A firewall for context, on your machine
The pipeline
Your agent sends its real context
Timeout, bad answer or full context: blocked, nothing sent
Agent
1Detectors
2Auto masks
3Security model
Untrusted model
Agent runs it
5Restore
4Check tool call
The context
API_KEY=real key: sk-or-v1-FAKE5e2b… # backup real key: sk-or-v1-FAKE5e2b…
db = real path: C:\Users\alice\…\inventory.db
author: real identity: Dana Whitfield real email: dana@acme-robotics.dev
The model's tool call
waiting for the answer…
- 404Unsupported endpoint
- 422Content it can't inspect
- 502Security model failed or overflowed
- 400Tool call rejected (error mode)
MasqAI protects the context; Daytona contains the actions
Laptop
agent loop + MasqAI
Daytona sandbox
fresh per run · deleted after
- Fresh sandbox per run, in about 1.3 s
- Every agent command runs inside it
- Outbound network blocked
- Unique planted secrets per run
- Deleted after, then a label sweep
Why rules and a model, together
| Seen in context | Rules | Security model | MasqAI, both together |
|---|---|---|---|
sk-or-v1-FAKE5e2b…an API key | masked | ||
DB_PASSWORD=hunter22xa password | masked | ||
Dana Whitfielda person's name | masked | ||
12 Elm St, Somervillewhere someone lives | replaced | ||
env | sorta dump of the machine | hidden | ||
sk-or-v1-a3f…9e1a partial key | linked to the full key | ||
andy in “handy”a false alarm | left alone | ||
“this key is public”a planted note | key stays masked |
Trust model
Trusted
- Gateway RAM
- The local security model
- Your agent's own tools
Untrusted
- The provider, reseller or relay
- Model output
- Files at rest
Out of scope
- A compromised host
- Your IP and TLS fingerprint
- Harmful commands that send nothing: use a sandbox
Hardening
- Rejected tool callsharmless echo or HTTP 400
- Admin token256 bits, RAM only
- Cross-origin refusedloopback Host only
- Sandboxed responsesstrict CSP, no framing
- Size caps64 MiB body, 8 MiB frame
- Masked errorsno request text echoed
- Bounded RAM state12 h idle, 50 sessions
- Frozen env nameskeys by reference only
What we give up
- Lossy rephrasinghidden lines are gone
- Imperfect detectionlower exposure, not zero
- Meaning still leakswhat you work on
- Prompt cache breakson relink, on purpose
- Local computea 7B model next to your work
- The check can be fooleda sandbox stays the second wall