wtf is grok-privacy-guard?

grok-privacy-guard is a set of shell scripts that adds a privacy layer on top of Grok CLI, an AI coding agent tool. Its goal is to stop Grok from silently packaging and uploading an entire codebase, including its git history, in the background, and to warn a user right away if that ever happens. It is built for macOS using zsh or bash, and according to the README, its scripts only read local logs and write to the user's own configuration file, without sending any data anywhere themselves. The README describes several protections. It blocks Grok from uploading a whole repository or session trace data in the background. It locks Grok's auto-update feature and checks the fingerprint of the Grok binary, warning the user if that binary is ever swapped out from under it. Every time Grok starts, the guard runs a quick check and prints a green status line if protection is active and nothing was uploaded, or a red line if something looks wrong. There is also a separate command that checks whether a codebase was uploaded at some point in the past. Installation can be done manually by cloning the repository and running an install script, or by asking a coding AI agent like Claude Code or Cursor to do it, with an explicit instruction to keep the status line visible rather than running it silently. The install script writes three settings into Grok's own configuration file, disabling codebase upload, trace upload, and auto-update, and keeps a backup of the original file. The README is honest about its limits: it does not intercept anything at the network level, it only relies on Grok respecting its own settings, and any files a user deliberately lets Grok read are still sent to the AI model as normal. The project is released under the MIT license and credits a public packet-capture analysis as the basis for how Grok's upload behavior works.