Ainonymize for Claude

Use Claude on contracts, HR files, patient letters, bank exports and client e-mails — without the personal data in them ever leaving your computer.

Ainonymize replaces names, addresses, e-mail addresses, phone numbers, IBANs, tax and ID numbers, dates of birth, health data and more with consistent, realistic pseudonyms on your machine before Claude sees a document. Claude works with "Jürgen Kellermann" instead of your client; when you need the final letter, contract or spreadsheet with the real names, Ainonymize puts them back locally. The restored file is never sent to Claude.

 your document ──► Ainonymize (local) ──► pseudonymized copy ──► Claude
                         │                                           │
                   mapping stays in                         draft with pseudonyms
                   ~/.ainonymize                                     │
 final document ◄── Ainonymize restore (local) ◄─────────────────────┘

Install

Claude Code (CLI, IDE, desktop "Code")

/plugin marketplace add Leineder/ainonymize-claude
/plugin install ainonymize@ainonymize

Restart Claude Code. Requires Node.js 18+ (already present if you installed Claude Code via npm). Optional: run /ainonymize:setup once to download the local model (~600 MB) right away.

Claude Cowork

In the plugin settings, add the GitHub marketplace Leineder/ainonymize-claude and install ainonymize. (The tools and skills work everywhere plugins run; the prompt/read guards need a client that runs plugin hooks.)

Claude Desktop (chat)

1. Download ainonymize.mcpb.

2. Double-click it (or Settings → Extensions → Install extension…) and confirm.

claude.ai and ChatGPT in the browser

Use the Ainonymize Chrome extension: it intercepts uploads and typed text on claude.ai and chatgpt.com. See ainonymize.vercel.app.

Any other MCP client

git clone https://github.com/Leineder/ainonymize-claude
cd ainonymize-claude && npm ci --ignore-scripts   # optional: the neural runtime
node server/cli.mjs mcp

Related MCP server: write-like-me-mcp

Use it

Just ask, naming the file:

Summarize ~/Clients/Meyer/Arbeitsvertrag.docx and list the risky clauses.

Compare the two offers in ./offers/ and draft a reply to the cheaper vendor — give me the final letter with the real names.

Go through export_customers.csv and find duplicates.

Claude calls anonymize_file, works with the pseudonyms, and for the final version calls restore_file / restore_text, which saves ….restored.docx (or .md, …) next to your files.

What the plugin adds in Claude Code (and Cowork)

The plugin doesn't just add tools. It also adds guard rails, which a browser extension can't do on a desktop agent:

• Prompt guard. If you type or paste personal data into a prompt, it is stopped before it is sent. A pseudonymized version is put on your clipboard: paste it and send. Add #raw to a message to send it unchanged on purpose.

• Read guard. Claude cannot open Word/Excel/PowerPoint/PDF/e-mail files directly, nor CSV/text files that contain personal data; it is redirected to anonymize_file. Restored files (*.restored.*) are never readable by Claude.

• One pseudonym per person per project. All documents of a project folder share a mapping scope, so the same client is the same pseudonym in every file.

Tools

Settings

~/.ainonymize/config.json (all optional):

{
  "promptGuard": "block",
  "readGuard": "block",
  "neural": true,
  "allowPaths": []
}

promptGuard: block | warn | off. readGuard: block | off. neural: false runs the rule-based layer only (no model download). allowPaths: files or folders Claude may read directly.

Honest limits

• Detection is very good, not perfect. On our synthetic test corpora, about 97–99% of personal values are removed. A missed value does reach Claude. For documents where a single miss matters, check the .anonymized copy before you continue.

• Restore is cautious. If Claude edits a pseudonym (e.g. turns "Jürgen Kellermann" into "Mr K."), or a pseudonym is ambiguous, it is left as written, and the tool tells you how many. Restoring the wrong person's name would be worse.

• Guard rails, not a sandbox. The hooks intercept prompts and Claude's Read tool. Claude could still reach a file through other tools (e.g. a shell command) if it ignored the instructions.

• Speed. Everything runs on your CPU: roughly 2–4 seconds per 1,000 characters with the neural model. Long documents take a few minutes, and Claude is told to wait and re-check.

• Not yet supported: scanned PDFs/images (OCR), legacy .doc/.xls/.ppt, archives. The Chrome extension handles more formats.

What the plugin runs, reads, writes and fetches

Everything below happens on your computer; nothing is sent to any server.

Privacy

Ainonymize collects nothing. The only network request it ever makes is the one-time model download from huggingface.co (pinned revision, SHA-256 verified). See PRIVACY.md.

License

Free to use, privately and commercially. See LICENSE. Bundled open-source components: THIRD_PARTY_NOTICES.md.

Deutsch, kurz

Ainonymize ersetzt personenbezogene Daten (Namen, Adressen, IBAN, Steuer-ID, Geburtsdatum, Gesundheitsdaten …) lokal auf Ihrem Rechner durch stimmige Pseudonyme, bevor Claude ein Dokument sieht, und setzt die echten Werte am Ende lokal wieder ein. DSGVO-freundlich, ohne Konto und ohne Server.

Installation in Claude Code: /plugin marketplace add Leineder/ainonymize-claude, dann /plugin install ainonymize@ainonymize. Claude Desktop: ainonymize.mcpb aus den Releases doppelklicken.