Why Claude Code Needs Protection

Claude Code is one of the most capable AI coding tools available. It can read your entire codebase, write tests, refactor complex functions, and fix bugs across files.

That power comes with a risk: every prompt you send includes your actual code.

Function names, class hierarchies, internal API patterns, authentication logic, database schemas: all of it goes to Anthropic's API on every Claude Code session.

This guide shows how to route Claude Code through Pretense in under 5 minutes.

Step 1: Install Pretense

curl -fsSL https://pretense.ai/install.sh | sh

Requires Node.js 20+.

Step 2: Initialize in Your Project

cd your-project
pretense init

This creates a .pretense/ directory with:

• -config.yaml: mutation rules and provider settings
• -mutation-map.json: (initially empty) persistent mutation map, stored locally
• -audit.log: mutation history

Step 3: Start the Proxy

pretense start

Output:

✓ Pretense proxy running on localhost:9339
✓ Mutation engine initialized
✓ Provider: Anthropic (forwarding to api.anthropic.com)

Step 4: Route Claude Code Through Pretense

Set the ANTHROPIC_BASE_URL environment variable to point to your Pretense proxy:

ANTHROPIC_BASE_URL=http://localhost:9339 claude "refactor auth.ts"

Or add it to your shell profile for permanent routing:

# ~/.zshrc or ~/.bashrc
export ANTHROPIC_BASE_URL=http://localhost:9339

Step 5: Verify Protection

Run a scan to see what Pretense is protecting:

pretense scan auth.ts

Output:

Scanning auth.ts...
⚠ ANTHROPIC_API_KEY    queued → stand-in (secret, stays a stand-in)
~ getUserToken          queued → _fn4a2b
~ verifyJwtClaims       queued → _fn8c3d
~ AuthService           queued → _cls5b7a
~ authPayload           queued → _v1e9f

Step 6: Add the MCP Server (Optional and Recommended)

Pretense ships an MCP server that registers directly with Claude Code, enabling automatic pre-send scanning on every session:

// .claude/settings.json
{
  "mcpServers": {
    "pretense": {
      "command": "pretense-mcp",
      "args": []
    }
  }
}

With the MCP server active, Claude Code will call pretense_scan before sending any tool result that contains code, giving you a second layer of protection.

Audit Your Sessions

After running a few Claude Code sessions, check the audit log:

pretense audit

Session: 2026-02-01T14:32:11Z
  Mutations: 14
  Secrets swapped: 2
  Identifier round-trip: byte-exact
  Provider: Anthropic

Session: 2026-02-01T14:45:22Z
  Mutations: 8
  Secrets swapped: 0
  Identifier round-trip: byte-exact
  Provider: Anthropic

What Gets Protected

By default, Pretense mutates and swaps back in the answer:

• -Function and method names
• -Class and interface names
• -Variable names in function scope
• -Environment variable references

Pretense swaps for stand-ins that stay as stand-ins in the answer, by design:

• -API keys (pattern-matched against 30+ provider formats)
• -Database connection strings
• -Private keys and certificates
• -JWT secrets

Pretense flags by default:

• -Email addresses
• -Phone numbers

Pretense passes through as written:

• -String literals (may contain user-facing content)
• -Comments (for context)
• -Type annotations

You're Done

That's it. Claude Code now routes through Pretense. Your proprietary identifiers are mutated before reaching Anthropic's API and swapped back byte-exact in the response, so you get working code back. Your secrets stay on your machine; the model only ever handles their stand-ins.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you lead an engineering team

The outcome: your team keeps asking AI assistants about real systems, configs and connection strings, and detected secrets leave each laptop as stand-ins.

• -No new workflow. Engineers type pretense run claude in place of claude. Other AI CLIs run the same way, for example pretense run gemini.
• -Guard the repo as well as the prompt. pretense install adds pre-commit and pre-push hooks. pretense scan ci in the pipeline fails on findings (exit 2) and on an empty scan (exit 3).
• -Answers stay usable. Identifiers inside fenced code blocks go out as stand-ins and come back byte-exact, so the code the model writes still uses your names.
• -Measure before you mandate. Run it on your own repo for a week. pretense audit shows what it swapped and when.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.