Velum 0.11.0: your coding agent reads masked files

Most people are careful about what they paste into a chat window. Almost nobody is careful about what their coding agent reads, because they never see it happen.

You ask for a small refactor. The agent reads six files to understand the code. One of them is a test fixture with real customer names in it, because that is how the fixture was made. Another has a client's tax ID in a seed script. A third has an address in a comment from two years ago. All of it goes into the context, and the context goes to the model provider. Nobody pasted anything.

Velum 0.11.0 closes that.

What it does

Velum runs as a Model Context Protocol server, so it works with any MCP-capable agent or harness. It works best in Claude Code, which exposes hooks, and hooks are what make masking unconditional rather than something the assistant has to remember to do.

In Claude Code, this is the whole flow:

• The agent reads a file. Velum masks it before the model sees it. Names, emails, national IDs, IBANs, cards and credentials become tokens like ⟦PERSON_1⟧.
• The agent works on the masked text and asks to write. Velum puts the real values back first, so the file on disk keeps its actual contents.
• Command output and search results go through the same path. There is no side door where cat customers.csv produces something a Read would have masked.

You do not change how you work. The agent does not know it is happening.

Settings, AI coding tools. The model gets no restore tool unless you give it one, and the prompt guard is off because it is the only part that interrupts. Install writes the plugin into Claude Code directly: no marketplace, no account, nothing to download.

The part people get wrong

An edit is the interesting case. The model saw ⟦EMAIL_1⟧, so that is what it writes into its edit, on both sides of the change. If only the new text were restored, the edit would fail to match the file, every time. So the old text is restored too, and the edit lands against the real file exactly as the model intended it.

That is the difference between a demo and something you can leave switched on.

What it costs, stated plainly

A typed prompt is not protected. If you type a client's name into the prompt yourself, it reaches the model provider before any tool call happens. That is true of every MCP server, ours included, and no amount of engineering on our side changes it. There is an optional guard that stops a prompt containing personal data and puts a masked copy on your clipboard, but it is off by default: it is the only part of this that interrupts you, and a tool you fight is a tool you turn off.

Outside Claude Code, masking is a tool the assistant calls. Codex, Claude Desktop and other MCP clients get the same local engine, but they provide no interception point, so the assistant chooses when to use it.

Filenames are not masked, only contents. A path is something the agent has to be able to use again.

Making it fast enough to leave on

Detection is the expensive part. Our neural tier runs at about 6,000 characters per second, which means a 93 KB source file would stall the agent for fifteen seconds on a single read. Running the fast pattern-only tier instead is not a fix either: on our benchmark it misses 37% of the values that must not leak, because patterns cannot find a person's name.

So the model tier now looks only where prose actually lives in code: inside string literals and comments, and only on lines that could plausibly carry a name. That same 93 KB file now takes 0.19 seconds. Detection quality did not drop. On our code benchmark it improved, because a name near a chunk boundary in a wall of syntax was getting lost, and it no longer is.

Defaults that assume the worst

The model gets no way to unmask. Not a discouraged tool, not a warning in a description. The tool is not registered, so it cannot be called. Restoring to a file or to your clipboard, and handing real values back to the model, are separate settings you turn on deliberately.

Some files are withheld entirely. .env, private keys, certificates. Not masked, not shown. The agent is told the file was withheld and why.

If masking fails, the content is withheld. A sidecar that is not running, a detector error, a file too large to mask inline: in each case the agent gets a notice instead of the content. A mask that quietly falls back to sending the real thing is worse than no mask at all, because you would believe you were covered.

Getting it

0.11.0 runs on macOS on Apple silicon. If you already have Velum it will offer the update next time you open it. Then go to Settings, AI coding tools, turn it on, and press Install for Claude Code.

Download Velum 0.11.0

Direct download, 336 MB. Signed and notarized by Apple, so it opens without a Gatekeeper warning.

Everything above happens on your machine. No file, no command output and no identifier is uploaded to anyone, including us.