@fastino/pii-guard

An OpenClaw plugin that automatically detects and blocks outbound AI responses containing personally identifiable information (PII).

What it does

PII Guard intercepts every assistant response before it is written to the session. If the response contains PII above a confidence threshold, it is replaced with a warning message:

⚠️ My response was blocked as it may contain personal information. Please ask me again.

Detection is powered by urchade/gliner_multi_pii-v1, a local encoder model that runs entirely on your machine. No data is sent to external services.

Detected PII types

Person names, email addresses, phone numbers, physical addresses, dates of birth, social security numbers, credit card numbers, passport numbers, driver's licenses, bank account numbers, IP addresses, usernames, passwords, and organisations.

Requirements

• OpenClaw gateway
• uv — installed automatically if not present
• Python 3.10+ (managed by uv)
• curl (standard on macOS and Linux)

Install

openclaw plugins install @fastino/pii-guard
openclaw gateway restart

On first start, the plugin automatically:

1. Installs uv if not present
2. Creates a Python virtual environment
3. Downloads and caches the PII detection model from HuggingFace (~500MB, one-time)

Subsequent starts load the model from cache and are fast.

Uninstall

openclaw plugins uninstall pii-guard
openclaw gateway restart

How it works

The plugin runs a local Flask sidecar process that holds the GLiNER model in memory. On each assistant response, a synchronous check is made to the sidecar over localhost before the message is written to the session. If any entity is detected with a confidence score ≥ 0.9, the response is replaced with the warning message.

The sidecar binds to 127.0.0.1 only and is protected by a random secret generated on first run (stored in ~/.openclaw/config/pii-guard.json).

If the sidecar is unreachable for any reason, the plugin fails open — messages are allowed through and a warning is logged.

Security notice

OpenClaw's plugin scanner will flag this plugin for child_process usage and environment variable access. These are expected: the plugin spawns a Python sidecar process and passes a locally-generated secret to it over localhost. No credentials are harvested or transmitted externally.