SkilakMesh
Get Mesh
NewInstall Mesh in one command

Your claude moves fast.Your secrets stay put.

Mesh runs on your computer and checks what your AI coding tools send. Secrets and personal data are redacted or blocked before they reach the AI provider.

See it in action Explore coverage
mesh-gatewaymesh-gateway
FAIL-CLOSED
Requestclaude
claude“Why does this fail? aws_access_key_id=AKIAIOSFODNN7EXAMPLE”
Mesh decisionMesh decisionREDACT
FoundAWS access key ID
ResultForwarded with the key replaced by [REDACTED:secret]
Audit recordno message content
{"event": "decision", "verdict": "redact", "redacted": true}
Runs on your computer
Example
RunsOn your computer
BehaviorFail-closed default
AuditLocal, no message content
PolicyBalanced or Strict
Long chatsStay fast
SetupNo Docker needed

Illustrative inspection

See Mesh in action.

See how Mesh redacts sensitive data, blocks a request under Strict policy, and lets a clean request through. These examples use synthetic data.

REDACT

An API key in a prompt

An engineer includes a fake AWS secret key in a Claude Code prompt. With Balanced policy, Mesh can replace the key before forwarding the request.

01Claude Code CLI · localhost
claude · terminal
❯claude "Fix authentication in provider.ts: aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
Example request content sent to Mesh
{
  "role": "user",
  "content": "Fix auth in provider.ts: aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}
02Local Mesh Gateway · Boundary Policy
smesh-gatewayREDACT
Rule Matched:aws_secret_access_key
Pattern:AWS secret access key pattern
Active Policy:Balanced (Redact & Forward)
03Example policy result
Redacted request forwarded
Content after Mesh decision
{
  "role": "user",
  "content": "Fix auth in provider.ts: aws_secret_access_key=[REDACTED:secret]"
}
Example decision summary
Metadata only
{"event":"decision","verdict":"redact","redacted":true}

Coverage

What Mesh catches

Mesh scans each request your connected AI tool sends. The default Balanced policy replaces detected values with placeholders such as [REDACTED:pii_ssn] and keeps you working. A Strict policy is available.

REDACTBLOCK

Secrets & credentials

Dozens of API key and token formats, plus passwords typed into a conversation.

REDACT

Personal data

Email addresses, phone numbers, SSNs and ITINs, payment cards with CVV and PIN, bank routing and account numbers, IBANs, and dates of birth.

REDACT

IDs & addresses

Passport and driver's licence numbers, street addresses, and health-plan and Medicare IDs.

BLOCK

Health, HR & legal

Common patterns in health information, HR records, and contract language.

REDACTBLOCK

Tool calls & agent traffic

Model-bound JSON, tool arguments, and agent messages are scanned too.

Long conversations

History that was already scanned is not scanned again, so long sessions stay fast.

Provider responses

Relayed to the client unmodified and not inspected. Mesh is an egress control: it enforces policy on what you send and records response metadata payload-free.

Coding-agent boundary

Complements OS sandboxing by inspecting outbound traffic routed through the mesh. It does not monitor filesystem reads.

Local dashboard

See what Mesh is doing.

Open a clear view of protection, traffic, and recent decisions in your browser. Dashboard Lite runs on your computer alongside the script-installed gateway.

Explore the dashboard smesh on GitHub

Already installed?

shell
smesh dashboard open

Included with the CLI. No separate desktop app needed.

Mesh Dashboard Lite with example gateway health, policy, protected clients, decision counts, inspection charts, and recent decisions.View full dashboard
Dashboard Lite · Synthetic example data. Counts illustrate the interface; no performance measurements are shown.

Check protection status

See gateway health, the selected policy, file-handling mode, and which clients report protected or unprotected.

Understand the activity

Review allowed, warned, redacted, and blocked decisions. Choose a time window to explore inspection trends and frequently matched rules.

Keep the content private

Recent decisions show metadata and rule identifiers. Prompts, detected secret values, and document contents stay out of the dashboard.

This is a local operational view of requests routed through Mesh. It does not display private request content or prove that every app on the computer uses the gateway.

Who it is for

Built for teams coding with AI.

Engineers want the best models. Their organizations need credentials and customer records kept off third-party servers. Mesh lets them have both.

Software engineers

Code fast without leaking credentials

Use Claude Code and Codex as usual. Mesh scans each outbound prompt and tool payload and redacts API keys, passwords, and tokens before the request leaves.

Security and tech leads

A record of what was sent

Let your team use AI coding agents with rules you can check. A local audit trail records each policy decision without keeping prompt content.

Regulated environments

Protect customer PII and records

Block or redact payment cards, Social Security numbers, bank details, and health-plan IDs before the request reaches the model provider.

Advisory and client teams

Keep client context private

Work in client codebases without sending client secrets or configuration to an AI provider.

How it works

Built to run on your computer.

Mesh runs as a small local gateway. Your AI tool sends its requests to Mesh, Mesh checks them, and then forwards them to the provider you already use.

Your computer

Runs locally

Your AI toolClaude Code or Codex
RequestResponse
Skilak MeshLocal gateway on localhost
Running
  • Policy engine
  • Inspection pipeline
  • Audit log, metadata only
Checked requestResponse
AI providerAnthropic or OpenAI, with your own key

  • Credentials

    Your keys stay with your tool

    Your AI tool keeps its own provider credential. Mesh passes it through to that provider and holds no provider keys of its own.

  • Egress

    Checked before it leaves

    Each request is scanned and handled by your policy before it is forwarded to the AI provider.

  • Audit

    Audit without content

    Mesh keeps a local audit record of every decision on your computer, without the message content.

  • Reliability

    Fail closed

    If a request cannot be scanned, Mesh stops it instead of sending it unchecked.

Agent safety

DLP is the second boundary.

Mesh can inspect data when an agent sends it through the gateway. It cannot make unrestricted filesystem access inherently safe. Least privilege comes first.

  1. Sandboxed workspace

    The agent runs in an isolated container or VM.

  2. Explicit file allowlist

    Only necessary files are mounted to the workspace.

  3. Secrets excluded

    Environment variables and config files are removed from context.

  4. Egress restricted

    Network blocked except for the route to Mesh.

  5. Scoped credentials

    Short-lived tokens issued through a secure metadata service.

  6. Mesh inspection

    Final boundary scan of prompts, tools, and files.

Licensing

The Skilak Mesh License.

Mesh is proprietary software licensed for free personal non-commercial use, with a free 30-day evaluation for organizations. Commercial and ongoing team deployments require a Company License.

Personal non-commercial use

  • Free forever for individuals on personal projects, learning, and hobbies
  • Free 30-day evaluation for organizations to test without upfront paperwork
  • Discretionary no-fee licenses available for teams with fewer than 10 people
  • Runs natively on your computer with zero telemetry and no phone-home
  • No account creation or online activation required

Company License requirements

  • Any use by, for, or on behalf of an organization after the 30-day evaluation
  • Commercial development, freelance, and client advisory work
  • Operating Mesh as a hosted or managed deployment for third parties
  • Embedding Mesh within products or customer-facing services

To request a Company License or inquire about small-team terms, contact [email protected] or request via the pilot form.

Specifications

Specifications.

What the current release supports.

Runs on

Platforms
  • macOS 13+ · Apple Silicon and Intel
  • Windows 11 · x86-64
  • Ubuntu 24.04 · x86-64
Clients
  • Claude Code CLI
  • Codex CLI
  • Codex in VS Code
Codex in VS Code shares the Codex settings.
Footprint
Native CLI and background service. No Docker.

What it catches

Keys and credentials
  • AWS
  • GitHub
  • Slack
  • OpenAI
  • SSH
  • Passwords
Personal data
  • SSN
  • ITIN
  • Payment cards
  • CVV / PIN
  • Bank accounts
  • IBAN
  • Date of birth
  • Addresses
  • Health IDs

Policies

Balanced · default
Redacts findings and swaps in placeholders.
Strict
Fail-closed: blocks the request.
Responses
Relayed, not inspected. Mesh controls what goes out, not what comes in.

Privacy and network

Network binding
127.0.0.1:51737Loopback only. Outbound HTTPS goes to the AI provider you choose.
Audit log
audit.jsonlOn your computer. Decision metadata only, never message content.
Telemetry
None. No tracking, no phone-home, no account required.
Skilak Mesh License
  • Free for personal, non-commercial use
  • 30-day evaluation for organizations
  • Company License for commercial use
Read the license

Clients

Works with Claude Code and Codex

Connect your AI tool with one command. Mesh updates its settings for you. Restart the tool and its requests go through Mesh.

Claude Code

Anthropic's coding agent for the terminal.

shell
smesh client connect claude --apply

Codex CLI and Codex in VS Code

Both share one Codex configuration, so one command connects both. Works with an API key or a ChatGPT sign-in.

shell
smesh client connect codex --apply

Quickstart

Install in one command

Install Mesh, run the guided setup, and connect your AI tool.

zsh
# macOS (Apple silicon or Intel) and Linux x86_64
curl -fsSL https://mesh.skilak.ai/install.sh | sh

# Windows x86_64 (PowerShell)
irm https://mesh.skilak.ai/install.ps1 | iex

# Set up, start, and connect your AI tool
smesh init
smesh start
smesh client connect claude --apply   # or: codex
smesh status
smesh dashboard open

The download page has the install command for each platform. Download page → · smesh on GitHub

Frequently asked questions

Questions developers ask.

Setup, licensing, and what Mesh does with your data.

Does Mesh inspect responses from AI providers?

No. Mesh is an outbound egress gateway: it inspects and redacts what your tools send to providers. Incoming provider responses are relayed unmodified to the client without content inspection.

Is Mesh free for our organization?

Any organization can install and evaluate Mesh free for up to 30 days on developer machines, with no contract. Ongoing production use requires a Company License. Skilak offers discretionary no-fee Company Licenses for small teams under 10 people.

When is a Company License required?

A Company License is required for any commercial use, client work, or organizational deployment beyond the 30-day evaluation period, as well as for operating Mesh as a hosted service or distributing it to customers.

What happens if the Mesh daemon is paused or stopped?

Mesh is built to fail closed by default if traffic is directed to a stopped gateway. You can run 'smesh client pause' to cleanly restore direct provider routes before maintenance, and 'smesh client resume' when ready.

Does Mesh send telemetry or logs back to Skilak?

No. Mesh has no telemetry, no tracking, and nothing that phones home. Audit records stay on your computer.

How does Mesh connect to Claude Code or Codex?

With a single command: 'smesh client connect claude --apply' or 'smesh client connect codex --apply'. Mesh updates the tool's settings; restart the tool and its requests go through Mesh.

Does Mesh have a dashboard?

Yes, Dashboard Lite is included with the CLI; run smesh dashboard open for a local, loopback-only view of protection status, decisions and recent activity; prompts and secret values are never shown.

Make sensitive data stop at the boundary.

Install it yourself in a minute. No account needed.

Request a pilot Download Mesh