{"slug": "gate-deterministic-pii-redaction-for-ai-agent-tool-output-rust", "title": "Gate – deterministic PII redaction for AI agent tool output (Rust)", "summary": "A new open-source Rust tool called Gate intercepts AI agent query results to redact personally identifiable information (PII) before it reaches large language model contexts. Unlike LLM-based redaction systems that send data to models for classification, Gate uses deterministic regex and column heuristics with under 10 milliseconds of overhead per query, ensuring reproducible and auditable privacy boundaries. The tool covers both Bash commands and MCP server calls without requiring changes to existing agent workflows, though it cannot catch PII in unstructured free-text prose.", "body_md": "**A deterministic privacy boundary between your data and AI.Intercepts query results before the model sees them — rule-driven, reproducible, and audit-ready.**\n\n**English** | [简体中文](/GaaraZhu/gate/blob/main/README.zh-CN.md)\n\nAI agents increasingly access internal databases and APIs through CLI tools, scripts, and MCP servers. Without safeguards, sensitive data such as emails, phone numbers, tax identifiers, and payment details can be unintentionally exposed to LLM context windows.\n\n`gate`\n\nintercepts query results before they reach the model and automatically redacts detected PII fields without requiring changes to existing agent workflows or prompts. It covers both access paths agents use: **Bash commands** (via a harness hook) and **MCP server calls** (via a wrap-style stdio proxy), adding < 10 ms of overhead per query.\n\nMost PII guardrails for AI agents are themselves LLMs — they send your data to a model to decide whether it's sensitive. Gate takes the opposite approach.\n\n| gate | LLM-based redaction | |\n|---|---|---|\n| Decision method | Regex + column heuristics + Luhn | Model inference |\n| Deterministic | ✅ Same input always produces the same output | ❌ Varies by run and model version |\n| Data stays local | ✅ Never leaves your machine | ❌ Sent to a model API for classification |\n| Latency | ✅ < 10ms overhead | ❌ Adds an API round-trip |\n| Auditable | ✅ Every decision traceable to an explicit rule | ❌ Model reasoning is opaque |\n| Known gaps | ✅ Documented — free-text prose | ❌ False-negative rate unknown |\n\nThe trade-off gate makes: rules can't catch PII in unstructured free-text prose. The [threat model](/GaaraZhu/gate/blob/main/THREAT-MODEL.md) documents what gate doesn't cover.\n\nDatabase-level masking is the right answer when you control the source. Gate fills the gap when you don't, and covers the paths masking can't reach.\n\n| gate | Database masking | |\n|---|---|---|\n| Requires DB admin access | ✅ No changes to the database | ❌ Needs column-level config by a DBA |\n| Works on vendor / external DBs | ✅ Wraps any JSON-returning tool | ❌ Only databases you administer |\n| Covers MCP and API tools | ✅ Any `tools/call` response |\n❌ No masking concept at this layer |\n| Production data freshness | ✅ Works against live data | ❌ Static copies drift; DDM may lag |\n| Agent bypass resistance | ✅ Direct value exposure blocked in harness hook | ❌ Aggregate functions and CASE expressions can bypass DDM |\n| Known gaps | ✅ Documented | ❌ DDM gaps are often silent |\n\nThey're complementary: if you have DDM configured, gate is the safety net for the paths and patterns DDM misses.\n\nThe demo walks through three steps:\n\n`gate scan`\n\ndetecting PII columns across the schema before any query runs- An agent querying the transactions table with gate disabled —\n`card_number`\n\nfully visible - The same queries with gate enabled —\n`card_number`\n\nredacted across both MCP and Bash paths\n\nAlso works with OpenCode, Cursor, GitHub Copilot CLI, Codex CLI, and Gemini CLI — see [Supported AI Tools](#supported-ai-tools) for the full compatibility matrix.\n\nFor the design rationale, threat-model walkthrough, and detection-pipeline deep dive, read\n\n[.]Introducing gate\n\nBefore installing the hook, use `gate scan`\n\nto assess how much PII your schema exposes. Pipe a `TABLE_NAME, COLUMN_NAME`\n\nquery into it and gate prints a risk report across every table. No config is required for `gate scan`\n\nitself — if you haven't created one yet, run `gate config --init-only`\n\nfirst.\n\n```\npsql -U <user> -h <host> -d <dbname> -c \"SELECT TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = 'public' ORDER BY TABLE_NAME, ORDINAL_POSITION\" | gate scan\n```\n\nSee [docs/scan.md](/GaaraZhu/gate/blob/main/docs/scan.md) for queries against MySQL, MS SQL Server (including native `sqlcmd`\n\n), Databricks, and toolkit-managed clients.\n\nRisk level is weighted by category sensitivity — one SSN column matters more than twenty address columns. Exits with code 1 if any PII columns are found (scriptable in CI). Pass `--verbose`\n\nto show all detected columns, or `--json`\n\nfor machine-readable output.\n\n| Sensitivity | Categories | Risk floor |\n|---|---|---|\nCritical |\nGovernment IDs, Health & medical, Financial, Biometric | HIGH always; CRITICAL if ≥3 columns or >10% of schema |\nElevated |\nContact, Names, Date of birth, Location of birth, Family & relationships, Employment | HIGH if >5% of schema; CRITICAL if >25% |\nStandard |\nAddress & location, Online & technical, Demographics | HIGH if >25% of schema |\n\nNote:`gate scan`\n\ndetects PII by column name only. A LOW result means your column names look clean — it does not mean the data is safe. Gate 2 additionally inspects values at query time, catching PII in free-text, JSON, and ambiguously-named columns that scan cannot see. In multi-row results, if any value in a column matches a PII pattern, the entire column is promoted and all rows are redacted — not just the matching row.\n\nFor false positives (e.g. `city`\n\nin a `products`\n\ntable), run `gate scan --review`\n\nto triage interactively and add columns to the allowlist. Allowlisted columns skip **all** redaction — both name-based and value-based. Only add a column to the allowlist when you are certain it contains no PII. Low-confidence pattern matches (below `confidence_threshold`\n\n) are redacted *and* flagged with a warning in `_gate_summary`\n\n; add the column to `column_allowlist`\n\nto suppress. Manage the list directly with `gate allowlist add/remove/list`\n\n.\n\n-\n**Install gate**\n\n```\n# Homebrew — macOS and Linux (recommended)\nbrew tap GaaraZhu/gate && brew install gate\n\n# cargo binstall — downloads a prebuilt binary\ncargo binstall gate\n\n# Or grab a binary from the releases page\n# https://github.com/GaaraZhu/gate/releases\n```\n\n-\n**Create your config**(opens`~/.config/gate/config.yaml`\n\nin your editor):\n\n```\ngate config\n```\n\n-\n**Register the hook** with your agent harness:\n\n```\n# Claude Code (default)\ngate init\n\n# OpenCode\ngate init --harness opencode\n\n# Cursor\ngate init --harness cursor\n\n# GitHub Copilot CLI (project-scoped, run from repo root)\ngate init --harness copilot-cli\n\n# Codex CLI\ngate init --harness codex\n\n# Gemini CLI\ngate init --harness gemini\n```\n\nAdd\n\n`--scope project`\n\nfor project-only setup. Restart your OpenCode, Cursor, or Gemini CLI session after`gate init`\n\nto load the hook. For Codex CLI, restart the session, then review the hook in the Trust & Permissions UI, mark it as trusted, and enable it. For Copilot CLI, the generated`.github/hooks/PreToolUse.json`\n\nis gitignored by default — each developer runs`gate init --harness copilot-cli`\n\nonce in their local clone. -\n*(Optional)***Register MCP server proxies** so`tools/call`\n\nresponses also pass through gate:\n\n```\n# Claude Code (default) — dry-run, shows what would change\ngate init --wrap-mcp\n\n# OpenCode\ngate init --harness opencode --wrap-mcp --yes\n\n# Cursor\ngate init --harness cursor --wrap-mcp --yes\n\n# Copilot CLI\ngate init --harness copilot-cli --wrap-mcp --yes\n\n# Codex CLI\ngate init --harness codex --wrap-mcp --yes\n\n# Gemini CLI\ngate init --harness gemini --wrap-mcp --yes\n```\n\nAdd\n\n`--scope project`\n\nfor project-level MCP config. For Cursor project-scoped MCP, re-enable the servers in**Settings → Tools & MCPs** after registration. See[docs/mcp.md](/GaaraZhu/gate/blob/main/docs/mcp.md)for`--servers`\n\n, per-harness paths, and manual single-server registration. -\n**Start your AI session**—`gate`\n\nintercepts query commands automatically. No changes to your prompts or tools required.\n\nRun `gate validate`\n\nto confirm your config is valid before the first session.\n\n`gate`\n\ncovers two access paths agents use to reach data. The [blog post](https://gaarazhu.github.io/introducing-gate/) has the full walkthrough; the short version:\n\nEvery Bash command passes through `gate hook`\n\nfirst. Commands that match a configured tool are silently rewritten to `gate run -- <original command>`\n\n, which spawns the subprocess and pipes stdout through the two-gate detection pipeline. The rewrite happens in the harness's pre-tool-execution hook — it is **enforcing** in Claude Code, OpenCode, Cursor, GitHub Copilot CLI, Codex CLI, and Gemini CLI; the agent cannot bypass it. Humans and CI scripts running outside the harness are untouched.\n\n```\nAI asks to run: tkpsql query --sql \"SELECT * FROM users\"\n                        │\n         harness hook fires (PreToolUse / tool.execute.before)\n                        │\n              gate hook rewrites to: gate run -- tkpsql query --sql \"...\"\n                        │\n         ┌──────────────┴──────────────┐\n         │ Gate 1: SQL inspection      │  SELECT * → no column hints, defer to Gate 2\n         │ Gate 2: Value scanning      │  regex + column-name heuristics + Luhn check\n         └──────────────┬──────────────┘\n                        │\n         {\"id\": 1, \"full_name\": \"[PII:name]\", \"email\": \"[PII:email]\", ..., \"_gate_summary\": {...}}\n```\n\n`gate mcp`\n\nis a transparent stdio proxy registered in the harness as the MCP server. It forwards all JSON-RPC traffic verbatim except `tools/call`\n\nresponses, which pass through Gate 2 before reaching the model. No changes to the upstream server are required.\n\nNote:only`tools/call`\n\nresponses are redacted —`resources/read`\n\n,`prompts/get`\n\n, and other MCP message types are forwarded without inspection.\n\n```\nAI ──tools/call──> gate mcp ──forward──> upstream MCP server\n                       │\n                       │ <── tools/call response with PII\n                       │\n                       │ Gate 2 scan + redact\n                       │\nAI <───redacted result─┘\n```\n\nRedacted output preserves the original JSON structure. PII values are replaced with `[PII:<type>]`\n\nplaceholders. A `_gate_summary`\n\nfield is appended reporting what was redacted.\n\n```\n{\n  \"rows\": [{\"id\": 1, \"email\": \"[PII:email]\", \"ssn\": \"[PII:ssn]\"}],\n  \"count\": 1,\n  \"_gate_summary\": {\"redacted\": 2, \"types\": [\"email\", \"ssn\"], \"warnings\": []}\n}\n```\n\nWith `hash_values: true`\n\nin config, each placeholder gains an 8-char hex suffix derived from the original value (`[PII:email:7f83b165]`\n\n). The same raw value always produces the same suffix, so the AI can join or deduplicate across rows without ever seeing the underlying data. Error responses from the underlying tool pass through unchanged.\n\n`_gate_summary`\n\nreports a single response. `gate retro`\n\naggregates across all of them — total queries seen, PII fields redacted, hit rate, plus a breakdown by tool and PII category. Useful for periodic audits and for confirming the boundary is doing real work.\n\nIf any query produced a low-confidence redaction, `gate retro`\n\nsurfaces a **Low-confidence redactions** section listing each unique warned column and the exact `gate allowlist add <col>`\n\ncommand to suppress it. Once a column is added to the allowlist it disappears from this section automatically.\n\nStats are collected by default and written to a local JSONL log on disk — they never leave your machine. Disable with `stats.enabled: false`\n\nin config.\n\n`gate`\n\nis a deterministic redaction layer, not a sandbox. It assumes the agent is non-adversarial and only inspects output from commands listed under `tools:`\n\nin config. The following are deliberately out of scope:\n\n**Adversarial agents / prompt injection.** Gate's threat model is an agent that*inadvertently*exfiltrates PII.`gate protect`\n\n(Unix) blocks the most direct bypass — a hijacked agent disabling gate via config edits — by transferring config ownership to root. But a determined attacker can still route around gate by invoking commands not in`tools:`\n\n, requesting non-JSON output formats, piping through encoders, or removing the hook entry from the harness settings file for the next session. Pair gate with a harness-level Bash allowlist to close the residual gap.**Commands not in** The AI can invoke them freely; their output is never inspected.`tools:`\n\n.**Non-JSON tool output.** Plain text, CSV, and other formats pass through unchanged. Configure tools to emit JSON.**Encoded or obfuscated PII.** Base64-encoded emails, URL-encoded values, or deliberately spaced strings (`a l i c e @ e x a m p l e . c o m`\n\n) are not detected.**Non-US PII by value alone.** The built-in SSN regex requires dashes. AU/NZ phone numbers are caught by value — mobile (`04XX`\n\n/`02X`\n\nlocal,`+61 4XX`\n\n/`+64 2X`\n\ninternational) and landline (`0[2378]`\n\n/`0[34679]`\n\nlocal,`+61 [2378]`\n\n/`+64 [34679]`\n\ninternational) — including the common`+610`\n\n/`+640`\n\nstray-leading-zero variant and arbitrary whitespace in the number. International-prefix numbers (`+61`\n\n/`+64`\n\n) auto-redact regardless of column name; local-format numbers require a PII-named column. Other AU/NZ identifiers are also covered at the value layer: ABN (mod-89 checksum), Medicare (mod-10 checksum), formatted TFN and IRD numbers (mod-11, separators required), NZ NHI (alpha-prefix regex), and NZ bank account numbers. Bare/unformatted TFN and IRD strings without separators are not detected by value alone — column-name matching remains the safety net for those. Other non-AU/NZ formats rely solely on column-name matching — extend`pii.column_names`\n\nor`pii.patterns`\n\nfor your region.**PII already in the model's context** from prior turns, system prompts, file reads, or earlier summarisation. Gate filters what goes*into*the model from configured tools; what's already there stays there.**Tool-side network exfiltration.** If a configured tool sends data to an external service directly (rather than returning it via stdout), gate never sees it.**Write operations.**`INSERT`\n\n,`UPDATE`\n\n,`DELETE`\n\nare not inspected or blocked.**Credential exposure.** Gate holds no credentials; that is the responsibility of the underlying tool. Prefer toolkit commands or MCP servers over raw clients that take credentials on the CLI.\n\nFor a stronger boundary, combine gate with harness-level tool restrictions and database-level read-only roles. See [THREAT-MODEL.md](/GaaraZhu/gate/blob/main/THREAT-MODEL.md) for the full attacker model and known bypasses.\n\nAny command that returns JSON can be configured as a `gate`\n\ntarget — database clients, internal API calls via `curl`\n\n, or any other tool your AI agent uses to fetch data. The AI sees the same structured response it always did, with PII values replaced in-place.\n\n| Command | Type | Notes |\n|---|---|---|\n`tkpsql` |\nPostgreSQL (toolkit-managed) | `sql_arg: \"--sql\"` |\n`tkmsql` |\nMS SQL Server (toolkit-managed) | `sql_arg: \"--sql\"` |\n`tkdbr` |\nDatabricks (toolkit-managed) | `sql_arg: \"--sql\"` |\n`databricks` |\nDatabricks CLI (native) | `sql_arg: \"--json\"` , `json_sql_path: \"statement\"` |\n`curl` |\nHTTP data sources | `pipe: \"jq -c .\"` |\n`psql` , `mysql` , `mariadb` |\nRaw DB clients | Not enabled by default — see\n|\n\nPrefer toolkit commands or MCP servers over raw clients: raw clients typically require credentials on the command line, which lands in the agent's transcript, shell history, and process listing. Toolkit commands ([ tk*](https://github.com/scott-abernethy/toolkit)) inject credentials from a secrets store; MCP servers hide the connection string entirely.\n\n`gate`\n\nworks with any JSON-returning command — toolkit is not required.\n\n```\ngate --help                    # full subcommand list\ngate <subcommand> --help       # details for any subcommand\n```\n\nThe ones you'll use most:\n\n| Command | Purpose |\n|---|---|\n`gate init` |\nRegister the hook with your harness (see Quickstart) |\n`gate config` |\nCreate and edit the YAML config |\n`gate scan` |\nPII risk report across your schema |\n`gate allowlist add/remove/list` |\nManage column-name false positives |\n`gate retro` |\nProtection retrospective — total queries & PII fields redacted, breakdown by tool and PII type/category, hit rate with visual progress bar, and low-confidence warnings with allowlist hints |\n`gate enable` / `gate disable` |\nToggle redaction without uninstalling |\n`gate validate` |\nCheck config for errors before the first session |\n`gate protect` / `gate unprotect` (Unix only) |\nTransfer config ownership to root |\n`gate uninstall` |\nRemove everything gate added to your system |\n\nSee [docs/commands.md](/GaaraZhu/gate/blob/main/docs/commands.md) for the full reference, including `gate run`\n\n, `gate mcp`\n\n, and the `--wrap-mcp`\n\n/ `--scope`\n\n/ `--harness`\n\nflags.\n\nFor a stronger guarantee, transfer ownership of the config to root so the agent cannot modify it:\n\n```\nsudo gate protect      # any future enable/disable/config/allowlist now needs sudo\nsudo gate unprotect    # restore direct write access\n```\n\nEnforced at the OS level across all harnesses (Claude Code, OpenCode, Cursor, GitHub Copilot CLI, Codex CLI, Gemini CLI). Not supported on Windows.\n\n| AI Tool | Bash Hook | MCP Wrap | Notes |\n|---|---|---|---|\n|\n\n[Cursor](https://cursor.sh)`gate init`\n\nto load the hook[OpenCode](https://opencode.ai)`gate init`\n\nto load the hook[GitHub Copilot CLI](https://github.com/features/copilot)`gate init`\n\nonce[Codex CLI](https://github.com/openai/codex)`gate init`\n\n, restart session and trust + enable the hook in the Permissions UI[Gemini CLI](https://github.com/google-gemini/gemini-cli)`gate init`\n\nto load the hook[Configuration](/GaaraZhu/gate/blob/main/docs/configuration.md)— full YAML schema and built-in PII detection rules[Commands](/GaaraZhu/gate/blob/main/docs/commands.md)— full subcommand reference[MCP setup](/GaaraZhu/gate/blob/main/docs/mcp.md)— wrapping existing MCP servers and registering new ones[Scan queries](/GaaraZhu/gate/blob/main/docs/scan.md)— schema-query examples for each database[Config file locations](/GaaraZhu/gate/blob/main/docs/config-locations.md)— where each harness stores hooks and MCP settings[Troubleshooting](/GaaraZhu/gate/blob/main/docs/troubleshooting.md)— common issues and fixes\n\n```\ngate uninstall\nbrew uninstall gate\n```\n\n`gate uninstall`\n\nremoves gate hooks from all harnesses, the config directory at `~/.config/gate/`\n\n, and any gate-generated plugin files. It shows what will be deleted and asks for confirmation.\n\nBug reports and pull requests are welcome. For significant changes, open an issue first to discuss the proposal. See [CONTRIBUTING.md](/GaaraZhu/gate/blob/main/CONTRIBUTING.md) for the dev setup, pre-commit checklist, and safety rules for redaction changes.\n\nMIT — see [LICENSE](/GaaraZhu/gate/blob/main/LICENSE).\n\nSee [DISCLAIMER.md](/GaaraZhu/gate/blob/main/DISCLAIMER.md).", "url": "https://wpnews.pro/news/gate-deterministic-pii-redaction-for-ai-agent-tool-output-rust", "canonical_source": "https://github.com/GaaraZhu/gate", "published_at": "2026-06-04 07:28:09+00:00", "updated_at": "2026-06-04 07:48:04.373982+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "ai-infrastructure", "large-language-models"], "entities": ["Gate", "GaaraZhu", "MCP", "LLM", "Luhn", "Bash"], "alternates": {"html": "https://wpnews.pro/news/gate-deterministic-pii-redaction-for-ai-agent-tool-output-rust", "markdown": "https://wpnews.pro/news/gate-deterministic-pii-redaction-for-ai-agent-tool-output-rust.md", "text": "https://wpnews.pro/news/gate-deterministic-pii-redaction-for-ai-agent-tool-output-rust.txt", "jsonld": "https://wpnews.pro/news/gate-deterministic-pii-redaction-for-ai-agent-tool-output-rust.jsonld"}}