What's New in v0.2.0

Ninety days ago, Pretense was a CLI proxy and a mutation engine. Today it is a platform. Here is what changed.

CLI v0.2.0. The command-line interface now supports Anthropic, OpenAI, and Google Gemini in a single proxy. We rewrote the streaming handler to support real-time streaming responses, which was the top request from early users. We added a pretense audit --format csv command for compliance teams who need to produce SOC2 evidence packages.

MCP server. Pretense ships a Model Context Protocol server that integrates directly with Claude Code. When the MCP server is active, Claude Code calls pretense_scan before processing any tool result containing code. This provides protection at the Claude Code application layer, in addition to the network proxy layer. Two layers beat one.

VS Code extension. A status bar indicator shows real-time mutation activity. The command palette includes Pretense: Scan Current File, Pretense: View Mutation Map, and Pretense: Start Proxy. Developers want to see protection status right in their editor, next to their code.

GitHub Action. The pretense-scan Action runs in CI and blocks merges on unprotected LLM API calls in CI pipelines. This extends protection from individual developer machines to team-wide CI/CD.

Dashboard. A Next.js 15 dashboard with Tailwind CSS and shadcn/ui components. It shows mutation activity across the team, session history, secret detection events, and compliance metrics.

Enterprise features. SSO configuration (SAML, BoxyHQ), team-level mutation policies, centralized audit log, and role-based access for the dashboard.

The Numbers

The 17 packages are: scanner, mutator, output-scanner, rag-guard, risk-engine, agent-guard, learner, alerting, billing, ci-gate, compliance-reporter, mcp-server, siem, sso, store, tenants, and tls. Each package is independently testable and versioned.

The 8 CI jobs are: lint, type-check, unit tests (Node 20), unit tests (Node 22), E2E tests, web build, dashboard build, and security scan.

The Hardest Technical Problem We Solved

Next.js incremental type generation in a monorepo with circular type dependencies.

The dashboard imports types from @pretense/risk-engine, which imports types from @pretense/scanner, which is also imported by @pretense/mutator, which is imported by the proxy. When Next.js runs tsc to generate .d.ts files incrementally, any package in the chain that is still waiting on its .d.ts files causes the downstream package to fail type checking with Cannot find module or its corresponding type declarations.

The fix we settled on: a two-pass build. The first pass generates .d.ts files for all packages using tsc --emitDeclarationOnly with the --incremental flag. The second pass runs the Next.js build, which can now resolve all types. The overall build time is 40% faster than the naive approach and produces correct type resolution on every run.

This is documented in turbo.json under the build pipeline. If you are building a similar monorepo with Next.js, the two-pass pattern is the approach that works.

What We Learned From Early Users

Three signals came through clearly across the first hundred users.

Developers want zero workflow change. The most common feedback was that pretense start required a terminal to stay open. We added a pretense start --daemon flag that starts the proxy as a background process. Users can now set ANTHROPIC_BASE_URL permanently in their shell profile and forget about the proxy. The lesson: keep protection setup as close to frictionless as possible.

CISOs want audit trails alongside protection. Early enterprise evaluators were primarily interested in the audit log, more than the mutation capability. The question was: if my developer uses an AI tool today, can I produce a record of what they sent in six months? The lesson: enterprise buyers care about accountability first and prevention second. Build the audit trail first.

Enterprises want SSO. Every single enterprise evaluation asked about SSO within the first two meetings. SSO is a procurement gate first and a feature second. We prioritized BoxyHQ SAML integration earlier in the roadmap than originally planned, specifically because of this signal.

Roadmap for v0.3.0

On-prem deployment. Full Pretense deployment within your network, with Pretense infrastructure fully outside the data path. Designed for organizations that keep all data inside their own infrastructure.

Custom ML risk scoring. The next version adds a learner module that builds a risk model from your mutation history. The model learns what is actually sensitive in your codebase, going beyond what matches a generic pattern.

SIEM integration. CEF, LEEF, and JSON event formats for Splunk, Microsoft Sentinel, and Elastic. This makes Pretense a source of security telemetry in your existing security operations workflow.

Custom mutation rules. Per-file, per-directory, and per-pattern mutation configuration. Always mutate identifiers in src/core/, keep identifiers that match _internal* as written, treat files matching *.schema.ts as especially sensitive.

Try v0.2.0 Today

curl -fsSL https://pretense.ai/install.sh | sh
cd your-project
pretense init
pretense start
export ANTHROPIC_BASE_URL=http://localhost:9339

The proxy starts as a background process, your AI tool routes through it, and you get an audit trail that runs on its own from then on.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you lead an engineering team

The outcome: your team keeps asking AI assistants about real systems, configs and connection strings, and detected secrets leave each laptop as stand-ins.

• -No new workflow. Engineers type pretense run claude in place of claude. Other AI CLIs run the same way, for example pretense run gemini.
• -Guard the repo as well as the prompt. pretense install adds pre-commit and pre-push hooks. pretense scan ci in the pipeline fails on findings (exit 2) and on an empty scan (exit 3).
• -Answers stay usable. Identifiers inside fenced code blocks go out as stand-ins and come back byte-exact, so the code the model writes still uses your names.
• -Measure before you mandate. Run it on your own repo for a week. pretense audit shows what it swapped and when.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.