Configuration
1 file and a handful of environment variables. Everything has a working default.
pretense.yaml
1 file, written for you. Everything in it has a working default, so an empty repository needs no edits at all.
pretense init
scan: secrets: block # block | redact | warn | off pii: redact proprietary: mutate proxy: port: 9339 blockMode: mutate # mutate (tokenize + forward — the always-mutate default) | reject (fail-closed: HTTP 400, never forward) | redact (alias of mutate) ignore: - "*.test.ts" - "*.spec.ts" - "node_modules/**" - "dist/**" - ".git/**" - ".next/**" customPatterns: [] verbose: false
scan sets what each class of finding does. proxy.port is the port the proxy prefers. ignore is glob-matched against paths. Under the default proprietary: mutate, code identifiers are renamed on the way out and restored byte-exactly in the reply.
At egress a redact action is a swap, like mutate: the value is replaced with a synthetic stand-in. Unlike a renamed identifier, a secret or PII stand-in is never swapped back into the reply. The name is historical. Nothing is deleted, and the plaintext is never forwarded. reject is the one that refuses instead, failing closed with an HTTP 400.
Running your own local models adds an airgap block here. Its runners are on the Air-gap page.
Environment
Set on the command that needs it. Each one overrides the file.
| Variable | Default | What it does |
|---|---|---|
PRETENSE_PROXY_HOST | 127.0.0.1 | Interface the proxy binds |
PRETENSE_API_KEY | None | Your key, instead of a stored login |
PRETENSE_LICENCE_PATH | ~/.pretense/licence.jwt | Where the licence is read from |
ANTHROPIC_BASE_URL | None | Point an Anthropic client at the proxy |
OPENAI_BASE_URL | None | Same, for OpenAI-compatible clients |
GEMINI_BASE_URL | None | Same, for Gemini |
The proxy binds loopback, so it answers this machine and nothing else on the network. Change PRETENSE_PROXY_HOST only when another host genuinely has to reach it, and only on a network you trust.
To read back what is actually in force rather than what you think you set, run pretense config list.
If ~/.pretense/audit.db was written by an older CLI, pretense start exits on launch with table audit_log has no column named detector_kinds. There is no schema migration for that column yet. Move the file aside and the proxy starts again, at the cost of the local history it held.
Policies
A policy re-weights severity for a compliance framework. It does not turn detection off.
pretense policy list pretense init --policy hipaa
The presets are hipaa, gdpr, soc2, nist and pci. Seeding one writes scan.compliancePreset into the file above; passing --policy to a scan overrides it for that run.