Compare

How Tokenhush compares

Tokenhush is a local, loopback-only HTTP gateway that replaces secrets and PII in an AI coding tool's request body with reversible session placeholders before they reach the model, and restores them in the response. It covers the 14 clients that accept a custom base URL. This page compares it with three other approaches: opt-outs and .gitignore, turning off the features that send too much, and a local MITM proxy with a root certificate. Each row states what the approach gives you, what it does not, and where it fits.

Get started Star on GitHub

Category-level by design: mitmproxy is the only named tool besides Tokenhush, and no prices are quoted anywhere on this page.

Four approaches, side by side

Each row is one approach from the public core README, with what it gives you, what it does not give you, and where it fits.

The four approaches as summarised in the current public core README; mitmproxy is named as the public example of the local-proxy class.
Approach	What it gives you	What it does not give you	Where it fits	Operational footprint
Opt-outs and .gitignore	No extra software. You keep secrets out of the files you remember to exclude, and you can switch off training or logging per provider.	You have to get every pattern right and keep it right. A tool that reads the repo, an .env you forgot to exclude, or a key pasted into a prompt still leaves the machine, and there is no undo after a request is sent.	File-level hygiene, applied before a request is composed: nothing in this approach runs at send time.	No install and no running process. Blast radius: only the files you remember to exclude, and there is no send-time checkpoint.
Turning off features that send too much	Fewer bytes leave, sometimes a lot fewer.	You lose capability, the setting can drift or be reset by an update, and it does nothing about secrets that reach the request anyway.	Workloads that can give up capability for fewer bytes, and that do not rely on the setting staying put.	One setting per provider, no code. Blast radius: the capability you give up, and a tool update can reset it.
A local MITM proxy with a root certificate	Traffic from any client on the machine can be inspected and rewritten, including clients with no base-URL setting. mitmproxy is the public, documented example of this class.	It terminates TLS, so you install a root certificate and add a permanently trusted party to your machine. That is a large change in trust for a secret-scrubbing feature.	Clients that ignore base URLs, when a machine-wide TLS-terminating certificate is a trade you can accept.	One proxy plus a trusted root certificate on the machine. Blast radius: every client on the host; reverting means removing that certificate.
Tokenhush	A loopback HTTP gateway your tool points at. It replaces secrets with reversible placeholders in the request body and restores them in the response. No TLS termination, no root certificate, and the mapping lives in memory only.	It only covers tools you can point at a base URL (14 helpers ship). It does not redact the response path, does not catch encoded secrets, and does not cover clients that ignore base URLs.	Tools that accept a custom base URL, where a local request-path checkpoint is enough and nothing machine-wide needs to be trusted.	Point one tool at `http://127.0.0.1:8787` (14 snippets ship). Binds `127.0.0.1` only, no root certificate, mapping in memory and cleared on restart.

Read the full boundary list

Detectors are precision-first, so a value that is not flagged still travels. The documented claim is high-confidence interception plus full auditability, not a guarantee that nothing sensitive can leave.

Redaction: a local MITM proxy versus the loopback gateway

Both approaches can redact secrets before a request is sent to an LLM. They differ in what has to be trusted for that to happen, and in what the trust change looks like over time.

A local MITM proxy with a root certificate. mitmproxy is the public example of this class. It terminates TLS, so you install a root certificate and add a trusted party that applies machine-wide: traffic from any client on the machine — including clients with no base-URL setting — can be inspected in plaintext and rewritten. The certificate has to be installed once, kept trusted across system updates, and rotated when it expires or its key is re-issued; the plaintext of that traffic is present in the proxy process, and the proxy has to be running for any of it to work.

The loopback gateway. Tokenhush never terminates TLS and installs nothing: the tool calls 127.0.0.1:8787 and the gateway forwards the request to the configured provider endpoint. There is no certificate to install or rotate and no machine-wide plaintext surface, because the rewrite happens in a process bound to loopback and the secret-to-placeholder mapping lives in memory for the session. The trade is coverage: a client that ignores configurable base URLs sits outside the gateway's path, and the response path is not redacted — both are written down in the security model. For the redaction-specific walkthrough, readhow the loopback gateway redacts secrets before they reach the model.

What Tokenhush explicitly does not cover

Three common AI surfaces sit outside the gateway's path by design: they expose no configurable base URL, so there is nothing for the gateway to sit in front of.

Cursor agent traffic
Cursor agent traffic does not honour a configurable base URL, so it is not on the gateway's path.
ChatGPT and Claude desktop apps
The desktop apps expose no base-URL setting either; their requests do not pass through the loopback gateway.
Browser web UIs
Browser-based chat UIs talk to their provider endpoints directly, with no base URL to redirect.

Covering any of these would need system-level interception with a root certificate, which the open-source core does not implement. The gateway covers exactly the tools you can point at a base URL; 14 helpers ship. The full list of limits and residual risks is in the security model.

Where this is written down

The comparison, the coverage boundary, and the residual risks all come from the public documentation.

Open source

Point one tool at the gateway

Any client that accepts a custom base URL can be routed through the loopback gateway. If a client cannot be pointed at a base URL, it is outside this comparison and outside the gateway's path.