Kamei masks secrets before AI sees them, plugs into Claude Code

Kamei is built around a split design. Fixed rules run every time — formatting cleanup, rules, Sensitive Data Protection, an organization's vocabulary and past human decisions — and anything caught there is always hidden. Only proper nouns that slip past those rules reach the judging agent, Gemma 4, which decides whether each is confidential. With "deep thinking" on, the agent picks its own tools to investigate ambiguous names; with it off, it asks the user instead. In the résumé sample, the only tool needed was reading surrounding context, which the agent chose three times. Human input is kept minimal: only names where judges split toward "pass" and digit strings that might be numbers are asked, and numbers are bundled into one question. When a user decides to hide a company, internal system or internal project name, it is written back into that person's vocabulary, so it is hidden automatically next time without asking — the 丸栄商事 hidden in the résumé sample was not asked about again in a later SQL paste. Employee numbers and similar personally linked identifiers are deliberately not written back. For control, a "pass" verdict needs backing: even if the agent decides to pass a name, a rule or another judge saying "hide" sends it to human confirmation. Tools are capped at 8 calls and 15 seconds, and if Gemma 4 is unavailable the system falls back to Gemini Flash-Lite and then to rules so processing continues. Just before sending, it re-checks without an LLM that names marked for hiding are not still present as literal strings, and hides them mechanically if they are. On security, Model Armor inspects the external LLM's reply before originals are restored, pseudonym keys are created per conversation in Cloud KMS, and the system claims it blocked 6 of 6 attack cases by treating input as data and wrapping it in delimiters that change on every call.