mcp server

pastewatch

Detects and obfuscates sensitive data before it reaches AI systems — clipboard, CLI, and MCP server

ppiankov/pastewatchcommunitylistedunreviewed

Use tool

Set up

Runs on your computer. Pick your agent and operating system.

This project does not publish an install method we can turn into a config. Follow the README instead.

README

synced Oct 25, 2026

Pastewatch

Detects and obfuscates sensitive data before it reaches AI systems — clipboard monitoring, CLI scanner, MCP server, API proxy, shell guard hooks, and VS Code extension.

It operates before paste, not after submission.

If sensitive data never enters the prompt, the incident does not exist.

Core Principle

Principiis obsta - resist the beginnings.

Pastewatch intervenes at the earliest irreversible boundary: the moment data leaves the user's control.

Once pasted into an AI system, data cannot be reliably recalled, audited, or constrained.

Pastewatch refuses that transition.

Why This Matters

Every AI agent sends your file contents, command outputs, and tool results to a cloud API. If those contain secrets, the secrets leave your machine — silently, irreversibly, and into infrastructure you don't control.

Pastewatch prevents supported secret-leakage paths structurally without breaking agent workflows:

  What the agent does                What actually happens
  ──────────────────                 ──────────────────────
  Read a file with secrets     →    MCP returns placeholders, secrets stay in RAM
  Run a bash command with DSN  →    Guard blocks before execution
  Send tool results to API     →    Proxy redacts secrets from the request body
  Write code with placeholders →    MCP resolves originals locally on write-back

The agent works normally. It reads files, runs commands, and writes code. Through MCP, the agent sees reversible placeholders; through the proxy, intrinsically identifiable or operator-authorized secrets are replaced before supported traffic reaches the cloud.

No ML and no probabilistic mutation. Authorization comes from secret evidence, not severity.

Why Pastewatch

Before-paste boundary — authorized secret matches are rewritten before supported traffic leaves. Nightfall, Prisma, Check Point all intercept downstream. Pastewatch prevents upstream
MCP server for AI agents — no other tool provides redacted read/write at the tool level. Authorized matches become reversible placeholders while the secret map stays local
Bash guard with deep parsing — pipes, subshells, redirects, database CLIs, infra tools. Every shell command the agent runs is scanned before execution
API proxy — filters model egress for supported traffic routed through it, including from subagents (refuses unrecognized upstream shapes rather than forward them unscanned)
Canary honeypots — "prove it works" not "trust it works." Plant format-valid fake secrets and verify they're caught
Local-only, deterministic, no ML — no cloud dependency, no probabilistic scoring, no telemetry. Runs offline, gives the same answer every time
One command — pastewatch-cli launch claude and every layer is active. No manual setup, no env vars, no second terminal

What Pastewatch Does

Pastewatch started as a clipboard monitor — scan before paste, replace secrets with placeholders. It evolved into a full secret protection stack for AI agent workflows:

Layer	What it does	How it works
Clipboard monitor	Scans before paste	macOS menubar app, replaces secrets in clipboard
CLI scanner	Scans files, directories, git diffs	`pastewatch-cli scan --dir .`
Startup sweep	Warns about pre-existing shell config credentials	`pastewatch-cli launch` scans common startup files once per changed finding summary
MCP server	Redacted read/write for AI agents	Agent sees placeholders, originals stay in RAM
Shell guard	Blocks secrets in commands and file access	Pre-execution hook for Claude Code, Cline, Cursor, Windsurf, Continue, Amazon Q
API proxy	Redacts secrets from supported outbound API traffic	Scans Anthropic-shaped requests and refuses unsupported body shapes
VS Code extension	Real-time detection in the editor	Highlights secrets as you type

All layers share the same detection engine — 30+ pattern types, deterministic regex, no ML. Every layer operates locally. Nothing phones home.

Zero false-positive mutation

Pastewatch rewrites your data only when it is certain the value is a secret. This is a hard rule, not a tuning knob:

Mutated: intrinsically identifiable secrets such as sourced provider tokens, complete private keys, validated JWTs and cards; exact values supplied by a trusted local source; patterns you approve with a custom rule; and email/host values covered by an obfuscate entry.
Opt-in ambiguity: intrinsic detectors are enabled by default. Email and host mutation requires an exact or domain-scoped obfuscate entry. Unconfigured email/host values are not rewritten or nagged; the proxy records only privacy-safe domain coverage so the operator can decide whether to opt in. Other ambiguous detectors remain advisory-only when explicitly enabled.
--severity controls how much it nags, never what it rewrites. Lowering severity surfaces more advisories; it never widens the set of values that get mutated.

The result: false negatives are preferred over false positives, and mutation false positives are driven to ~zero by construction. Pastewatch never breaks a working agent response to redact something it only might be.

What Pastewatch is NOT

Not a DLP system — no policies, no enforcement workflows, no admin console
Not a compliance product — it does not certify, audit, or generate reports for regulators
Not an AI classifier — deterministic pattern matching only, no probabilistic scoring
Not a policy engine — it does not decide what you're allowed to do, it prevents structural leaks
Not an approval system — it does not collect, queue, or adjudicate approvals; exemptions stay narrow, scoped, and operator-authored (every path)
Not a sandbox — the shell guard is a guardrail for cooperative agents, not containment for a hostile process running as you

Pastewatch does not:

phone home or collect telemetry
require cloud connectivity
guess, infer, or act when uncertain
store clipboard history or file contents
make decisions — it presents evidence and lets you decide

Where Pastewatch stops

Pastewatch is a blade, not a toolbox. On a single developer's machine it is complete: detect, decide, obfuscate. Free, offline, no account.

It deliberately stops there. Team-wide policy, approving ambiguous matches in real time from one place, rules that approve on your behalf with a record of who signed them, and gateways for remote and multi-model traffic are a different job.

That job is NeuroRouter Pro. It runs alongside Pastewatch; neither replaces the other.

How Pastewatch Works

Pastewatch scans text for sensitive patterns and replaces them with non-sensitive placeholders. The same engine powers all six layers:

Detection — regex-based pattern matching across 30+ secret types (API keys, DSNs, tokens, credentials, PII)
Authorization — evidence partitions matches into mutation or advisory-only outcomes
Obfuscation — authorized values are replaced with typed placeholders (<AWS_KEY_1>)
Resolution — only the MCP server stores originals in local RAM and restores them on write-back

The clipboard monitor scans before paste. The CLI scans files on demand. The MCP server scans on read and resolves on write. The guard scans commands before execution. The proxy scans API requests before they leave the network. Each layer catches what the others miss.

Quick Start

30 seconds from zero to protected AI agent session:

# 1. Install
brew install ppiankov/tap/pastewatch

# 2. Set up hooks and MCP server for your agent
pastewatch-cli setup claude-code

# 3. Run through the proxy — one command, fully protected
pastewatch-cli launch claude

The launch command starts the proxy, waits for it to be ready, sets ANTHROPIC_BASE_URL, and runs Claude Code. When the agent exits, the proxy stops. The proxy scans Anthropic-shaped API requests and redacts supported secrets before they leave your machine. Protect other agents with configured hooks, MCP tools, and agent instructions where available.

Important: The setup step injects credential handling rules into your agent's CLAUDE.md. Without these rules, agents may echo passwords in shell output or store plaintext credentials in memory files — formats that bypass regex detection. The rules ensure agents use detectable keywords (password=, secret=) and never store raw values. See docs/CLAUDE-SNIPPET.md for the full snippet.

For persistent setup, add a shell alias:

# .zshrc / .bashrc
alias claude='pastewatch-cli launch claude'

Installation

From Release (Recommended)

Download the latest .dmg from Releases
Open the DMG and drag Pastewatch.app to Applications
Launch Pastewatch from Applications
Grant notification permissions when prompted

CLI via Homebrew

brew install ppiankov/tap/pastewatch
pastewatch-cli doctor    # verify installation

CLI Manual Install (No Homebrew)

For environments where Homebrew is not available (CI runners, restricted workstations):

# macOS (universal binary — Apple Silicon + Intel)
curl -L -o pastewatch-cli https://github.com/ppiankov/pastewatch/releases/latest/download/pastewatch-cli

# Linux x86_64
curl -L -o pastewatch-cli https://github.com/ppiankov/pastewatch/releases/latest/download/pastewatch-cli-linux-amd64

# Linux arm64
curl -L -o pastewatch-cli https://github.com/ppiankov/pastewatch/releases/latest/download/pastewatch-cli-linux-arm64

chmod +x pastewatch-cli
sudo mv pastewatch-cli /usr/local/bin/
pastewatch-cli doctor

Or build from source (requires Swift 5.9+):

git clone https://github.com/ppiankov/pastewatch.git
cd pastewatch
swift build -c release
sudo cp .build/release/PastewatchCLI /usr/local/bin/pastewatch-cli

From Source (GUI)

git clone https://github.com/ppiankov/pastewatch.git
cd pastewatch
swift build -c release
./.build/release/pastewatch

Detection Scope

Binary transfers stay blocked unless the operator issues an exact path-and-hash grant with pastewatch-cli allow-binary <file> in their own terminal. See binary transfer grants.

Pastewatch detects only deterministic, high-confidence patterns:

Type	Examples
Email	`user@company.com`
Phone	`+60123456789`, `(555) 123-4567`
IP Address	`192.168.1.100`
AWS Keys	`AKIAIOSFODNN7EXAMPLE`
API Keys	`sk_test_...`, `ghp_...`
Obsta Labs Licenses	`ol_<base64url-payload>.<base64url-signature>` (issued signature: 86 unpadded characters; includes renewal and trial licenses)
Stripe Checkout Sessions	`cs_live_...`, `cs_test_...` (24+ alphanumeric characters)
UUIDs	`550e8400-e29b-41d4-a716-446655440000`
JWT Tokens	`eyJhbGciOiJIUzI1NiIs...`
DB Connections	`postgres://...`, `clickhouse://...`
SSH Keys	PEM header shape: `-----BEGIN ... PRIVATE KEY-----`
Credit Cards	`4111 ** ** 1111` (Luhn validated)
File Paths	`/etc/nginx/nginx.conf`, `/home/deploy/.ssh/id_rsa`
Hostnames	`db-primary.internal.corp.net`
Credentials	`password=...`, `secret: ...`, `api_key=...`
Slack Webhooks	`https://hooks.slack.com/services/...`
Discord Webhooks	`https://discord.com/api/webhooks/...`
Azure Connections	`DefaultEndpointsProtocol=https;AccountName=...;AccountKey=...`
GCP Service Accounts	`{"type": "service_account", ...}`
OpenAI Keys	`sk-proj-...`, `sk-svcacct-...`
Anthropic Keys	`sk-ant-api03-...`, `sk-ant-admin01-...`
Hugging Face Tokens	`hf_...`
Groq Keys	`gsk_...`
npm Tokens	`npm_...`
PyPI Tokens	`pypi-...`
RubyGems Tokens	`rubygems_...`
GitLab Tokens	`glpat-...`
Telegram Bot Tokens	`123456789:AA...`
SendGrid Keys	`SG....`
Shopify Tokens	`shpat_...`, `shpca_...`
DigitalOcean Tokens	`dop_v1_...`, `doo_v1_...`
Perplexity Keys	`pplx-...`
JDBC URLs	`jdbc:oracle:thin:@...`, `jdbc:db2://...`, `jdbc:postgresql://...`
XML Credentials	`<password>`, `<secret_access_key>`, etc. in XML configs
XML Usernames	`<user>`, `<quota_key>` in XML configs
XML Hostnames	`<host>`, `<hostname>`, `<interserver_http_host>` in XML configs
High Entropy Strings	Opt-in Shannon entropy detection (4.0 bits/char threshold)

Each type has a severity level (critical, high, medium, low) used in SARIF, JSON, and markdown output.

No ML. No probabilistic scoring. No confidence levels.

If detection is ambiguous, Pastewatch does nothing.

Obfuscation Model

Detected values are replaced with typed, numbered placeholders:

AKIAIOSFODNN7EXAMPLE  →  <AWS_KEY_1>
AIza...               →  <GOOGLE_API_KEY_1>
github_pat_...        →  <GITHUB_TOKEN_1>

How placeholders work depends on the layer:

Layer	Placeholder lifetime	Recovery
Clipboard	Discarded after paste	None — one-way
CLI scan	Output only	None — source files are never modified
MCP server	Stored in RAM for the session	Write-back resolves originals locally
API proxy	Replaced in-flight	None — redacted before it leaves

The MCP server is the only layer that maintains a mapping, because it must restore placeholders locally when the agent writes a file. Clipboard and proxy replacement is one-way; responses are scanned independently rather than deobfuscated. The MCP mapping lives in process memory and is lost when the session ends.

User Experience

Clipboard/GUI — silent by default. When obfuscation occurs, a minimal macOS notification: Pastewatch: Obfuscated: AWS Key (1), Google API Key (1)
CLI — findings printed to stdout, exit code 6 if secrets found
Startup sweep — one stderr warning per changed shell config finding summary during launch; disable with --no-startup-sweep (details)
MCP — transparent to the agent. It reads placeholders and writes them back. No user interaction needed
Guard hook — blocks with a clear message: BLOCKED: file contains secrets. Use pastewatch_read_file instead
Proxy — redacts silently. When secrets are caught, injects a [PASTEWATCH] alert into the agent's response so it can warn the user

No previews. No animations. No confirmations. Silence is success.

CLI Mode

pastewatch-cli provides scanning, guarding, and proxy subcommands for use without the GUI:

pastewatch-cli scan --dir .              # scan a directory
pastewatch-cli launch claude             # proxy + agent in one step
pastewatch-cli guard "cat .env"          # block secret-leaking commands
pastewatch-cli mcp                        # redacted read/write MCP server
pastewatch-cli check --file README.md     # explain per-surface decisions
pastewatch-cli doctor --explain           # inspect active config and rule coverage

Full command reference: docs/cli-reference.md — every subcommand (scan, proxy, launch, mcp, guard, fix, inventory, report, canary, watch, dashboard, config, and CI integration) with flags and examples.

Explain active configuration

pastewatch-cli doctor --explain
pastewatch-cli doctor --explain --json

Configuration merges protection from administrator and user policy with the current directory's .pastewatch.json. A project can add detectors, rules, protected paths and obfuscation, or raise rule severities; it cannot discard operator entries or add suppression patterns. Lowering mcpMinSeverity reports more advisories; raising it cannot hide existing reports. When administrator policy exists, user policy is also tighten-only.

Project and tighten-only user entries exempt advisory classes only, never non-ambiguous types, custom rules or intrinsic/exact-known-secret evidence. The walkthrough shows each contributing tier and per-field attribution. It never changes policy.

The report includes enabled detectors, compiled custom rules and their effective severity, shared pattern loading, allowlist counts, documentationPolicy, and guard/scan/MCP/proxy outcomes. Rule outcomes assume a match that is not allowlisted; the guard threshold is high. MCP's advisory threshold does not disable authorized placeholder replacement. Invalid active configuration fails enforcement closed. Patterns and allowlisted values are represented only by byte lengths and sorted character-class sets, never their literal contents, positional shapes or hashes. Plain doctor is unchanged.

Check a value across surfaces

pbpaste | pastewatch-cli check
pastewatch-cli check --file CHANGELOG.md
pastewatch-cli check --json < input.txt
pastewatch-cli check  # interactive input is not echoed

check uses the same configuration explanation and production decisions as the scanners. It reports the active config, loaded custom-rule count, detection type, severity, mutation evidence, allowlist suppression, and guard/scan/MCP/proxy outcomes. No match is explicit, not a claim of universal coverage. Values appear only as byte lengths and sorted character-class sets (letters, digits, whitespace, symbols), without positional shapes or hashes. Rule patterns and allowlist entries are never printed.

Guard verdicts use the high threshold; scan verdicts use the default scan policy. --file passes its real path to the documentation policy. MCP verdicts model a trusted file read at mcpMinSeverity: placeholders are restored locally on write (two-way). Proxy verdicts model the input as an outbound user-text field: redaction is one-way, never restored. The report preserves differences between the surfaces, including their allowlist and inline-comment handling. It makes no network requests and does not validate whether credentials are live.

Pass input through stdin or --file, never as a positional value: arguments are visible in shell history and ps. Positional values are refused with exit 64 without being echoed. A completed diagnostic exits 0 and reports the scan exit code separately; unreadable input or invalid configuration exits 2.

Documenting credentials

To show a connection string or password in documentation, use one of these forms; every other value is treated as a real secret and blocked (and redacted on MCP read / proxy). This policy applies to database URL userinfo when the DB Connection detector is enabled; it does not expand detection coverage.

Preferred form	Example password component
Angle brackets	`<password>`
Braced environment variable	`${DB_PASSWORD}`
Environment variable	`$DB_PASSWORD`
Double-braced template	`{{db_password}}`
Percent-format template	`%(password)s`
Percent-delimited variable	`%DB_PASSWORD%`
Repeated mask	`****` / `xxxx`

Accepted words: password, passwd, pass, pwd, secret, changeme, change_me, example, sample, test, dummy, placeholder, redacted, your_password, yourpassword, mypassword, my_password.

Word matching is case-insensitive and does not trim whitespace. Uniform masks must contain at least three characters. Passwords are percent-decoded once before comparison; malformed encodings are compared as written. passw0rd and p@ssw0rd are not placeholders: they are common real passwords.

Verify a line before committing it, supplying the value through stdin:

printf '%s\n' '<line>' | pastewatch-cli check

For one specific known-safe example, put the whole DSN in allowedValues in your user config (~/.config/pastewatch/config.json), or have an administrator add it to system policy. When system policy exists, only that tier grants this exemption. Password-only entries do not suppress the connection. Patterns, project entries and inline comments never exempt intrinsic secrets. Agents cannot create or modify .pastewatch.json or .pastewatch-allow.

Agent Integration

Agent Safety Matrix

The API proxy (Layer 0) redacts supported Anthropic-shaped traffic (/v1/messages and /v1/messages/batches) and refuses unrecognized upstream body shapes (HTTP 415). pastewatch-cli launch wires only Claude Code to this proxy. Other clients need hooks or MCP unless the operator separately configures an Anthropic-compatible client to use pastewatch-cli proxy; OpenAI/Gemini-shaped bodies are not redacted.

Agent	Protection	Hooks	MCP	Setup
Claude Code	Structural	PreToolUse (exit 2)	Automatic	`pastewatch-cli setup claude-code`
Cline	Structural	PreToolUse (JSON cancel)	Automatic	`pastewatch-cli setup cline`
Roo Code	Structural	PreToolUse (JSON cancel)	Automatic	`pastewatch-cli setup roo-code`
Cursor	Structural	preToolUse (exit 2)	Automatic	`pastewatch-cli setup cursor`
Windsurf	Structural	pre_read/write/run (exit 2)	Automatic	`pastewatch-cli setup windsurf`
Continue	Structural	PreToolUse (exit 2)	Automatic	`pastewatch-cli setup continue`
Amazon Q	Structural	preToolUse (exit 2)	Automatic	`pastewatch-cli setup amazon-q`
Copilot	Structural	preToolUse (`.github/hooks/`)	Automatic	`pastewatch-cli setup copilot`
Codex CLI	Structural after hook trust	PreToolUse (exit 2)	Manual TOML	`pastewatch-cli setup codex`, then review with `/hooks`
Qwen Code	Structural	PreToolUse (exit 2)	Automatic	`pastewatch-cli setup qwen-code`
Goose	MCP only	No hooks	Manual YAML	`pastewatch-cli setup goose`
Kilo Code	MCP only	No hooks (declined)	Automatic	`pastewatch-cli setup kilo-code`
Gemini	MCP only	No hooks	Automatic	`pastewatch-cli setup gemini`
Antigravity (agy)	Proxy not applicable + MCP only (voluntary tools; no Structural read blocking)	No - handler registration fails	Yes	Not yet supported by `pastewatch-cli setup`; edit `~/.gemini/config/mcp_config.json` manually
OpenCode	MCP only	No hooks	Yes	Manual
Aider	No automatic local layer	No MCP yet	Unavailable	`pastewatch-cli setup aider` explains the limitation
Jules	Cloud only	No local config	Cloud UI	N/A (use proxy on local side)

Structural = registered hooks can block the named native tool before it runs. Other readers and routes can bypass those events; this is not a sandbox. MCP only = redaction applies only when the agent uses the configured Pastewatch MCP tools. Native file or network access is not intercepted.

See What each layer covers. pastewatch-cli doctor reports each setup agent's detected coverage tier: hooks+wire, hooks+MCP, MCP advisory, or none. Wire coverage requires traffic routed through the proxy; the Bash reader list is frozen.

Install

Install via Homebrew:

brew install ppiankov/tap/pastewatch

Or download the binary:

curl -LO https://github.com/ppiankov/pastewatch/releases/latest/download/pastewatch-cli
chmod +x pastewatch-cli
sudo mv pastewatch-cli /usr/local/bin/

For AI coding agents: Use MCP redacted read/write to prevent secret leakage - see docs/agent-safety.md for setup.

For CI/CD: Use the CLI scan command or GitHub Action.

Agents: read docs/SKILL.md for commands, flags, config files, detection types, and exit codes.

Configuration

Config files

File	Location	Purpose	Created By
`.pastewatch.json`	Project root	Project-level config (rules, allowlists, hosts)	`pastewatch-cli init`
`~/.config/pastewatch/config.json`	Home	User-level defaults	Manual / GUI app
`.pastewatch-allow`	Project root	Value allowlist (one per line, `#` comments)	`pastewatch-cli init`
`.pastewatchignore`	Project root	Path exclusion patterns (glob, like `.gitignore`)	Manual
`.pastewatch-baseline.json`	Project root	Known findings baseline	`pastewatch-cli baseline create`

Configuration merges administrator, user and project contributions with tighten-only subordinate tiers. For file targets, .pastewatch-allow is loaded automatically from the target's Git toplevel; outside Git, use the explicit scan/watch root (a single-file scan uses its parent). Entries are exact advisory exemptions only,

never non-ambiguous types, custom rules or intrinsic/exact-known-secret evidence. Stdin, raw MCP text and the guard's command-string pass load no project allow file. doctor --explain shows

the resolved path, loaded status, effective entries and ignored non-advisory/custom-rule entries.

Every way a finding can be let through, who may author it and how far it reaches: docs/exemptions.md.

`.pastewatch.json` schema

{
  "enabled": true,
  "enabledTypes": ["AWS Key", "SSH Private Key", "JWT Token", "Vault Token"],
  "showNotifications": true,
  "soundEnabled": false,
  "allowedValues": ["test@example.com"],
  "allowedPatterns": ["sk_test_.*", "EXAMPLE_.*"],
  "customRules": [
    {"name": "Internal ID", "pattern": "MYCO-[0-9]{6}", "severity": "medium"}
  ],
  "safeHosts": [".internal.company.com"],
  "sensitiveHosts": [".local", "secrets.vault.internal.net"],
  "sensitiveIPPrefixes": ["172.16.", "10."],
  "mcpMinSeverity": "high",
  "operatorRedactionNotices": false,
  "obfuscate": [
    {"type": "email", "pattern": "operator@example.com"},
    {"type": "email", "pattern": "@example.com"},
    {"type": "host", "pattern": "gateway.example.com"},
    {"type": "host", "pattern": ".example.com"}
  ],
  "placeholderPrefix": "REDACTED_PLACEHOLDER_"
}

Field	Type	Description
`enabled`	bool	Enable/disable scanning globally
`enabledTypes`	string[]	Detection types to activate (default: intrinsic detectors only)
`showNotifications`	bool	System notifications on GUI obfuscation
`soundEnabled`	bool	Sound on GUI obfuscation

GUI settings can also be changed via the menubar dropdown.

Threat Model

Pastewatch assumes:

Users will paste sensitive data
AI systems are not trusted with raw secrets
Prevention is cheaper than remediation

Pastewatch does not attempt to secure downstream systems. It prevents supported, positively identified secrets from entering configured agent transports; ambiguous classes stay unchanged unless the operator authorizes them.

Known limitations

The command guard scans recognized copy, move, install and redirection sources using the source file's policy, not the destination extension. Documentation classification is path-based. Expansions in destinations or option values do not suppress literal source checks; unresolved source operands cannot be inspected. Renaming through scripts, obfuscated shell commands or recursive directory operations can bypass this source-file check.

Unknown copy options are treated as value-less flags and do not disable source checks. Truly unparseable copy commands are allowed with one stderr diagnostic naming the unsupported command, without its operands. This is not a shell sandbox or adversarial-agent containment. Intrinsic secrets, exact known values and custom rules remain actionable in documentation files.

Design Constraints

Local-only operation
Deterministic behavior
Minimal UI surface
No background analytics
No user accounts
No configuration required for safe defaults

If a feature increases complexity without reducing risk, it is rejected.

Platform Support

Platform	Component	Status
macOS (Apple Silicon)	GUI + CLI	Supported
macOS (Intel x86_64)	CLI only	Supported (universal binary)
Linux x86_64	CLI only	Supported
Linux arm64	CLI only	Supported
Windows	—	Not supported natively — run the Linux binary under WSL2

The GUI (clipboard monitoring) is macOS-only. The CLI runs on macOS and Linux via Homebrew or direct download.

Windows: there is no native Windows build. Run the CLI inside WSL2 using the Linux amd64 binary (see Installation → Linux x86_64). If you need native Windows secret-redaction on the API wire, that is the domain of the gateway layer, not this tool.

Linux proxy note: On Linux, the proxy uses curl (Process) for upstream HTTP requests instead of Swift's URLSession. This works around a known FoundationNetworking bug on arm64 where dataTask completion handlers silently fail. Requires curl on PATH (present on all standard Linux distributions).

Documentation

docs/troubleshooting.md - Inactive rules, document policy, and copy-source guard decisions
docs/agent-integration.md - Consolidated agent reference (enforcement matrix, MCP setup, hooks, config)
docs/agent-setup.md - Per-agent MCP setup (Claude Code, Claude Desktop, Cline, Cursor, OpenCode, Codex CLI, Qwen Code)
docs/agent-safety.md - Agent safety guide (layered defenses for AI coding agents)
docs/examples/ - Ready-to-use agent configs (Claude Code, Cline, Cursor)
docs/hard-constraints.md - Design philosophy and non-negotiable rules
docs/status.md - Feature milestones, stability, current scope, and non-goals
docs/cli-reference.md - Full CLI command reference (scan, proxy, guard, MCP, and all subcommands)
docs/exemptions.md - Every exemption path, who may author it, and its reach

License

MIT License.

Use it. Fork it. Modify it.

Do not pretend it guarantees compliance or safety.

Project Status

Status: Stable, feature-complete · v0.44.2 · Accepting compatibility and bug fixes only

Pastewatch is stable and in maintenance mode. See docs/status.md for the full feature-milestone breakdown.