sealgatev0.4

LOCAL DETECTION · LOCAL ENCRYPTION

Your context.
Your boundaries.

Keep Claude Code’s native terminal. Detect sensitive text with a trusted local LLM, encrypt it on your machine, and inspect model requests before they leave.

Start with SEALGATE Follow a request

Open source · MIT licensed · Subscription login preserved

sealgate claudeLOCAL

01 / ORIGINAL TEXT ON YOUR MACHINE

Draft a reply to
alice@example.test
about the launch schedule.

Detect spans · Encrypt locally

02 / PROTECTED TEXT SENT REMOTELY

Draft a reply to
[[SEALGATE:v1:…]]
about the launch schedule.

Illustrative marker. Real output contains authenticated ciphertext.

Surrounding text stays useful. Hidden values stay opaque.

Native ClaudeYour terminal and permission dialogs

Complete request inspectionPrompts, context, history, and tool text

Model request inspectionOS sandbox with a local gateway

01 / GET STARTED

From checkout to
protected requests.

The native launcher requires Node.js 22+, the native claude binary on your PATH, and either macOS (ARM64 or x86-64, using the built-in sandbox) or Linux ARM64/x86-64 with a local Docker daemon.

Install the CLI

Install the published package from npm. The package is scoped as @m0d8ye/sealgate; the command it installs is sealgate. 

npm install --global @m0d8ye/sealgate
sealgate --help

Prefer building from source? Clone the repository, then run npm ci and npm install --global ., or use node /absolute/path/to/sealgate/dist/bin/sealgate.js in place of sealgate.

Initialize your local key

With your trusted vLLM service already running, initialize SEALGATE once. Substitute your endpoint and served model name. 

sealgate init \
  --base-url http://127.0.0.1:8080/v1 \
  --model qwen3.8-27b

This creates private config.json and key files in ~/.config/sealgate/, outside Git. Back up the key securely: losing it makes existing ciphertext unrecoverable. If already initialized, edit the configuration instead of reinitializing.

Configure the detector in your project

Move to the project you want Claude to work on. Add these variables to its .env, keeping any existing settings. Replace the example key with your local service’s credential. 

SEALGATE_BASE_URL=http://127.0.0.1:8080/v1
SEALGATE_MODEL=qwen3.8-27b
SEALGATE_API_KEY_ENV=SEALGATE_API_KEY
SEALGATE_API_KEY=your-local-service-key
SEALGATE_TIMEOUT_MS=120000
SEALGATE_ENABLE_THINKING=false
chmod 600 .env

Keep .env out of Git. Exported variables override .env, which overrides config.json. For an unauthenticated detector, use SEALGATE_API_KEY_ENV= and omit the key. SEALGATE_ENABLE_THINKING=false is an optional Qwen/vLLM extension; omit it for providers that do not support it.

Sign in and launch Claude

Sign in outside the sandbox, then launch from your project directory. Linux builds the Docker runtime once first. 

sealgate sandbox-build   # Linux only
claude auth login
sealgate claude

Your project is writable and edits persist. The project root .env, your key directory and, on macOS, your home directory are hidden from Claude. Add --proxy-egress to let tools use your HTTP proxy; that tunnel is not inspected.

02 / UNDER THE HOOD

One inspected route
to the remote model.

Preprocessing happens at the HTTP request boundary. SEALGATE does not patch Claude’s binary, and a submission hook is not required.

LOCAL → REMOTE With a trusted local detection service

Native Claude

Terminal, context,
history, local tools

OS SANDBOX

SEALGATE gateway

Inspect fields.
Encrypt matched spans.

HOST PROCESS
Trusted vLLM + local encryption key

vLLM identifies exact sensitive substrings. Node performs AES-256-GCM encryption. The key is never sent to either provider.

Anthropic

Surrounding text
and opaque ciphertext

REMOTE SERVICE
Responses stream back unchanged through the same gateway. Linux tools can reach the network directly outside SEALGATE; macOS blocks other network traffic by default.
DETECT

Inspect the text that would leave

SEALGATE buffers each supported model request and sends decoded field text to your trusted detector. That includes system prompts, message history, tool inputs, descriptions, schemas, and file content returned by tools.

The detector returns exact sensitive substrings. SEALGATE validates the result, replaces every occurrence, and merges overlapping matches.

ENCRYPT

Keep the key on your machine

New encrypted spans use AES-256-GCM with a random nonce. The resulting [[SEALGATE:v1:…]] marker carries the nonce, authentication tag, and ciphertext.

The gateway reuses ciphertext for repeated values within a session. This keeps history stable and reveals equality between those values.

ENFORCE

Sandbox native Claude

On macOS a deny-by-default Seatbelt profile permits one outbound route by default: the gateway’s loopback port. On Linux a relay connects Claude’s configured model endpoint to the host gateway through a Unix socket. Tools have direct TCP and DNS access outside SEALGATE. Kernel rules block direct connections to the original provider’s resolved IP addresses, and host Unix sockets remain denied.

Failed detection, unsupported requests, or encryption errors block forwarding. There is no fallback that sends the original text.

Conventional encryption. Claude can reason about the surrounding text, but cannot interpret encrypted values or perform homomorphic inference. An encrypted filename, amount, or tool argument may make a task impossible.

03 / EVERYDAY USE

Choose the workflow
that fits the task.

COMPLETE MODEL REQUESTS

Native Claude

Use the native terminal with automatic request inspection and OS sandboxing. Linux tool networking bypasses inspection. 

sealgate claude
sealgate claude --model sonnet
sealgate claude --print < prompt.txt

The current session includes follow-up history. Its temporary Claude home is removed on normal exit; cross-launch history is not persisted in this version.

PROMPT-ONLY ALTERNATIVE

Manual preprocessing

Protect text in your own terminal, then paste the successful output into Claude. 

sealgate protect < prompt.txt
sealgate decrypt < protected.txt

Interactive input ends with Ctrl-D. Decryption is offline and explicit. Run it outside Claude’s tools. These commands do not isolate Claude or inspect its other context.

PROMPT-ONLY ALTERNATIVE

SEALGATE terminal chat

A lightweight editor protects each typed prompt before sending it to Claude’s print mode. 

sealgate chat

Enter adds a line; Ctrl-S protects and sends. Files, tool results, and other context are outside this wrapper’s protection. It does not provide the sandbox network boundary.

The Claude plugin adds a reminder. Installing the plugin alone does not rewrite prompts or intercept requests. Use sealgate claude for the gateway workflow. Plugin installation instructions

04 / KNOW THE BOUNDARIES

Interception is enforced.
Detection is probabilistic.

The trusted detector receives original text and can miss secrets, including encoded text or adversarial instructions. Successful encryption does not prove every sensitive value was found.

Inspected before forwarding

  • System context, prompts, and conversation history.
  • Text from files, tool results, and tool input values.
  • Tool descriptions, schemas, nested fields, and metadata.
  • Keys, numbers, and protocol strings: a detected secret here blocks the request when it cannot be safely rewritten.

Blocked or unavailable

  • Images, opaque uploads, remote file references, and unsupported API fields.
  • Direct network calls on macOS by default. Linux tools can use the network directly; this traffic is not inspected or encrypted.
  • Unknown or changed signed-thinking blocks. Only exact blocks already received from Anthropic in this session can replay.
  • Ciphertext from earlier launches or manual preprocessing. The gateway accepts only markers it issued in this session.

Local trust still matters

Local Claude sees original text and can retain it in temporary session files. Your terminal, detector, host, Docker daemon or macOS sandbox, and kernel must be trusted. Project files remain writable. Encryption leaks approximate span lengths and positions; surrounding text may reveal information too.

Read the security model

05 / REFERENCE

When you need
the details.

The detector timed out. What should I change?

Every request includes context and tool definitions, so detection takes longer than a short prompt. For compatible Qwen/vLLM models, try SEALGATE_ENABLE_THINKING=false and evaluate detection quality on representative data. SEALGATE_TIMEOUT_MS accepts 1–300000 milliseconds. Failures never trigger an unprotected fallback.

Can I use a provider other than local vLLM?

Yes. Configure a trusted OpenAI-compatible /chat/completions endpoint with JSON object output. It receives the original text. HTTPS is required except for loopback endpoints and literal private LAN addresses. Omit SEALGATE_ENABLE_THINKING unless the provider supports that extension.

How do I change what counts as sensitive?

Edit ~/.config/sealgate/config.json. The defaults cover credentials, personal identifiers, contact details, financial information, and explicitly marked confidential content. Add categories in additionalCategories, or replace detectionInstructions. Exact-match validation checks returned spans, not detection completeness.

What are the request limits?

The gateway accepts up to 2 MiB of JSON and 1 MiB of aggregated detection text, with depth 64 and 100,000 JSON nodes. It allows two active requests and a ten-minute overall deadline. Large contexts or unsupported structures are blocked; reduce the context or consult the gateway guide.

How can I verify my setup?

Follow the step-by-step tool verification guide for captured input/output, pass conditions, and a reproducible local run using synthetic data.

From the checkout, run the unit tests and the platform integration suite. The latter runs native Claude against a mock remote service using synthetic credentials. 

npm test
npm run test:seatbelt                            # macOS
sealgate sandbox-build && npm run test:sandbox   # Linux

To include your configured live vLLM detector with synthetic fixture text: 

SEALGATE_TEST_LIVE=1 npm run test:sandbox

A live Anthropic request additionally needs a current subscription login.

01

Gateway guide

Protocol, authentication, isolation, and supported features.

02

Implementation walkthrough

Detection, marker format, cryptography, and source map.

 03

Security model

Trust boundaries, local storage, and failure behavior.

 04

Tool verification

Step-by-step checks with captured inputs and outputs.

 05

Source on GitHub

Read the TypeScript, report an issue, or contribute.