Sether

Coming soon · Free · MIT · v0.1.0 in testing

Stop secrets before your coding agent sends them.

Sether Hooks checks every prompt you type into Claude Code, Codex or Gemini CLI. If it carries a key, an email or other personal data, the prompt stops before it reaches the model, and you get a clean version with placeholders to send instead. It runs on your machine and makes no network calls.

Tell me when it shipsSee how it works
claude

> deploy with key AKIAZ3KXQ7M2PL4RT8WN and email the report to ngozi@contoso.com

Sether stopped this prompt before it was sent: 2 sensitive items.

- AWS key: AKIAZ3K•••

- email: n•••@c•••.com

Clean version, with placeholders instead of the values:

deploy with key [AWS_KEY_1] and email the report to [EMAIL_1]

To send the original anyway, send it again within 2 minutes.

Example output with fictional values.

Why a hook

The only local check that runs before the model sees your prompt.

Plugins, MCP servers and connectors are called after the model already has your prompt. Each agent's own documented prompt hook runs before anything is sent, so it is the one place a local check can actually stop the text. Detection uses the @raeven-co/sether engine, tuned like Sether for VS Code for prompts full of code.

  • UserPromptSubmit

    Claude Code

    Tested end to end

    A stopped prompt used zero model tokens. Claude Code 2.1.295 and later also stops the prompt if the hook cannot run at all.

  • UserPromptSubmit

    Codex

    Tested end to end

    Zero input and output tokens for a stopped prompt. Codex runs a hook only after you trust it with /hooks.

  • BeforeAgent

    Gemini CLI

    Tested against its hook contract

    Built and unit-tested against the documented contract, not yet run against a real Gemini CLI.

What it stops

Real secrets and personal data.

  • Emails
  • Phone numbers
  • Card numbers (Luhn-checked)
  • SSNs
  • IBANs
  • Public IP addresses
  • AWS, OpenAI, Anthropic, GitHub, Slack and Stripe keys
  • JWTs
  • Labelled API keys and passwords
  • Database URLs with passwords
  • SECRET=... assignments
  • PEM private keys

What it lets through

The values every codebase has.

  • Private and loopback IPs
  • example.com-style domains
  • Documented test cards and IBANs
  • Fictional phone ranges
  • Timestamps and version numbers
  • Code like password: values.password
  • Default local credentials such as postgres:postgres@localhost

Planned setup

One command per agent.

These are the commands for the first release. The package is not on npm yet. The installer keeps your other settings and hooks, backs up the file before any change, and never touches a file that isn't valid JSON. Uninstall removes only Sether's entry.

npm install -g @raeven-co/sether-hooks

sether-hook install claude    # ~/.claude/settings.json
sether-hook install codex     # ~/.codex/hooks.json, then trust it with /hooks
sether-hook install gemini    # ~/.gemini/settings.json

What it does not promise

Know the limits before you rely on it.

  • It keeps the prompt from the model, not off your disk.

    Claude Code still records a blocked prompt in its local session transcript. Sether asks it to leave the original out of the on-screen message.

  • Each agent decides what happens if the hook cannot run.

    Claude Code stops the prompt. Codex and Gemini CLI let it through. If the hook runs but the check fails, Sether stops the prompt unless you choose to fail open.

  • It checks what you type.

    Files the agent reads, tool output and attachments are not prompts, so they are not covered.

  • Names in plain sentences are not caught.

    A bare name like "ask Ngozi" needs a model. Labelled names are found when the identity pack is on; free-text names need sether-ner.

All Sether limitations →

Get the release note when it ships.

One email when Sether Hooks is on npm, plus Sether release news. MIT licensed and free.

No spam. Unsubscribe anytime. The MIT developer libraries stay free.

See the full roadmap →