# Show HN: LocalMask – local-first CLI that masks PII and secrets before LLMs

> Source: <https://localmaskpro.com>
> Published: 2026-07-12 12:30:56+00:00

with pipx — recommended, works anywhere

pipx install localmask

or with pip — inside a virtualenv

python3 -m venv .venv && .venv/bin/pip install localmask

then scan any repo

localmask scan ./your-repo

It's on PyPI as `localmask`

. On a Mac you can also
`brew install sgury/localmask/localmask`

, or
[grab the tarball](/dl?f=free).

Then `localmask publish <scan> <masked-repo-url>`

creates a private masked
git mirror your AI tools can safely read.

Works with GitHub, GitLab, Bitbucket, self-hosted git & Google Secure Source Manager.
Tokens are handled via `GIT_ASKPASS`

— never in a URL, process args, or
`.git/config`

— and only masked content is ever pushed. In free you use your
own AI (paste the masked files or point it at the mirror); Pro adds built-in Ask-AI + the proxy.
[Full guide & security on GitHub →](https://github.com/sgury/localmask#readme)