The agent
One binary, on the endpoint, and nothing else.
No container to operate, no central service on the request path, no account to create before you start. The agent listens locally, masks, routes, restores.
Source available, not open source — and we say so
The agent ships under FSL-1.1-Apache-2.0, the Functional Source License. The code is public and anyone can read it. Using it is free and unlimited, including commercially and inside a company. The only thing forbidden is turning it into a competing product: reselling, managed service, marketed substitute.
Every release converts automatically to Apache-2.0 two years after publication. You are never locked in: at worst, you wait.
We do not write “open source” because the licence does not meet the OSI definition. A product selling rigour about data cannot open with a loose claim about its own licence.
Autonomous by design
No backend required
The agent masks and restores without ever reaching our servers. Monitoring is an option you switch on, not a dependency.
Backend down, agent unaffected
Network outage, failure on our side, firewall block: heartbeats queue locally for seven days and replay in batches when the link returns, rather than as two thousand simultaneous requests that would finish off the service that just recovered. Beyond that, lost windows are counted and declared: a gap in the record is exactly what an auditor needs to see. The user’s request never slows down.
Your keys, your providers
The agent uses the API keys you give it and talks straight to the provider. We are never in the middle.
Explicit enrolment
Linking an agent to a console requires an enrolment token, exchanged once for a persisted agent key. An agent never joins a fleet on its own.
A stopped agent does not break the machine
The line added to the shell asks the agent and prints nothing while it is stopped. A stopped agent therefore means unmasked traffic, not a workstation where every AI tool fails on a line nobody wrote. That is a deliberate trade — availability over enforcement — and monitoring is what makes it safe: a stopped agent shows up in the console as silent, rather than as nothing at all.
Installation
One install script for macOS and Linux: it places the binary, registers the service — launchd or systemd — and writes the configuration. On macOS it adds an icon to the menu bar: a second binary, separate from the agent on purpose, that says whether it is masking and hands over the line that points one tool at it, provider by provider. Quitting it leaves the agent masking. Uninstalling removes everything the script placed, shell environment variables included.
The agent is in private beta. The repository is public; signed binaries are not out yet. Write to us for access.
Request accessSupported providers
- Anthropic
- OpenAI
- Google Gemini
- Mistral
- Groq
- Together
- DeepInfra
- xAI
See for yourself what leaves
Masking you cannot watch is masking taken on trust. Four ways to look at it, all on the endpoint, none needing an account.
The test page
While the agent runs, a local page shows your own text three ways: as you wrote it, masked with tokens, masked with stand-ins. In this agent’s locales and allow list, not in a generic demo.
Audit mode
The agent can print every value it replaces and restores, and write both bodies of every exchange to disk. What stays uncoloured in the body that left is what the catalogue never recognised: it is the one place a gap shows, and no counter reports it. Neither belongs in a service definition, and the banner says so on every start.
Scan a file
One command reads a file or standard input and lists what would be masked: the category, the position in the text, the confidence. Without starting anything and without sending anything.
State, not process
The status command does not answer “the service is up” but “here is what it is masking”. An agent with no locale is perfectly healthy and recognises almost nothing: it exits non-zero until the agent is actually masking, which makes it usable from a script.
What the agent does not do yet
A CISO needs to know the limits before signing, not after. Here is the honest state today.
No prompt-injection guard
Detecting hostile instructions inside retrieved content is not in this release. It is the next functional milestone.
No blocking mode
The agent masks; it does not yet refuse a request containing a forbidden category. Per-category blocking, expected above all for secrets, comes after.
In-memory vault only
The mapping does not survive an agent restart and is not shared across instances. That is the intended behaviour on a workstation; it would not be on a shared server.