The Problem

Teams using AI coding agents and LLM APIs face a real tension: the more context you give the model, the more likely you are to leak secrets, API keys, customer PII, or internal hostnames into third-party traffic. Redacting values breaks the conversation, because the agent can no longer reference the original data. Cover sits between the agent and the LLM, replacing sensitive values with reversible pseudonyms before the request leaves the machine, then restoring them in the response.

What This Does

Cover is a local reverse proxy written in Go. It intercepts outgoing JSON from agents like Codex or Claude Code, applies policy-driven transformations (allow, mask, redact, pseudonymize, block), and restores the originals in JSON and SSE streaming responses. The core logic lives in internal/redact/ — redact.go applies the policy, mapping.go maintains the reversible session mappings, and restore.go reverses the transformation. internal/proxy/proxy.go and internal/proxy/stream_sse.go handle the HTTP interception and streaming.

The cmd/cover/ entry point exposes a CLI with subcommands for init, inspect, doctor, and monitor. The internal/llamacpp/ package adds an optional local semantic detector for free-form text that regex misses.

How It Is Wired

Execution starts in cmd/cover/main.go, which dispatches to subcommands. The proxy path goes: main.go → internal/proxy/proxy.go → internal/redact/redact.go → internal/redact/mapping.go. The mapping.go file owns the reversible pseudonym store — bounded, session-isolated, memory-only with TTL. That file carries the widest blast radius: if the mapping leaks or corrupts, the proxy either fails closed or exposes secrets. The hardening_test.go files in both internal/proxy/ and internal/redact/ stress-test this boundary.

The daemon lifecycle is in internal/daemon/daemon.go and port.go. Configuration flows from internal/config/config.go and internal/codexconfig/config.go. Installation and agent configuration live in internal/install/install.go and agentsettings.go. The wiring is clean — no cycles in the module graph, and the proxy path is only four hops from entry to the network call.

How To Use It

Setup — Install via the script or build manually:

git clone https://github.com/moses-y/cover
cd cover
go build -o cover ./cmd/cover
install -m 0755 cover ~/.local/bin/cover

Configuration — cover init generates configs/config.example.yaml, which defines policies with actions like allow, mask, pseudonymize, and block. The configs/codex-router.example.yaml handles Codex-specific routing.

Running it — Start the daemon with cover start, then point your agent at the local proxy. Use cover inspect to preview protected JSON before sending, and cover doctor to verify the policy and daemon health.

Real-World Use

Point Claude Code at the proxy, define a policy that pseudonymizes api_key and customer_email fields, and the agent can still reference user_42 in conversation while the real email never leaves localhost. cover inspect shows exactly what will be sent before any request goes out.

Code Health & Issues

The repo has 26 test files across the core packages, CI in .github/workflows/ci.yml, Apache 2.0 license, and a SECURITY.md. The internal/redact/ package has benchmark tests, which suggests performance was a real concern. The code structure is clean with no red flags from static analysis.

Severity (Med) — This is a fork of DavidCarliez/cover with 22 stars; the original project has more community validation than this fork's zero stars suggest. Verify the fork hasn't diverged in ways that break the documented install script, which still points at the original repo.

The Bottom Line

Cover is a well-structured, genuinely useful privacy tool for teams that need LLM context without exfiltration risk. The reversible pseudonym approach is sound, and the fail-closed hardening shows real engineering discipline. It's a niche tool — you need a specific workflow (local LLM proxy, policy-driven redaction) to justify the setup, but for that workflow it's a solid choice.