@trustevo/pii-guardrail

On-device PII firewall for AI coding tools. It tokenizes MCP tool results before the model sees them and restores surrogates only at trusted boundaries — zero data egress, reversible, on-device. Same detection engine as the PII Guardrail browser extension, packaged for your terminal and IDE.

Install / wire up a tool

# Auto-detect and wire the right config for your tool:
npx @trustevo/pii-guardrail install claude-code   # Claude Code hooks
npx @trustevo/pii-guardrail install cursor        # wraps your MCP servers
npx @trustevo/pii-guardrail install claude-desktop
npx @trustevo/pii-guardrail install windsurf

# Verify the wiring + run a PII probe:
npx @trustevo/pii-guardrail doctor

By default install is a dry run (prints the config diff). Add --apply to write it.

📖 Per-tool setup guides: docs/integrations — Claude Code, Cursor, Windsurf, Claude Desktop, and any OpenAI/Anthropic-compatible tool.

Protect a tool's own model calls (Cursor, Codex, Continue…)

Beyond MCP, you can route a coding tool's own LLM calls through a local proxy that tokenizes PII before it reaches the provider and restores it in the response (works for OpenAI- and Anthropic-compatible APIs):

# start the egress proxy in front of your provider
npx -p @trustevo/pii-guardrail pii-guardrail-llm --target=https://api.openai.com

# then point the tool's "custom API base" at it:
#   OpenAI base URL → http://127.0.0.1:8788/v1

--block-t1 refuses to send critical data (cards/SSNs/secrets) at all; --no-restore leaves surrogates in the response (max safety). Streaming (SSE) is restored per event. Copilot is not supported (hardcoded backend).

What each binary does

| Binary | Role | |---|---| | pii-guardrail | installer + doctor — wires/verifies a tool | | pii-guardrail-hook | Claude Code Pre/PostToolUse + SessionEnd hook | | pii-guardrail-proxy | stdio MCP proxy — wrap one MCP server command | | pii-guardrail-remote | HTTP/SSE reverse proxy for remote MCP servers | | pii-guardrail-llm | LLM-API egress proxy — the tool's own model calls (OpenAI/Anthropic) |

Guarantees

• Zero egress: detection + tokenization run locally; no network calls on the detection path.
• Zero persist: the value↔surrogate vault lives in memory for the process lifetime only.
• Fail-open: an internal error never bricks your tooling (set PII_GUARDRAIL_STRICT=1 to fail-closed where you'd rather stop than pass an unscanned result).

Trust tiers (--trust=block|inbound|roundtrip) control whether results are tokenized only or fully round-tripped. See docs/mcp-protection.md.