What shim-cli can't do

We launched today, and we'd rather you hear the limits from us before you install.

• A prompt you type into Claude Code or Codex is not masked, because neither client lets a hook rewrite it. shim reports it, or blocks it under enforce. Copilot CLI is the exception: there the model gets the masked prompt.

• In Claude Code, the output of a failed command can't be replaced. cat .env && cat missing-file exits non-zero and the model reads the .env as is. shim reports it.

• Files attached with @ and shell commands are reported, not masked.

• Codex and Copilot CLI tool traffic isn't inspected yet. VS Code reports but masks nothing.

• Detection is patterns plus checksums. It misses names, postal addresses and passwords with no key name. Treat it as a guard, not a DLP boundary.

• No Windows yet. macOS and Linux work.

Why a hook and not an MCP server? An MCP server only sees calls to its own tools. The agent's built-in Read and Bash never pass through it. A hook sits on the client's own tool calls, so it sees those too.

Which of these would stop you from using it? Your answers decide what we fix first.

Full list: https://github.com/GetSHIM/shim-...