Gate – deterministic PII redaction for AI agent tool output (Rust) A new open-source Rust tool called Gate intercepts AI agent query results to redact personally identifiable information (PII) before it reaches large language model contexts. Unlike LLM-based redaction systems that send data to models for classification, Gate uses deterministic regex and column heuristics with under 10 milliseconds of overhead per query, ensuring reproducible and auditable privacy boundaries. The tool covers both Bash commands and MCP server calls without requiring changes to existing agent workflows, though it cannot catch PII in unstructured free-text prose. A deterministic privacy boundary between your data and AI.Intercepts query results before the model sees them — rule-driven, reproducible, and audit-ready. English | 简体中文 /GaaraZhu/gate/blob/main/README.zh-CN.md AI agents increasingly access internal databases and APIs through CLI tools, scripts, and MCP servers. Without safeguards, sensitive data such as emails, phone numbers, tax identifiers, and payment details can be unintentionally exposed to LLM context windows. gate intercepts query results before they reach the model and automatically redacts detected PII fields without requiring changes to existing agent workflows or prompts. It covers both access paths agents use: Bash commands via a harness hook and MCP server calls via a wrap-style stdio proxy , adding < 10 ms of overhead per query. Most PII guardrails for AI agents are themselves LLMs — they send your data to a model to decide whether it's sensitive. Gate takes the opposite approach. | gate | LLM-based redaction | | |---|---|---| | Decision method | Regex + column heuristics + Luhn | Model inference | | Deterministic | ✅ Same input always produces the same output | ❌ Varies by run and model version | | Data stays local | ✅ Never leaves your machine | ❌ Sent to a model API for classification | | Latency | ✅ < 10ms overhead | ❌ Adds an API round-trip | | Auditable | ✅ Every decision traceable to an explicit rule | ❌ Model reasoning is opaque | | Known gaps | ✅ Documented — free-text prose | ❌ False-negative rate unknown | The trade-off gate makes: rules can't catch PII in unstructured free-text prose. The threat model /GaaraZhu/gate/blob/main/THREAT-MODEL.md documents what gate doesn't cover. Database-level masking is the right answer when you control the source. Gate fills the gap when you don't, and covers the paths masking can't reach. | gate | Database masking | | |---|---|---| | Requires DB admin access | ✅ No changes to the database | ❌ Needs column-level config by a DBA | | Works on vendor / external DBs | ✅ Wraps any JSON-returning tool | ❌ Only databases you administer | | Covers MCP and API tools | ✅ Any tools/call response | ❌ No masking concept at this layer | | Production data freshness | ✅ Works against live data | ❌ Static copies drift; DDM may lag | | Agent bypass resistance | ✅ Direct value exposure blocked in harness hook | ❌ Aggregate functions and CASE expressions can bypass DDM | | Known gaps | ✅ Documented | ❌ DDM gaps are often silent | They're complementary: if you have DDM configured, gate is the safety net for the paths and patterns DDM misses. The demo walks through three steps: gate scan detecting PII columns across the schema before any query runs- An agent querying the transactions table with gate disabled — card number fully visible - The same queries with gate enabled — card number redacted across both MCP and Bash paths Also works with OpenCode, Cursor, GitHub Copilot CLI, Codex CLI, and Gemini CLI — see Supported AI Tools supported-ai-tools for the full compatibility matrix. For the design rationale, threat-model walkthrough, and detection-pipeline deep dive, read . Introducing gate Before installing the hook, use gate scan to assess how much PII your schema exposes. Pipe a TABLE NAME, COLUMN NAME query into it and gate prints a risk report across every table. No config is required for gate scan itself — if you haven't created one yet, run gate config --init-only first. psql -U