ContextArmor

See what reached AI. Protect the next message locally.

ContextArmor is a local-first privacy toolkit for people who use AI with real client work. It separates two jobs that are often confused:

1. Free exposure audit: inspect explicitly selected AI conversation records after the fact and show current, daily, and weekly risk trends.
2. Local protection: create sanitized copies before supported work is read by an AI.

Raw transcripts, files, detected values, custom terms, and private mappings stay on the device. The baseline is risk reduction, not guaranteed anonymization, compliance, or proof of a breach.

The audit-ai-exposure Skill works across the packaged Codex, Claude Code, and Gemini CLI integrations. It scans only transcript paths or exports the user explicitly selects. It never claims background access to every AI client.

node skills/audit-ai-exposure/scripts/audit.mjs scan \
  --client codex \
  --term "Example Client" \
  ./synthetic-transcripts

Show the locally recorded trend without rescanning content:

node skills/audit-ai-exposure/scripts/audit.mjs report

The local event store contains only timestamps, client labels, counts, categories, severities, and skip reasons. Repeated scans may observe the same occurrence again, so the report does not call findings unique leaks.

Each report also contains a protection link with a random 128-bit installation ID, local audit number, client label, and finding-count band. The scanner does not open the link or make a network request. If the user chooses to open it, those aggregate fields can connect first audit, repeat audit, checkout, and paid conversion without sending transcript text, detected values, filenames, or custom terms.

The make-ai-safe-copy Skill creates a separate .ai-safe/ copy with stable placeholders before an agent reads supported files.

node skills/make-ai-safe-copy/scripts/safectx.mjs sanitize \
  --out-dir .ai-safe \
  --term "Example Client" \
  ./example

Originals remain untouched. The aggregate report excludes detected values; a mode-0600 private mapping remains local for optional restoration.

Agent Skills CLI:

npx skills add https://github.com/kuhung/contextarmor --skill audit-ai-exposure
npx skills add https://github.com/kuhung/contextarmor --skill make-ai-safe-copy

Codex CLI:

codex plugin marketplace add kuhung/contextarmor --ref main
codex plugin add contextarmor@contextarmor

Claude Code:

claude plugin marketplace add kuhung/contextarmor
claude plugin install contextarmor@contextarmor

Gemini CLI:

gemini extensions install kuhung/contextarmor --ref v0.4.1

• Selected transcripts and source files
• Detected values and custom client/project terms
• Aggregate day/week event history
• Random local installation ID used only after a user voluntarily opens the protection link
• Private placeholder mappings

The bundled scanners make no network requests. They do not silently modify original files or claim access to AI history the host does not expose.

The exposure audit accepts UTF-8 .txt, .md, .log, .json, .jsonl, .ndjson, .csv, .yaml, .yml, and .xml files up to 25 MB. The safe-copy workflow supports common text, source, configuration, and data formats listed in its Skill instructions.

Office documents, PDF, images, archives, metadata, comments, attachments, and OCR layers are intentionally outside the current baseline. Contextual secrets not provided as custom terms may remain.

• See the local protection workflow
• Report a missed category
• Report an incorrect detection
• Share workflow feedback

Never paste real secrets, customer data, private transcripts, detected values, or internal screenshots into a public issue.

Requires Node.js 22 or newer.

Release builds set CONTEXTARMOR_PROTECTION_URL to the deployed /r/audit endpoint. Development and tests can override it without changing the local scan or storage boundary.

npm test

Security and privacy reports: use the private contact form.