Two minutes from install to your first masked prompt.
Prebuilt binaries are published for Windows (x86_64), macOS (Intel + Apple Silicon), and Linux (x86_64). Pick the path for your OS below. The recommended ones download a prebuilt binary and need no compiler or C/C++ linker. Then one command, deectx start, turns it on.
gh attestation verify <file> --repo deectxone/deectx. deeCtx meets the OpenSSF Best Practices passing criteria.Recommended: a prebuilt binary, no Visual Studio / linker needed.
scoop bucket add deectx https://github.com/deectxone/scoop-deectx
scoop install deectx
deectx start # wire tools + start maskingKeep it current with scoop update deectx. No Scoop yet? Install it first (see Prerequisites below). Avoidcargo install on Windows unless you have the C++ Build Tools, it fails with link.exe not found.
cargo-binstall and Homebrew both install a prebuilt binary, no compiler needed.
# prebuilt (needs Rust; no compile of deectx)
cargo binstall deectx
# or via Homebrew (also a prebuilt binary)
brew tap deectxone/deectx && brew install deectx
deectx start # wire tools + start maskingKeep it current with brew upgrade deectx or re-running cargo binstall deectx.
First time? Install the package manager first
Each path needs its tool present. If a command errors with "not recognized" or"command not found", install the prerequisite, open a new terminal, then retry.
Scoop (Windows)
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
Invoke-RestMethod get.scoop.sh | Invoke-ExpressionRust / Cargo (for binstall)
# Windows:
winget install Rustlang.Rustup
# macOS / Linux:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
# then, once:
cargo install cargo-binstallHomebrew (macOS / Linux)
/bin/bash -c "$(curl -fsSL \
https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"All install paths
All platforms · no compiler
# one-time: cargo install cargo-binstall
cargo binstall deectxWindows tip: cargo install deectx compiles from source and needs a C/C++ linker. If it errors with link.exe not found, use Scoop or cargo-binstall instead (no compiler). See Troubleshooting.
Prefer a raw binary? Download a zip/tarball straight from GitHub Releases each release ships all four targets, refreshed automatically.
Turn it on: deectx start
One command discovers your installed tools, points them at the local proxy, installs an autostart daemon so deeCtx runs and guards you at every login, and begins masking. No config to copy, no env vars to remember. Re-running deectx start after an update replaces a stale proxy.
deectx start
# ● wires Claude Code, Codex, and opencode to http://127.0.0.1:8787
# (backing up every patched file to <path>.bak, idempotent, never overwrites)
# ● skips tools locked to OAuth accounts (Claude Pro/Max, Copilot built-in)
# ● installs the login autostart daemon and starts masking nowManage it: the whole lifecycle is four verbs.
Status dashboard: on/off, which tools are wired, and any warnings. Your at-a-glance check. For today's masked/redacted breakdown and live counters in a browser, open 127.0.0.1:8787 while it's running.
Turn ON: wire tools, install autostart, start masking. Idempotent; also applies an update.
Turn OFF: restore every tool to direct API access and stop the proxy. Stays off until start.
Unwire tools + remove the daemon, then ask before deleting your data. Never removes the binary.
Also: deectx audit --today (hash-only ledger summary), deectx status (live counters). Config and ledger live in ~/.deectx/. setup/unwrap remain as aliases of start/stop.
Windows / macOS: deectx start also launches a tray icon: the deeCtx mark in green while masking is active, grey when stopped, amber if a stop left a warning to review. Its menu opens the local dashboard and toggles masking without a terminal; Quit deeCtx stops the proxy. Linux runs headless (no tray); use the CLI/status dashboard instead.
Keep it current, or remove it cleanly.
Update with the same tool you installed with, then run deectx start once to apply the new binary (it replaces the running proxy).
| Installed with | Update | Remove the binary |
|---|---|---|
| Scoop (Windows) | scoop update deectx | scoop uninstall deectx |
| Homebrew (macOS/Linux) | brew upgrade deectx | brew uninstall deectx |
| cargo-binstall | cargo binstall deectx | cargo uninstall deectx |
| Cargo | cargo install deectx | cargo uninstall deectx |
To remove deeCtx, run deectx uninstall first. It stops the proxy, restores every tool config from its .bak backup, removes the login autostart entry, and asks before deleting your data. Then remove the binary with the command above. Your ~/.deectx/ config + ledger are kept unless you opt in to deleting them.
Point your AI tool at the proxy.
deectx start wires supported tools for you. For anything else, point its model base URL at the proxy:
OpenAI-compatible
http://127.0.0.1:8787/v1Anthropic-compatible
http://127.0.0.1:8787/v1/messagesOne proxy serves both wire formats: it routes each request by your API-key shape. Anthropic keys (sk-ant-…) go to the Anthropic upstream, OpenAI keys (sk-…) to the OpenAI upstream. Endpoints deeCtx doesn't handle explicitly (e.g. /v1/models) are forwarded verbatim, so tools keep working.
Health check, a live dashboard, then a real audit.
Health check
curl -fsS http://127.0.0.1:8787/healthz
# → okInvoke-RestMethod http://127.0.0.1:8787/healthz
# → okPowerShell aliases curl to Invoke-WebRequest, which doesn't understand curl's flags. Use curl.exe or Invoke-RestMethod instead.
Local dashboard
Open http://127.0.0.1:8787 in a browser while deeCtx is running: today's masked/redacted breakdown by entity type, which tools are sending traffic, active packs, and live counters, auto-refreshing every 5s. Entity types and counts only, same as the ledger: deeCtx never shows (or stores) the actual values it masked.
Live counters (since the proxy started)
deectx status
# requests / masked / redacted / alerts / errorsSend a test prompt, then check the audit
deectx audit --today --export report.jsonCommon errors and how to get past them.
Fastest fix for any build error: don't build at all.scoop install (Windows) or cargo binstall deectx (all platforms) download a prebuilt binary and need no compiler or linker.
deectx setup → unrecognized subcommand, or "Prompt is too long"
Your installed binary is older than your wiring. The lifecycle commands and the transparent proxy that fixes "Prompt is too long" ship in newer builds. Update, then re-run deectx start.
scoop update deectx # or: cargo binstall deectx / brew upgrade deectx
deectx start # re-wires tools + replaces any stale proxyClaude Code → API error: 400 right after deectx start
Older builds could mis-mask a protocol field (e.g. an extended-thinking signature), which the upstream API then rejected. Current builds exclude those fields from masking and, as a backstop, automatically retry any masked request that gets a 400 unmasked, logged as an error, never blocking your traffic. Update to pick up the fix.
scoop update deectx # or: cargo binstall deectx / brew upgrade deectx
deectx start # re-wires tools + replaces any stale proxydeectx serve → address in use (10048)
A proxy is already listening on 127.0.0.1:8787, usually the autostart daemon. You don't need serve when it's running; check with deectx. To take the port, stop first.
deectx # dashboard: is it already running?
deectx stop # free the port, then serve if you mustcargo install deectx → link.exe not found (Windows)
cargo install compiles from source; the MSVC target links with link.exe, which ships only with the Visual C++ toolchain, not with Rust or VS Code. Use a prebuilt binary instead.
scoop bucket add deectx https://github.com/deectxone/scoop-deectx
scoop install deectx
# or: cargo binstall deectxscoop install deectx → Couldn't find manifest
deectx isn't in Scoop's main bucket, so scoop install deectx on its own always fails. Add the deectx bucket once, then install.
scoop bucket add deectx https://github.com/deectxone/scoop-deectx
scoop install deectxFull, always-current troubleshooting lives in the repository README.