Redactor Desk is a desktop client for Claude: chat and work in code while secrets, credentials and personal data are replaced by placeholders locally before anything reaches the model API. Only real values ever touch disk — never a placeholder.
The agent's tool surface has no path around redaction. Every prompt, every file's contents and every search result passes the same local redaction layer before it reaches the model — and the real values are restored only locally.
Everything model-bound passes sanitize(); everything the model writes passes restoration before it lands on disk or in the chat.
The agent has no shell access and no built-in tools — just five redacted file operations. There is simply no channel that leads out unsanitized.
The same value always maps to the same stable placeholder (__REDACTED_…__). The model reasons coherently in placeholders; you see the real values locally.
Plan mode is read-only; changes require a deliberate switch to Build mode. A backup is written before every change.
Before every send, a second and independent layer re-examines the already-sanitized text — for known secret patterns and for any value held in the local vault. If it finds something, the client raises an alert and records the finding in the evidence log.
Every model call is recorded as a trace: prompt, reasoning, tool calls and response, step by step. Traces persist, and can be browsed and exported — only the placeholder form is stored, never a real value.
Prompts, rules and notes arrive as packs: versioned directories of a manifest file and Markdown text, switchable one by one. A pack is text, not a program — it cannot define a tool, read a file, or run anything. The client validates every pack against its own manifest, including the ones we ship, and refuses whatever does not match: visibly, with a reason. The pack contents are licensed under Apache-2.0.
On request, an extra model call rewrites your prompt before it goes out — but only after redaction: the rewrite sees the already-sanitized text and never your real values. You see both versions side by side and decide. If a rewrite damages a placeholder or invents one, it is discarded before we even ask you. The step runs on the same provider as the rest of your session — the Anthropic path is the one wired up today; a Bedrock session skips the rewrite with a note and sends your own words unchanged, rather than borrowing someone else's provider.
Paste an error with a token — Redactor Desk tokenizes it before the message is sent. Claude answers over the placeholder; the reply is restored locally. When writing to a file, real values land on disk, never a placeholder.
Redactor Desk is a proprietary product (closed source) and stays one — so does the redaction engine. What is public is the content of the packs: the prompts, rules and notes themselves. They are licensed under Apache-2.0, as open source in the full sense of the term — readable, copyable and changeable by anyone expected to run them.
The redaction engine is identical and full in both editions — protection is never hidden behind a paywall.
Full redaction · for individuals & consultants
Free · macOS (Apple Silicon) · signed & notarized · checksums
Volume licensing · for regulated organizations
For regulated organizations (NIS2, DORA, AI Act) that want to clear agentic coding at all — and for consultants working with sensitive client data. We support your controls; we don't claim to "meet" them.
Honest stays honest.
Detection is deterministic and heuristic (regex, checksums, entropy). What isn't detected isn't replaced — which is why regulated organizations pair Redactor Desk with clear policy and training. "Fully offline" applies to detection and tokenization; the client, by nature, talks to the model API — the Anthropic API or your own Amazon Bedrock in the EU region, inside your AWS boundary, with your IAM. More on the security page.
Current version 0.4.1, released in July 2026. Existing installs pick the update up on their own — signed and notarized, from our own host.
We'll show Redactor Desk on your real use case — and support you through adoption in a regulated organization.