Shadow reference: CLI, configuration, providers and security
The Shadow reference documents every shadow CLI command, every shadow.toml option, the supported AI providers and hosts, the security model, troubleshooting steps and the FAQ. Look up exact commands, options and guarantees.
- ConfigurationReference for every shadow.toml setting: persona, detectors, NER model, Presidio, policy, files, proxy and gateway routes, with defaults and examples.
- CLIReference for the shadow CLI: init, run, install, status, mask, unmask, scan, vault, terms, hosts, top, activity and dashboard, with every flag.
- Supported providers and hostsAI providers Shadow supports: OpenAI, Anthropic, Gemini, Azure OpenAI, Bedrock, Mistral and more. Intercepted hosts, gateway routes and API formats.
- Security modelShadow's security model: what it protects from AI providers, what it trusts, how the vault and local CA are secured, and its known limitations.
- FAQAnswers to common questions about Shadow: latency, streaming, message recipients, agents, files, answer quality, Presidio, DLP, telemetry and licensing.
- TroubleshootingFix common Shadow problems: untrusted certificates, connection refused, gateway 404s, values not masked, fakes left in answers, streaming and vault errors.
Frequently asked questions
Where is Shadow's configuration file?
shadow.toml in the data directory, or the path given by --config or SHADOW_CONFIG. Every key is optional, so no file at all is a valid configuration.
How do I check that Shadow is running?
Run shadow status. It reports whether the proxy answers, the persona, the vault size and the CA fingerprint; shadow status --quiet exits 0 or 1 for health checks.
Which AI providers does Shadow support?
OpenAI, Anthropic, Google Gemini and Vertex AI, Azure OpenAI, AWS Bedrock, OpenRouter, Mistral, Groq, Together AI, DeepSeek, xAI, Cohere, Perplexity, Fireworks, Cerebras and Voyage AI, plus hosts you add. See supported providers.