PostToolUse hook for Claude Code that redacts secrets and PII from tool output before Claude sees it. Works for all tools: Read, Bash, MCP tools (mcp__ssh-manager__*, etc.).

Claude Code puts every tool result into the model context. One cat .env, one wg show, one MCP call over SSH, and a live key is inside a transcript that went to a third party. You cannot recall it — you can only rotate the key.

This hook sits between the tool and the model. It cuts the secret out before the model receives it, so the leak does not happen instead of being found afterwards.

It is a last line of defence, not a replacement for keeping secrets out of tool output.

Claude Code runs the hook after every tool call. The hook receives the tool response, applies the enabled rules, and returns the cleaned version.

Every rule has a name, and every replacement says which rule fired:

PGPASSWORD=[REDACTED:env_secret]
Authorization: Basic [REDACTED:basic_auth]
postgresql://app:[REDACTED:conn_str]@db.local/app

So the model still sees what kind of value was there, and you can read off the exact name to switch off if a rule is wrong for you.

Pure regex. No network call, no model, no dependencies — one file and the standard library, about 1 ms per tool call.

python3 redact_output.py --list-rules prints these with their current state.

A terminal escape or a lone \r inside a token, as grep --color and progress output leave them, is removed before the rules run, so a split key is still cut. Colour around whole words is kept.

The rules are tuned against false positives, and the self-check enforces it: re.compile(...), PASSWORD = os.environ.get('X'), PUBLIC_KEY=ssh-ed25519, ${GITHUB_TOKEN}, git SHAs, UUIDs, sha256: digests and Go h1: hashes all come back byte-identical.

The eight off-by-default rules are off because cutting mail addresses, home paths and IP addresses breaks ordinary work with git log, stack traces and ip addr. public_ip6 is off for the same reason as public_ip: switch it on with enable = ["public_ip6"] when a transcript must not carry your server addresses. Entropy is off because it misses about a third of real secrets and invents false positives; the named rules do the real work.

Python 3.8 or newer, no packages to install. Python 3.11 adds tomllib, which the optional config file needs.

No Python at all? Each release carries a single-file binary for Linux x86_64, Linux aarch64 and macOS arm64, built from the same redact_output.py with its interpreter inside, so redact.toml, redact.secrets and the REDACT_* variables work the same:

curl -LO https://github.com/SilentAutomaton/redact-hook/releases/latest/download/redact-hook-linux-x86_64
curl -LO https://github.com/SilentAutomaton/redact-hook/releases/latest/download/redact-hook-linux-x86_64.sha256
sha256sum -c redact-hook-linux-x86_64.sha256
install -Dm755 redact-hook-linux-x86_64 ~/.claude/hooks/redact-hook
~/.claude/hooks/redact-hook --self-check

Then point the command in step 2 at ~/.claude/hooks/redact-hook (in full) and skip step 1. The first run unpacks the binary into your cache directory; later runs start from there.

git clone https://github.com/SilentAutomaton/redact-hook.git
cd redact-hook
python3 redact_output.py --self-check

The self-check must print 0 failures before you install anything. Then:

install -Dm755 redact_output.py ~/.claude/hooks/redact_output.py

Edit ~/.claude/settings.json and add to the hooks section:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          {
            "type": "command",
            "command": "/home/YOUR_USER/.claude/hooks/redact_output.py",
            "timeout": 30
          }
        ]
      }
    ]
  }
}

Write the path in full. Claude Code does not expand ~ or $HOME in a hook command, and a hook that cannot start redacts nothing.

"matcher": ".*" runs the hook after every tool. To leave a tool alone, name it in REDACT_SKIP_TOOLS rather than narrowing the matcher — the default already skips WebFetch and WebSearch, whose output is public anyway, and Write, ToolSearch, ExitPlanMode and AskUserQuestion, whose output holds only what the model or you wrote.

Hooks are loaded at session start. Confirm the hook is live:

python3 ~/.claude/hooks/redact_output.py --list-rules

Then ask Claude to read a file holding a fake key and check that the value comes back as [REDACTED:...].

cd redact-hook && git pull
install -Dm755 redact_output.py ~/.claude/hooks/redact_output.py

Restart Claude Code afterwards. Your redact.toml is untouched.

Write redact.toml in $CLAUDE_CONFIG_DIR, or in ~/.claude if that variable is not set. Every field is optional.

# rules to switch off, by the name in [REDACTED:name]
disable = ["phone", "card"]

# "partial" keeps the head and tail of a whole token: sk_liv...D3fH
mask = "partial"

# rules to switch on
enable = ["entropy", "email", "home_path"]

# regexes that are never cut, whatever rule matched
allow = ["AKIAIOSFODNN7EXAMPLE", "example\\.com"]

# your own rules
[[rule]]
name    = "internal_ticket"
pattern = "ACME-\\d{6}"

[[rule]]
name        = "staff_id"
pattern     = "EMP-[0-9]{5}"
replacement = "[staff]"

A missing file is fine. Bad TOML, a bad regex or a rule with no pattern prints a warning on stderr and the rest keeps working — the hook never dies on a config error, because a dead hook redacts nothing.

A custom pattern with an unbounded repeat inside another, such as (a+)+ or (\w+\s?)*, is skipped with a warning too: on the wrong input it backtracks for minutes, and the hook sits in front of every tool result.

With mask = "partial", a token of 18 characters or more that a rule cuts whole comes back as its first 6 and last 4 characters, sk_liv...D3fH, so a log line still says which key it was. Rules that cut a value behind a key, such as wg_key or assignment, secret_file, and a custom rule with its own replacement keep the placeholder. A partial mask already in the text, written by this hook or another tool, is left alone on the next pass.

No pattern can tell an ordinary password from an ordinary word. For those, put the exact values in redact.secrets next to redact.toml, one per line:

install -m600 /dev/null ~/.claude/redact.secrets
$EDITOR ~/.claude/redact.secrets

Every value is matched literally, the longest first, and comes back as [REDACTED:secret_file]. Values shorter than 4 characters are skipped. The hook warns if the file is readable by other users and never prints a value.

These override the file, so a project can set its own rules through the env block of its .claude/settings.json without a second config file.

entropy also switches on by itself for one result when the command prints a whole environment or a secrets file: env, printenv, set, export -p, declare -x, or cat/less/head/tail of .env*, .envrc, .netrc, .pgpass, credentials. A rule in disable stays off.

This directory contains a .claude-plugin/ with an install-redact-hook skill. To load it in Claude Code, add to ~/.claude/settings.json:

{
  "extraKnownMarketplaces": {
    "redact-hook": {
      "source": {
        "source": "directory",
        "path": "/path/to/this/directory"
      }
    }
  }
}

Then install the plugin via /install-plugin in Claude Code and invoke with /install-redact-hook.

Read these before you trust the hook with anything.

• PostToolUse cannot stop egress. The tool has already run by the time the hook sees its output. This protects the model context, not the network. Only a PreToolUse hook can stop a tool from reaching out.
• The local transcript keeps the raw value. toolUseResult in ~/.claude/projects/**/*.jsonl is written before redaction. The hook protects what goes to the API, not the file on your disk.
• Tool input is never redacted — a secret you type in a prompt, or that Claude puts in a command line, is not covered.
• @file mentions are expanded by the client and bypass hooks entirely.
• Hooks load at session start; changes to settings.json need a restart.
• MCP config injected via system-reminder bypasses PostToolUse; use ${VAR} substitution in .mcp.json instead.
• The config file needs Python 3.11 or newer for tomllib. On an older interpreter the defaults run and a warning is printed.
• Unknown secret formats with no prefix and no field name are missed unless entropy is on.

python3 redact_output.py --self-check
python3 redact_output.py --list-rules

--self-check runs both directions: one sample per rule that must be cut, and a list of ordinary output that must come back unchanged. It also fails if any default rule has no sample at all.

Rule shapes come from gitleaks and detect-secrets, including the split between named regex rules and an entropy pass.

Three ideas were borrowed from other Claude Code redactors: named rules and a value allowlist from redacted, type-preserving placeholders from cc-redact, and the PreToolUse/PostToolUse limitation above, which claude-code-redaction-hooks documents clearly. claude-code-redact takes the heavier road — a local proxy with round-trip un-redaction — if you want no coverage gaps and do not mind the dependencies.

MIT. See LICENSE.