ClaimCheck

Sanitize PII/secrets (FEIN, SSN, names, credentials) from text or files with the local ClaimCheck CLI before anything leaves the machine; reversible via the local vault.

normandmickey@normandmickey

Install

openclaw skills install @normandmickey/claimcheck

ClaimCheck — local PII pseudonymization

ClaimCheck replaces sensitive values with stable, reversible placeholders ([FEIN_1], [SSN_2], [PERSON_1]...) and keeps the mapping in a local vault. Nothing leaves the machine — no account, no API key, no network calls.

Install (one-time)

Windows PowerShell (installs to %USERPROFILE%\claimcheck\ClaimCheck.exe):

text

irm https://raw.githubusercontent.com/saasclawai-org/ClaimCheck/main/tools/install.ps1 | iex

macOS/Linux: build from source —

text

dotnet publish -c Release -r <rid> --self-contained true -p:PublishSingleFile=true

Repo: https://github.com/saasclawai-org/ClaimCheck

When to use (always for client-adjacent data)

Before quoting any file's contents into chat, tickets, docs, emails, or commits when it may contain client data (FEIN, SSN, account numbers, names, credentials)
Before sharing sample data — share the sanitized sample instead
To CHECK a file for PII without reading it: sanitize-file (no --content)

Commands

ClaimCheck sanitize-text # text from stdin → JSON {summary, findings, sanitized} ClaimCheck sanitize-text "some text" # text as argument ClaimCheck sanitize-file # file → summary only (no content) ClaimCheck sanitize-file --content ClaimCheck restore <file|-> # placeholders → real values (local vault only)

On Windows the binary is %USERPROFILE%\claimcheck\ClaimCheck.exe (or your custom InstallDir). Recognized: FEIN, SSN, email, phone, cards (Luhn), IBAN, AWS/GitHub/Slack keys, API keys, JWTs, connection-string passwords, PEM private-key blocks, base64/hex encoded blobs, CVV, card expiry, dates of birth, passport numbers, driver's licenses, bank routing numbers, IP addresses, street addresses, medical license numbers, insurance member IDs. Custom patterns: .sanitize-patterns.json (see repo README).

Rules

Share ONLY the sanitized field — findings show placeholders, never values.
Never paste raw FEIN/SSN/card/credential values into chat, logs, or commits.
The vault lives in ~/.sanitize-mcp/vaults (plaintext, local). Treat the machine as the trust boundary.
NER tier (free-text names/orgs/locations): set SANITIZE_NER=1 env — model (~109MB) cached in ~/.claimcheck/models.
Not 100% — verify sanitized output before high-stakes sharing (DISCLAIMER.md in the repo).