127.0.0.1:9800Local interception point. Secrets are detected and replaced here before the request leaves your machine.
Security & Trust
No trust required. Check the path.
TigerMole masks secrets locally before Claude Code sends a request. This page lists the network surface, cryptography and failure behaviour behind the 111 detection rules.
Local masking · fail-closed · no telemetry
01 / Network surface
Three paths. Nothing hidden.
Your prompt and code take one outbound path, already masked. Licensing is separate and never carries your prompts, code or secrets.
api.anthropic.comMasked prompts and placeholders only. Anthropic never receives the original secret value.
api.tigermole.comActivation and periodic revalidation. Sends the license, machine fingerprint, hostname or owner label and platform only.
02 / Cryptographic boundaries
Keys stay where they belong.
License at rest
DPAPI / AES
Bound to the current user on the machine.
Audit integrity
SHA-256 + ED25519
Team logs are signed and tamper-evident.
Audit encryption
X25519 + ENC2
Optional encryption with your public key. TigerMole never sees the private key.
03 / Failure mode
Fail-closed by default.
If masking panics, times out or cannot parse a request, TigerMole blocks it instead of forwarding unmasked data. This is not a switch.
BLOCKED · NON-CONFIGURABLE04 / Verify it yourself
Read the implementation path.
The public quickstart explains activation, the local proxy and the checks you can run after installation.
Open the quickstartSecurity contactsecurity@tigermole.com