

Only the pattern rules run, so keys, cards and ID numbers are caught but most names and addresses are not. The detection model for names and addresses needs PyTorch or ONNX Runtime, and neither is built for Intel Macs.

More fixes

Blocked prompts, ports, model: FAIL and too much masking: Settings and fixes.