Noirdoc

What is Noirdoc?

Noirdoc is an open-source “PII guard” for Claude Code that pseudonymizes sensitive data before it reaches Claude, then restores the original values in a user-controlled way. Its core purpose is to prevent real names, emails, IBANs, and other detected identifiers from entering the Claude Code context while you work.

The page also describes the same underlying approach delivered through other entry points: a local CLI for redacting documents in any LLM workflow, and a hosted proxy that scrubs API calls for OpenAI, Anthropic, and Azure.

Key Features

• PreToolUse redaction for Claude Code: A hook redacts protected files before Claude Code reads them, so real values do not enter Claude’s context.
• Local detection and processing: The detection and pseudonymization run on your machine; the page states that no API call leaves your machine “not even to us.”
• Reversible mapping with local reveal: Pseudonymized outputs are restored automatically after processing; you can run noirdoc reveal to view originals in your own terminal.
• Configurable protection via path rules: Glob patterns (e.g., ./incoming/** or *.contract.*) determine which files are pseudonymized; everything else remains untouched.
• Local storage of mappings: The plugin keeps pseudonymized copies in .noirdoc/cache/ and preserves the reversible mapping locally (with behavior depending on “one-shot” vs “persistent” modes in the CLI examples).

How to Use Noirdoc

• Install the Claude Code plugin

  1. Add it to the Claude Code marketplace: /plugin marketplace add nextaim-de/noirdoc-claude-plugin
  2. Install inside Claude Code: /plugin install noirdoc@nextaim
  3. Open or read a protected file in Claude Code; the plugin redacts detected items before Claude sees them.

• Reveal originals locally after a workflow

  • In your own shell, run noirdoc reveal to view original values. The page emphasizes that reveal happens outside the Claude Code transcript.

• Use the CLI for local document workflows

  • Install: pip install noirdoc
  • Example one-shot round trip: redact a file to a cleaned output, then reveal back using the output file.
  • Example persistent mode uses a namespace so the mapping can be reused across commands.

Use Cases

• Working with documents containing personal or account identifiers in Claude Code: Protect files that include real names, emails, IBANs, or IDs so Claude Code receives placeholders instead of original values.
• Batch redaction of incoming contracts or paperwork: Use path/glob rules to pseudonymize only certain folders (e.g., an incoming directory) or file types (e.g., *.contract.*) while leaving other files unchanged.
• Controlled review of restored answers: Keep the conversation “clean” in Claude Code, then run noirdoc reveal in your own terminal to recover original values when you need them.
• Integrating redaction into non-Claude LLM workflows via CLI: Use noirdoc to redact PDFs, DOCX, and plain text locally, then translate responses back using consistent placeholders.
• Scrubbing LLM API requests for teams: Use the hosted proxy (or a self-hosted version per the page) when you want every OpenAI/Anthropic/Azure API call to be scrubbed with a two-line integration.

FAQ

• Does Noirdoc send my data to a third party? The page states that detection runs locally and that no API call ever leaves your machine “not even to us.”

• How are sensitive values handled during the Claude Code run? The plugin pseudonymizes inputs locally before Claude Code passes them on, replacing names, IBANs, and IDs with placeholders.

• Can I get the original values back? Yes. The plugin restores responses automatically, and you can reveal original values by running noirdoc reveal in your own terminal (outside the Claude Code transcript).

• How do I choose which files are protected? The page describes path rules using glob patterns to decide which files are pseudonymized automatically.

• Is there more than one way to use Noirdoc? Yes: the page describes three entry points—a Claude Code plugin, a local CLI for general document workflows, and a hosted proxy (with the option to self-host) for API calls.

Alternatives

• Manual preprocessing of documents (redaction before prompting): You can redact sensitive fields yourself before sending text to an LLM, but you must manage placeholder consistency and restoration manually.
• Generic data-loss-prevention (DLP) or content filtering tools: These can help prevent sensitive data from being shared, but they may not provide reversible placeholder mapping and response restoration tuned to Claude Code workflows.
• Other LLM “PII masking” middleware: Alternatives in this category typically mask sensitive strings before requests; you would compare how they integrate (plugin vs proxy vs middleware) and whether they support reversible mappings and local workflows.
• Self-hosted proxy solutions for LLM APIs: If your primary need is API scrubbing, a proxy-based approach can centralize control, whereas the Claude Code plugin focuses on local handling inside Claude Code.