Baize
Speak freely and without reservation.
Core Advantages
Privacy Protection
- Bidirectional reversible privacy protection: Before your sensitive information is sent to the LLM, it is replaced with placeholders; after the response is received, it is automatically restored. The whole process is transparent to you — the history, tool arguments, and final answers you see are always the original text, while what the LLM sees is always placeholders such as
[[PHONE_1]]and[[EMAIL_1]]. - Multiple ways to enable privacy protection: You can enable it via natural language in the conversation, or use the more precise
/privacycommand. - Localized agent: This product has no remote database and runs completely locally. It does not collect user information.
Multilingual Interaction
- Supports nine languages: 中文, English, 日本語, 한국어, Español, Français, deutsch, русский, العربية.
- Multiple ways to switch languages: You can directly speak a language, for example
please speak with english, to switch to English, or use/lang jato switch to Japanese.
Features
- Multi-backend support: DeepSeek, any OpenAI-compatible API (GLM / Qwen / Kimi / OpenAI), and local Ollama. Switch with one setting.
- Zero-config startup: Automatically generates configuration files on first run. Users only need to enter the key once.
- Privacy sanitization: Automatically detects and masks phone numbers, emails, ID cards, bank cards, API keys and other PII before sending to the LLM, then restores them in the response. Supports standard / strict levels, switchable via natural language or
/privacy.
- Multilingual interaction: Freely switch among Chinese / English / Japanese / Korean / Spanish / French / German / Russian / Arabic. Just say
Englishor use/lang ja, and the AI thinks and replies in that language.
- Complete toolchain: bash execution, file read/write/edit, glob/grep search, web search and fetch, background tasks, task and todo management.
- Skills system: Load domain knowledge (SKILL.md) on demand, making the AI more professional in specific scenarios.
- Subagents: Delegate complex tasks to subagents with independent contexts to avoid polluting the main session.
- Hooks: Python or Shell hooks that support pre/post tool-call interception, audit logging, auto-formatting, and test gating.
- MCP protocol: Connect external tool servers (GitHub, Filesystem, etc.) via Model Context Protocol.
- Context compression: Two-level compression (tool result truncation + LLM summarization), supporting very long conversations.
- Secure sandbox: Command whitelist, path escape detection, dangerous command blocking, sensitive file protection, and script injection interception.
- Black-gold themed CLI: Adaptive Chinese width, code highlighting, Diff coloring, and thought collapsing.
Baize CLI Interface
Baize CLI startup screen
Installation
Prerequisites
- Python 3.10+ (requires tomllib; built in on 3.11+; on 3.10 install tomli)
- pip
Install from Source
Two download methods
pip install https://github.com/Xu123-Bob/Baize.git
- On the repository page, click
<>Code--> Download ZIP
baize, and run it.
(2) After downloading the ZIP, install locally: unzip, enter the directory, and run:
bash -- Press Win+R and enter cmd
pip install .
After installation, press Win+R, enter cmd, open the CLI, type baize, and run it.
Optional: Install Data Access Dependencies
If you need Baize to drive SPSS or SQL databases, install: ``bash
pip install -r requirements-data.txt
`
requirements-data.txt includes:
spss-studio-mcp: SPSS statistical analysis MCP server (requires IBM SPSS Statistics installed locally)
atengk-mcp-server-rdbms: General relational database MCP server (PostgreSQL / MySQL / SQL Server / Oracle / DM, etc.)
pyodbc: ODBC Python binding required by SQL Server
Or, if the project is installed via pyproject.toml, use extras:
`bash
pip install -e ".[data]" # Install all data access dependencies
pip install -e ".[spss]" # SPSS only
pip install -e ".[sql]" # General SQL only
pip install -e ".[sql-mssql]" # SQL Server only, including pyodbc
`
- ⚠️ SQL Server users:
pyodbc is only the Python binding. You also need Microsoft ODBC Driver 18 for SQL Server installed at the system level.
⚠️ SPSS users: spss-studio-mcp is only an MCP bridge. IBM SPSS Statistics (version 20–31) must be installed and licensed locally, and the environment variable SPSS_INSTALL_PATH must point to the SPSS installation directory. Full statistical analysis is mainly supported on Windows. On Linux/macOS, it can fall back to “file mode” (read .sav, inspect metadata, preview data, but no statistical analysis).
Quick Start
- First run
bash
baize
On first run, Baize automatically generates two configuration files:
`
~/.baize/config.toml # Backend configuration (choose DeepSeek / OpenAI / Ollama)
~/.baize/.env # Key file>
`
Windows path: C:\Users\your-username\.baize\.
- Choose a backend
Open ~/.baize/config.toml and modify active_provider:
`toml
Baize Configuration File
Modify the 'active_provider' to switch the backend # Optional values: "deepseek" / "qwen" / "kimi" / "glm" / "openai" / "ollama"
active_provider = "deepseek"
[model_providers.deepseek]
name = "DeepSeek"
base_url = "https://api.deepseek.com"
env_key = "DEEPSEEK_API_KEY"
model = "deepseek-flash"
[model_providers.qwen]
name = "Qwen"
base_url = "https://dashscope.aliyuncs.com/compatible-mode/v1"
env_key = "DASHSCOPE_API_KEY"
model = "qwen-plus"
[model_providers.kimi]
name = "Kimi"
base_url = "https://api.moonshot.cn/v1"
env_key = "MOONSHOT_API_KEY"
model = "kimi-k2.7-code"
[model_providers.glm]
name = "GLM"
base_url = "https://open.bigmodel.cn/api/paas/v4"
env_key = "ZHIPUAI_API_KEY"
model = "glm-4-plus"
[model_providers.openai]
name = "OpenAI"
base_url = "https://api.openai.com/v1"
env_key = "OPENAI_API_KEY"
model = "gpt-4o"
[model_providers.ollama]
name = "Ollama (本地)"
base_url = "http://localhost:11434/v1"
env_key = ""
model = "qwen2.5:7b"
`
- Fill in the key
Edit ~/.baize/.env, if you need to use a specific LLM, simply remove the # at the beginning and add # before other LLMs to lock the output of other LLM APIs. After entering the API Key, be sure to save it. Only after saving will it be effective:
`env
============================================================
baize Key File
============================================================
Fill in only the keys for the backend you are using. The rest can remain commented out.
The variable names must be consistent with the env_key field in config.toml.
#
Location：
Linux / macOS: ~/.baize/.env
Windows: C:\Users\Your username\.baize\.env
============================================================
---------- DeepSeek（Default backend） ----------
Get the address:https://platform.deepseek.com/api_keys
DEEPSEEK_API_KEY=
---------- OpenAI or any OpenAI-compatible interface (optional) ----------
Applicable to Groq, Tongyi, Moonshot, Zhoushu, OpenAI, etc.
Note: The base_url is configured in the [model_providers.xxx] section of config.toml, not here.
OPENAI_API_KEY=
---------- Qwen（optional） ----------
Get the address:https://dashscope.console.aliyun.com/
DASHSCOPE_API_KEY=
---------- Kimi / Moonshot（optional） ----------
Get the address:https://platform.moonshot.cn/console/api-keys
MOONSHOT_API_KEY=
---------- GLM（optional） ----------
Get the address:https://open.bigmodel.cn/usercenter/apikeys
ZHIPUAI_API_KEY=
---------- Custom Gateway（optional） ----------
CUSTOM_API_KEY=
---------- Ollama（Local model, no need for key） ----------
Just make sure that Ollama is running on localhost:11434, and no further configuration is required.
`
- Restart
bash
baize
If you see the black-gold logo and welcome message, startup succeeded.
Usage Examples
After startup, describe your needs in natural language at the >>> 降旨： prompt:
`
>>降旨：Write a Python script to scrape Douban Top250 and save it as CSV
>>降旨：Help me check type errors in all Python files under src/
>>降旨：Find all places in this repository that use requests and change them to httpx
`
Multilingual Interaction
Baize supports nine languages: 中文, English, 日本語, 한국어, Español, Français, deutsch, русский, العربية.
Two ways to switch:
Option 1: Just speak (auto-detect)
Baize automatically detects your input language and switches:
`
>> 降旨：Hello, help me write a Python script
[system] Detected input language: English. Baize switched to English.
(replies in English)
>> 降旨：日本語で答えてください
[system] Detected input language: 日本語. Baize switched to 日本語.
(replies in Japanese)
`
Option 2: Manual command
`
>> 降旨：/lang # Show current language and available list
[system] Current language: 中文 (zh)
[system] Available:
zh 中文 ←
en English
ja 日本語
ko 한국어
es Español
fr Français
de Deutsch
ru Русский
ar العربية
>> 降旨：/lang English # Switch by language name
>> 降旨：/lang ja # Switch by language code
>> 降旨：/lang 西班牙语 # Chinese names work too
`
Supports language name / language code / Chinese name / native name. To switch to English, any of English, en, 英语, 英文 works.
Built-in Commands
/exit, /quit --> Exit Baize
/clear --> Clear conversation history, todos, thought records, and tool records
/compact --> Manually compress context (use when the conversation is too long)
/commit --> Save the current session and commit to Git (if inside a Git repository)
/lang → Show current language; /lang en switches to English (accepts code or name)
/skills --> List all available skills
/skills reload --> Reload the user skills directory
/unload --> Unload the currently active skill
/show thought --> View the full thought record
/show tool --> View tool call records
/show all --> View all session history
/skill-name --> Load the specified skill (supports fuzzy matching)
/privacy --> Privacy sanitization control (see "Privacy Sanitization" below)
Ollama Local Models (Zero Cost)
Don't want to use a cloud API? Use local Ollama:
bash
#1. Install Ollama: https://ollama.com/download
#2. Pull a model
ollama pull qwen2.5:7b
#3. Start the Ollama service
ollama serve
#4. Modify ~/.baize/config.toml
active_provider = "ollama"
#5. Start Baize
baize
Recommended models: qwen2.5:7b (strong Chinese), llama3.1:8b, deepseek-r1:7b.
Extension Mechanisms
Baize supports four extension methods. Place them in the current working directory to take effect.
Skills
Write domain knowledge in ./skills/skill-name/SKILL.md. The AI will proactively load it when encountering complex tasks.
markdown
---
name: pandas-eda
description: Best practices for exploratory data analysis with pandas
tags: data,python
---
# Pandas EDA Guide
## Core Steps
1. Use df.info() to inspect field types and missing values
2. Use df.describe() for statistical description
...
You can also manually load it in conversation with /pandas-eda.
Subagents
Define specialized subagents in ./subagent/role-name/AGENT.md. The main agent can delegate tasks through the agent tool.
markdown
---
name: code-reviewer
description: A strict code reviewer
---
You are a senior code reviewer. During review, prioritize:
1. Boundary conditions and exception handling
2. Resource leaks
3. Concurrency safety
...
Hooks
Place the following under ./hooks/:
PreToolUse-*.sh
PostToolUse-*.sh
Stop-*.sh
They receive JSON input and return a decision:
`bash
#!/bin/bash
PreToolUse-guard.sh
read -r input
if echo "$input" | grep -q "rm -rf"; then
echo '{"hookSpecificOutput":{"permissionDecision":"block","permissionDecisionReason":"Deletion prohibited"}}'
fi
`
Python hooks can directly call built-in APIs (see the hook_* functions in Baize.py).
MCP Servers
Configure external tool servers in ./MCP/mcp_config.json:
json
{
"mcpServers": [
{
"name": "filesystem",
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "."],
"env": {},
"enabled": true
}
]
}
Security Design
Baize enables the following security mechanisms by default:
- Command whitelist: Only common commands such as
ls, cat, grep, git, python3, etc. are allowed.
Path escape detection: All file operations are restricted to the current working directory and /tmp.
Dangerous command blocking: Blocks patterns such as rm -rf /, fork bombs, curl | sh, git push --force, etc.
Sensitive file protection: Prohibits modifying .env, .ssh/, id_rsa, *.pem, etc.
Script injection interception: Detects bypasses such as python -c "os.system(...)".
Process resource limits: On Linux/macOS, limits CPU, memory, and process count.
If you need to relax restrictions in a trusted project, modify ALLOWED_COMMANDS and FORBIDDEN_PATH_PATTERNS in Baize.py.
Privacy Sanitization
Baize ships with a bidirectional, reversible privacy sanitization mechanism. Sensitive information is replaced with placeholders before being sent to the LLM, and restored automatically in the response — completely transparent to you. What you see (history, tool arguments, final answer) is always the original text; what the LLM sees is always [[PHONE_1]], [[EMAIL_1]], etc.
Off by default. Enable when needed.
Two ways to enable
Option 1: Natural language
`
>>降旨：enable privacy sanitization
[system] Privacy sanitization enabled (standard mode).
>>降旨：enable strict sanitization
[system] Privacy sanitization enabled (strict mode).
>>降旨：disable privacy protection
[system] Privacy sanitization disabled.
`
Option 2: Slash commands
/privacy on Enable standard mode
/privacy strict Enable strict mode (adds names, license plates, QQ, WeChat)
/privacy off Disable
/privacy status Show current state and statistics
/privacy rules List all rules
/privacy test Test sanitization
/privacy clear Clear the placeholder map
Two levels
Standard: Mainland China phone numbers, ID cards, bank cards (Luhn check), emails, IPv4/IPv6, OpenAI/Anthropic/GitHub/AWS API keys, Bearer tokens, private key blocks, password fields, URL credentials
Strict: All of standard + Chinese names, QQ numbers, WeChat IDs, Mainland China license plates
How it works
User input (with real PII) → messages store original text
↓ sanitize_messages()
What the LLM sees: [[PHONE_1]], [[EMAIL_1]]
↓ LLM response
Placeholders → restore_message()
Restored to original → stored / displayed / executed
Same original text reuses the same placeholder, so one phone number stays as [[PHONE_1]] throughout a session.
Tool arguments are graded by sensitivity: text-only tools like todo, ask_user_question, task_* have their arguments sanitized; path/command/URL tools like run_read, run_bash, run_webfetch are left alone (otherwise they would fail because the path was replaced).
Subagents are protected too: tasks delegated from the main agent go through the same sanitize/restore pipeline.
Example
`
>>降旨：/privacy test My phone is 13812345678, email [email protected]
Original: My phone is 13812345678, email [email protected]
Masked : My phone is [[PHONE_1]], email [[EMAIL_1]]
Restored: My phone is 13812345678, email [email protected]
>>降旨：/privacy status
[Privacy Sanitization]
Current mode : standard
Active rules : 15 / 19
Placeholders : 2
Sanitize calls: 3
Restore calls : 3
`
Data Access
Baize connects to enterprise data analysis software through MCP (Model Context Protocol). The main program does not need any modification—just register the server in MCP/mcp_config.json.
SPSS Integration
Prerequisites
- IBM SPSS Statistics installed locally (version 20–31, Windows recommended)
- SPSS is licensed and can start normally
Configuration Steps
- Find the SPSS installation directory: the default path is usually
C:\Program Files\IBM\SPSS Statistics\ followed by the version number, such as 31.
- Set the environment variable in
.env or system environment variables:
`text
SPSS_INSTALL_PATH=C:\Program Files\IBM\SPSS Statistics\31
`
- Verify the status:
`bash
spss-studio-mcp status
`
Expected output:
`text
=== SPSS MCP Capability Status ===
pyreadstat : OK v1.3.6
pandas : OK v3.0.2
SPSS batch : OK
`
- Register it in
MCP/mcp_config.json:
`json
{
"mcpServers": [
{
"name": "spss",
"command": "spss-studio-mcp",
"args": ["serve", "--transport", "stdio"],
"env": {
"SPSS_INSTALL_PATH": "C:\\Program Files\\IBM\\SPSS Statistics\\31"
},
"enabled": true
}
]
}
`
If
SPSS batch: NOT FOUND
It means spss-studio-mcp did not find the SPSS engine, but pyreadstat + pandas are working. In this case, Baize enters file mode:
- Can read
.sav, inspect metadata, preview data, and convert CSV ↔ SAV
Cannot run statistics such as t-tests, regression, ANOVA, etc.
Solution: correctly set SPSS_INSTALL_PATH in MCP/mcp_config.json, or accept the file mode fallback.
SQL Integration
Supported Databases
PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, DM, KingbaseES, TiDB, OceanBase, etc. (based on SQLAlchemy 2.0 drivers).
Configuration Steps
- Prepare a read-only database account (strongly recommended):
`sql
CREATE USER baize_ro WITH PASSWORD 'xxx';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO baize_ro;
`
- Prepare the connection string:
- PostgreSQL -->
postgresql+psycopg://user:pwd@host:5432/db
MySQL --> mysql+pymysql://user:pwd@host:3306/db
SQL Server --> mssql+pyodbc://user:pwd@host:1433/db?driver=ODBC+Driver+18+for+SQL+Server
Oracle --> oracle+oracledb://user:pwd@host:1521/?service_name=ORCL
- Register it in
MCP/mcp_config.json:
`json
{
"mcpServers": [
{
"name": "sql",
"command": "atengk-mcp-server-rdbms",
"args": ["--transport", "stdio"],
"env": {
"DATABASE_URL": "postgresql+psycopg://baize_ro:pwd@localhost:5432/prod"
},
"enabled": true
}
]
}
`
Built-in Security Guardrails
atengk-mcp-server-rdbms provides multiple layers of protection:
- AST-level SELECT guard: uses
sqlglot to parse the syntax tree and physically blocks write operations such as DELETE/UPDATE/DROP/TRUNCATE.
Automatic LIMIT injection: queries without a specified row count are forced to append LIMIT 100, preventing full-table pulls from causing memory overflow.
Read-only by default: write operations require explicit authorization via --allow-dml / --allow-ddl.
SQL injection blocking: malicious statements built by string concatenation are rejected at the AST level.
Configure Multiple Databases at Once
If you want to connect multiple databases at the same time, register multiple servers:
`json
{
"mcpServers": [
{
"name": "sql_prod",
"command": "atengk-mcp-server-rdbms",
"args": ["--transport", "stdio"],
"env": { "DATABASE_URL": "postgresql+psycopg://ro:pwd@prod:5432/db" },
"enabled": true
},
{
"name": "sql_warehouse",
"command": "atengk-mcp-server-rdbms",
"args": ["--transport", "stdio"],
"env": { "DATABASE_URL": "mysql+pymysql://ro:pwd@dw:3306/analytics" },
"enabled": true
}
]
}
`
Baize automatically merges all their tools into MATERTOOLS, and the LLM selects the appropriate tool based on the task.
Directory Structure
`
baize-agent/
├── pyproject.toml # Packaging configuration
├── README.md
├── tests/ # Tests (not shipped with the package)
| ├── __init__.py
| ├── test_history.py
| └── test_skill_loader.py
├── .env.example # Environment variable example
├── .gitignore
└── agent/ # Main package
├── __init__.py
├── Baize.py # Main program and Agent Loop
├── config.py # Multi-backend configuration loading
├── ui_theme.py # CLI rendering theme
├── utils.py # General utilities
├── logo.txt
├── skills/ # Built-in skills
├── subagent/ # Built-in subagents
├── core/ # Core logic (side-effect free, unit-testable)
| ├── __init__.py
| ├── history.py # Session history cleaning / token estimation / compression
| └── privacy.py # Privacy sanitization: PII detection / placeholder
├── hooks/ # Built-in hooks
└── MCP/ # MCP client and configuration
├── __init__.py
├── mcp_client.py
└── mcp_config.json
`
Environment Variable Reference
- Variable:
DEEPSEEK_API_KEY Description: DeepSeek API Default: key —
Variable: DEEPSEEK_BASE_URL Description: DeepSeek endpoint Default: https://api.deepseek.com
Variable: OPENAI_API_KEY Description: OpenAI Default: compatible API key —
Variable: OPENAI_BASE_URL Description: OpenAI-compatible endpoint Default: https://api.openai.com/v1
Variable: OLLAMA_BASE_URL Description: Ollama service address Default: http://localhost:11434
Write variables to ~/.baize/.env; there is no need to modify shell config files.
- Data analysis variable:
SPSS_INSTALL_PATH Description: IBM SPSS Statistics installation directory Default: — (falls back to file mode if not set)
Data analysis variable: DATABASE_URL Description: Database connection string for SQL MCP Default: — (read by the MCP server)
Write these variables to MCP/mcp_config.json.
Development
Running Tests
This project uses pytest. Before development, install the package in editable mode with dev dependencies:
pip install -e ".[dev]"
Run all tests:
python -m pytest tests/ -v
Run a single file:
python -m pytest tests/test_history.py -v
Code Structure Conventions
agent/: The main package shipped with the package. All runtime logic and resources (skills, subagent, hooks, MCP) are here.
agent/core/: Pure logic modules with no external side effects. They must be independently testable. Put new logic of this kind here and add tests.
tests/: Corresponds one-to-one with source files under agent/, named test_.
Any function with external dependencies (network, disk, global state) should have dependencies injected via parameters to make replacement easy in tests.
❓ FAQ
- Q: Where should I put the API key?
A: ~/.baize/.env, not the .env in the project root.
- Q: Do I need to reinstall after switching backends?
A: No. Just change active_provider in ~/.baize/config.toml.
- Q: Does local Ollama require an API key?
A: No. Select active_provider = "ollama" and leave env_key empty.
- Q: How do I switch the working directory?
A: Just say "switch to /path/to/project" in the conversation, and Baize will call the set_workspace tool.
- Q: What happens when the context gets too long?
A: Baize automatically performs two-level compression: first truncating old tool results, then requesting the LLM to generate a summary. You can also manually run /compact.
- Q: Will it accidentally delete my files?
A: The default command whitelist blocks dangerous operations such as rm -rf /; before writing files, it shows a Diff and asks for confirmation.
- Q: How can I make Baize connect to SPSS?
A: 1. Install pip install -r requirements-data.txt; 2. Set the environment variable SPSS_INSTALL_PATH to the SPSS installation directory; 3. Enable the SPSS server in MCP/mcp_config.json. See the "Data Access" section for details.
- Q: What should I do if
SPSS batch: NOT FOUND appears?
A: This means the SPSS engine was not found. Check whether SPSS_INSTALL_PATH correctly points to the directory containing stats.exe; if you only process .sav files, you can ignore this warning (it will fall back to file mode).
- Q: What else do I need to install to connect to SQL databases?
A: Install atengk-mcp-server-rdbms at the Python level (automatically done by pip install). SQL Server users also need to install Microsoft ODBC Driver 18 at the system level, which cannot be installed via pip.
- Q: Will Baize accidentally delete my database data?
A: No. SQL MCP only allows SELECT by default, and all write operations are blocked at the AST syntax tree level. It is still strongly recommended to create a separate read-only database account for Baize as a double safeguard.
- Q: Will data in SPSS analysis results leak to the LLM?
A: If privacy sanitization is enabled (/privacy on), tool return results are automatically sanitized for phone numbers, emails, ID cards and other PII before being sent to the LLM. However, it is recommended to also use a read-only database account + data sampling (query only necessary fields) to reduce risk.
- Q: Why does Baize become slower and use more tokens after adding SPSS/SQL?
A: Because the tool definitions exposed by the MCP server are sent to the LLM with every conversation turn. SPSS has 60+ tools, adding about 6000–12000 tokens of fixed overhead. If your common workflow does not involve SPSS, you can set its enabled to false` and turn it on when needed.
🤝 Contributing
Welcome to submit Issues and pull requests. It is recommended to read the contents in CONTRIBUTOR.md before submitting a pull request.Thank you for every Contributor to Submit PR
- GitHub Contributor:
License
MIT LicenseAcknowledgements
- This project is hosted on AtomGit in China: https://atomgit.com/Com_Xu/Baize
- Thanks to AtomGit for including this project in the G-star incubation program
- Thanks to PR contributors, Douyin followers, and students who follow me
- Inspired by excellent AI Coding tools such as Claude Code and Codex
- Built on DeepSeek, OpenAI SDK, and MCP
- Thanks to all developers walking the Vibe Coding path together
☕ Support
If Baize is useful to you, you’re welcome to sponsor or tip. Independent development also takes a lot of time. Sponsorship will not change the product update schedule. Thank you for your support!
Contact Me
- If you are interested in Baize, want to participate in open-source collaboration, or want to keep up with my updates, you can contact me through
- Currently, I am also in the job-hunting process. I have experience in market research and user research, and I have some knowledge of Agents. If my skills meet your requirements, I would also like to work with you (Desired Position: AI product operation / user research / market research)
Scan the QR code with WeChat. Please indicate "Baize Open Source Cooperation" or "Corporate Recruitment".
Scan with Douyin to follow