Changelog

• New: the FrostWolf plugin for Claude Code. It brings Guard and Cloak into a coding session as hooks, with no base URL change and no proxy. See Claude Code.
• New: personal data and secrets in tool results are tokenized before Claude sees them, and restored when Claude writes a file or runs a command.
• New: injected instructions are taken out of tool results, and shell, web fetch, and MCP calls are validated before they run.
• New: prompts with an injection are blocked. A prompt that carries personal data, or attaches a file with @ that does, is refused with a version to send instead.
• New: a batch check stops the turn before the next model call if a result was not cloaked, including the output of a failed command.
• Behaviour: every entity category is tokenized, including credentials and card codes, so a file Claude rewrites gets the original back.
• Behaviour: fails closed by default. on_unavailable: allow lets unchecked prompts, calls, and results through.
• New: install and set the key in one command: claude plugin install frostwolf --marketplace FrostWolfAI/frostwolf-skills --config api_key=....
• New: the console’s Integrations page shows that command with a freshly minted key, and lists the devices the plugin runs on, attributed to the member who created each key.

• Fix: the Python package now ships a py.typed marker, so type checkers read the inline annotations instead of reporting import-untyped.
• Fix: TypeScript decorate examples annotate the request body with the provider’s parameter type. Without it the body is inferred as unknown and strict builds fail. Streamed requests use a separate decorated function.

​

Cloak

• New: guard.protect, a master call that checks for attacks and personal data in one request and rewrites the payload once.
• New: guard.cloak with scan, protect, restore, and forget.
• New: four strategies, tokenize, hash, mask, and redact, chosen per entity type or category. Credentials and card verification codes are redacted and never stored by default.
• New: identity-bound restore. A token belongs to the context it was created under, and another context’s token is refused with RestoreDeniedError.
• New: a pluggable vault, with an in-memory default that is bounded and expiring.
• New: wrap and decorate accept a cloak option. Non-streamed responses can be restored automatically.
• New: semanticPass (enforce, report, off), for callers that remove personal data before the request reaches a model.
• Behaviour: Cloak fails closed. A request it could not check is refused with cloak_unavailable.
• Behaviour: capture records the request as it was forwarded, with tokens, and the response before it was restored.

​

Control plane

• New: POST /v1/cloak/detect, and an optional cloak block on /v1/scan.
• New: the semantic field on scan requests.
• New: Cloak telemetry in the console, counts only, and a Cloak page.
• Texts up to 12,000 characters are checked, in overlapping windows.

​

Notes

• Cloak is in beta. It detects identifiers, payment card data, and credentials in text. Health data, audio, and images are not yet supported.
• Both SDKs produce identical tokens and hashes for the same key, context, and value.