Alchembly
Personal Edition

AI Personal Firewall

Claude Code is useful because it reads your code. This screens what it sends — catching secrets and personal data on your own machine, before anything reaches Anthropic.

What it does

Runs locally

A proxy on 127.0.0.1 that Claude Code talks to instead of the API directly. Nothing is sent anywhere else.

Redacts before sending

API keys, tokens, card numbers, passports, names and phone numbers are replaced in the request itself.

Shows its work

A dashboard lists what was caught and why, with per-category controls for what blocks and what redacts.

Stays out of the way

A menu-bar app. Your Anthropic credential is never touched — it goes to Anthropic, as before.

What it looks like

Real screenshots of the shipped build, not mock-ups.

The firewall dashboard: a Recent activity table listing an AWS access key and an IBAN as redacted and three attempts as blocked, session totals of 5 requests, 2 redacted and 3 blocked, and the four collapsible groups of protection categories.
The dashboard. What was caught, in what category, and when — never the value itself. Session totals reset when the firewall restarts.
The firewall dashboard in dark mode: a Recent activity table listing an AWS access key and an IBAN as redacted and three attempts as blocked, session totals of 5 requests, 2 redacted and 3 blocked, and the four collapsible groups of protection categories.
The dashboard. What was caught, in what category, and when — never the value itself. Session totals reset when the firewall restarts.
The Connect Claude Code dialog, listing what connecting does — point Claude Code at a local proxy, update ~/.claude/settings.json, start the firewall as a login item — and what the app never transmits: caught values, the map back to the original, and your Anthropic credential.
Connecting. The app says what it is about to change, and what it will never send, before you agree to anything.

Download

Version 0.1.42.

macOSNotarised

Universal — Apple silicon and Intel · 231 MB
Download for macOS

Signed with an Apple Developer ID and notarised by Apple, so it opens without a Gatekeeper warning. macOS 11 or later.

SHA-256
4d8d3c94b9886b12b21d1424d0f74a508ad2a3e4b6f2f8d0cd032c4fe3cacd38

WindowsUnsigned

64-bit installer · 157 MB
Download for Windows

Not yet code-signed, so SmartScreen will warn on first run — choose More info, then Run anyway. Verify the checksum below if you would rather be certain. Windows 10 or later.

SHA-256
70bd02b1c597332893a303088e23a45a0ceeb0b7f37e8c12f63e2e4722b05797

Every release, with checksums: all releases.

Getting started

  1. Install the app and open it. It sits in the menu bar; there is no window until you ask for one.
  2. Choose Connect Claude Code. It explains exactly what it will change before it changes anything.
  3. Use Claude Code as normal. Open Dashboard to see what has been caught.

Connecting points Claude Code at the local proxy by adding a base URL and an access token to ~/.claude/settings.json, and starts the firewall as a login item. Disconnect Claude Code puts that file back exactly as it was.

Everything it does

The full list, for anyone who wants to know exactly what they are installing.

Redacted

The value is replaced in the request; the request still goes through.

  • Secrets
  • Personal information
  • PAN / card
  • Passport
  • Person names
  • GCC phone
  • GCC IBAN
  • Emirates ID

Blocked

The request is refused outright and never reaches Anthropic.

  • Prompt injection
  • Jailbreak attempt
  • Tool param injection
  • MCP definition
  • MCP result

Screening

  • The same detection engine as the enterprise product, unchanged — not a cut-down ruleset.
  • Thirteen categories, each switchable on its own. Whether a category redacts or blocks is fixed by the engine and cannot be changed through the dashboard.
  • Redaction is reversible. A caught value becomes a placeholder like [SECRET_1] on the way out, and is swapped back to the real value in Anthropic's reply before Claude Code reads it.
  • The same value always gets the same placeholder, so an unchanged prompt prefix stays byte-identical and Anthropic's prompt caching still hits.
  • Text you wrote yourself that merely looks like a placeholder is passed through untouched. The restorer never guesses.
  • Streaming replies are screened frame by frame, not buffered whole.
  • Claude Code's own Read, Edit, Bash, Grep and Write calls are screened for injected instructions but never blocked for being tool calls.
  • Pause keeps screening and keeps showing you what it finds — it just stops acting on it. Ordinary source code is not affected either way.
  • If the screening engine itself fails, the request is refused rather than forwarded. There is no path where a failure quietly becomes a passthrough.

The dashboard

  • A live feed of what was caught: category, rule, time and request id.
  • It never shows the caught value. Each row is a fixed per-rule phrase, so a secret cannot reappear on the screen that reported it.
  • Totals for the session — requests, redacted, blocked — reset when the firewall restarts. Nothing is kept between runs.
  • Per-category switches and the enforce/pause control, applied to the very next request; nothing in flight is dropped.
  • A status line that names the actual reason when something is wrong, rather than a generic error.
  • Update status, and a button to check again now.
  • Light and dark, keyboard-navigable, and usable at phone width.

The app

  • Lives in the menu bar on macOS and the tray on Windows. No window until you open one.
  • Connect Claude Code does the wiring for you: it backs up ~/.claude/settings.json, then adds a base URL and the firewall's own access token, preserving every other setting, the file's indentation and its key order.
  • Disconnect restores that file byte-for-byte. Quitting disconnects first, then stops the firewall — in that order, so you are never left pointed at a proxy that is gone.
  • Uninstalling on Windows runs the same teardown before it removes any files.
  • The firewall keeps running if the app is closed or crashes — a LaunchAgent on macOS, a scheduled task on Windows.
  • Port 8081 by default; if something else holds it, the app takes a free port, writes that one into your settings, and tells you which process was in the way.
  • The bundled firewall binary is checksummed, and the app refuses to start one that does not match.

Privacy

  • Everything is on 127.0.0.1. The bind address is not configurable — there is no setting that exposes it to the network.
  • Your Anthropic credential is never read, stored or replaced. Connect deliberately does not write an auth token into your settings; your existing credential goes to Anthropic exactly as it did before.
  • Caught values are held in memory for the life of the process and never touch disk, logs or any other sink.
  • A per-install access token guards the proxy and the dashboard — owner-only on disk, and on Windows the whole directory's permissions are locked down, not just the file.
  • Requests that do not come from your own machine are rejected on the host header, which is what stops a hostile web page reaching the proxy through your browser.
  • No account, no sign-in, no telemetry. Besides Anthropic, the only address the app ever contacts is its own update feed.

Installing and updating

  • macOS: one universal build for Apple silicon and Intel, signed with an Apple Developer ID and notarised by Apple.
  • Windows: a per-user installer. No administrator prompt, and nothing written to Program Files or the machine registry.
  • Every download is published with its SHA-256 so you can check it before you run it.
  • The update feed is signed with a key built into the app, which is checked before an update is trusted. An unsigned or altered feed is refused, and the app says so rather than failing quietly.
  • macOS installs updates itself. Windows tells you a new version exists and links you to it.