Veilio Guard
Real names and secrets reach Claude as placeholders, then restore before edits land.
Illustration. Actual results depend on the mod, terminal and environment.
Install
/plugin marketplace add veilio-inc/veilio
/plugin install veilio-guard@veilio
/reload-pluginsRun these commands one at a time in a Claude Code session.
claude plugin marketplace add veilio-inc/veilio
claude plugin install veilio-guard@veilioThen run /reload-plugins in your session, or start a new session.
Please install the Claude Code mod "Veilio Guard" (https://github.com/veilio-inc/veilio). Before installing, read the Security and Requirements sections of its README and tell me what it reads and writes, which commands it runs, whether it uses the network, and which Claude Code version, OS and terminal it needs. If everything looks fine, run claude plugin marketplace add veilio-inc/veilio and claude plugin install veilio-guard@veilio, then remind me to run /reload-plugins in my session.Send this to Claude Code so it reads the author’s instructions before installing.
git clone https://github.com/veilio-inc/veilio
cd veilio
claude --plugin-dir ./plugins/veilio-guardClone the repository and try it in a local session with --plugin-dir.
What it accesses
Based on the author’s documentation, checked when listed; use claude plugin validate to check for yourself.
Reads
YesReads tool results, prompt/attachment/skill text, project `.veilio/map.json` and `guard.json`, and managed settings.
Writes files
YesMerges new symbol entries into project `.veilio/map.json`; on/off updates the project guard config.
Runs commands
UnspecifiedREADME lists no subprocesses; code centers on Claude Code $.fs / $.settings / $.ui, no spawn seen.
Network
NoneIntroduction
Veilio Guard is a Claude Code function-hooks mod that sits between tools and the model. Files, command output, search/MCP results and what you type reach Claude with placeholders such as __CLS__1 and with credentials removed; edits, commands and searches get real names back before they run. .env, private keys and .veilio/ are refused before Claude reads them. On your machine you still see real names in replies, tool rows and diffs; the session transcript keeps placeholders. If the guard cannot do its job it fails closed: unchecked results are withheld and unchecked prompts are not sent. It shares .veilio/map.json with the Veilio CLI and MCP server. The author states it makes no network call.
Install with /plugin marketplace add veilio-inc/veilio, then /plugin install veilio-guard@veilio. Needs Claude Code 2.1.287+; tested on macOS and Linux, with one Windows 11 terminal session. /veilio shows status and on/off; orgs can force it via managed settings.
License: custom Veilio Community License (not OSI). Personal and in-company use, forks and self-hosting are allowed; reselling, white-labeling or hosting it for others needs written permission. See the repo LICENSE for geographic/sanctions terms.
Who it is for
- People who want Claude Code to work without sending real identifiers or secrets to the model
Requirements
- Claude Code ≥ 2.1.287
- Platforms · macOS / Linux
- Author states no network calls; shares `.veilio/map.json` with the Veilio CLI.
- One Windows 11 terminal session (incl. PowerShell checks); not a full Windows claim.
- Orgs can force it via prependPlugins so users cannot turn it off locally.