{
"name": "auth-service-7f4b",
"pod_ip": "10.42.18.247",
"sa_token": "eyJhbGciOiJSUzI1NiIs..."
}
{
"name": "pod_1",
"pod_ip": "ip_1",
"sa_token": "token_1"
}
MCP / privacy proxy / open source
OpenMaskit is an MCP proxy that strips sensitive values from tool responses before they reach your AI agent — and puts them back when the agent calls home.
{
"name": "auth-service-7f4b",
"pod_ip": "10.42.18.247",
"sa_token": "eyJhbGciOiJSUzI1NiIs..."
}
{
"name": "pod_1",
"pod_ip": "ip_1",
"sa_token": "token_1"
}
Every MCP tool response your agent reads becomes part of its context window. Hostnames, tokens, customer emails, internal IPs — once they're in the prompt, they're somewhere: in transit, in logs, in someone else's training pipeline. The agent doesn't need the real values to do its job. It just needs something to refer to them by.
Drop OpenMaskit between your agent and the MCP servers it already talks to. Responses pass through; sensitive values are replaced with stable aliases on the way out, and swapped back to real values on the way in.
Everything runs on your machine.
Masking happens locally. Aliases are computed locally. The audit log is local, encrypted at rest. Real values, masked values, tool-call payloads — none of it ever crosses the wire to us. Read the privacy notice →