askalf

Cordon — AI skill for Claude Code

AI community

PII-redacting LLM compliance gateway — own your prompts; PII never leaves your perimeter.

How to install Cordon

This entry records only its repository, not the path inside it, so there is no exact command to give. Open askalf/cordon and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Cordon does

PII-redacting LLM compliance gateway — own your prompts; PII never leaves your perimeter.

Alternatives in AI

TokenTracker — Local-first AI token usage & cost tracker for 31 coding tools incl 1.4k ★
DontFeedTheAI — Transparent anonymization proxy for AI-assisted pentesting 654 ★
Llmio — LLM API load-balancing gateway 274 ★

README

cordon

[![ci](https://github.com/askalf/cordon/actions/workflows/ci.yml/badge.svg)](https://github.com/askalf/cordon/actions/workflows/ci.yml) [![codeql](https://github.com/askalf/cordon/actions/workflows/codeql.yml/badge.svg)](https://github.com/askalf/cordon/actions/workflows/codeql.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/askalf/cordon/badge)](https://scorecard.dev/viewer/?uri=github.com/askalf/cordon) [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)

own your prompts — PII never leaves your perimeter.

A drop-in **LLM compliance gateway**. Point any OpenAI- or Anthropic-compatible client at cordon and raw PII / PHI / PCI / secrets are stripped or tokenized **before** the request reaches the model. In reversible mode the real values are restored in the model's reply, so the answer stays usable while the provider only ever sees placeholders. Self-hosted — your data never leaves your network.

client ──▶ cordon ──▶ OpenAI / Anthropic
            │  1. detect PII            (deterministic spans)
            │  2. redact / tokenize     (ephemeral per-request vault)
            │  3. forward de-identified body upstream   ← model never sees raw PII
            │  4. restore real values in the response   (reversible mode, incl. streaming)
            └─ audit: hash-chained log of counts/types (never values), fail-closed

Why

The model — and everything downstream of it (provider logs, retention, subprocessors) — never sees the raw value. cordon sits between your app and the provider, so no client code changes: you only change the base URL. It is **fail-closed** — if detection errors, the request is **blocked**, never forwarded with PII intact.