How does ScrubVault protect my data when using cloud-based AI?

ScrubVault acts as a local privacy airgap that automatically detects and replaces PII (like emails and SSNs) with secure tokens before data leaves your machine, ensuring cloud LLMs never see your sensitive information.

Does this skill work with tools like Claude Desktop or Cursor?

Yes, this skill is fully compatible with the Model Context Protocol (MCP) and can be used immediately within Claude Desktop, Cursor, and Cline to redact prompts in real-time.

Does my sensitive data ever leave my local environment for processing?

No, ScrubVault is a zero-dependency Python package that performs all masking in local RAM, meaning your sensitive session mappings are never stored on a server or sent over the network.

What is included in the ScrubVault package?

The skill includes the core Python library, a pre-configured MCP server for easy integration, and documentation for implementing the mask/unmask workflow in your own custom agents.

What specific types of PII can ScrubVault detect and mask?

Standard identifiers like emails, IP addresses, IBANs, SSNs, credit card numbers, and phone numbers are supported out-of-the-box using high-performance, local pattern detection.

Why should I use this instead of just telling the LLM to 'ignore PII' in the system prompt?

Manual prompting is unreliable and prone to "hallucinating" private data; ScrubVault provides a programmatic, technical guarantee that PII is stripped at the application layer before the request is even sent.

ScrubVault - Zero-Data-Leak PII Masking

Example session with this skill installed

I need to analyze this log entry for a database error, but it has user emails and IPs: 'Error at 192.168.1.45 for user dev-admin@company.com while processing IBAN DE89370400440532013000.'

Read your context and instructions
Compiled the scrubvault - zero-data-leak

I have intercepted the sensitive data and replaced it with deterministic tokens. The masked version has been prepared for the LLM, and the original values are held securely in local memory.

Privacy Redaction Summary

Entity Type	Original Value (Local Only)	Token (Sent to Cloud)
IP Address	192.168.1.45	`{{IP_1}}`
Email	dev-admin@company.com	`{{EMAIL_1}}`
IBAN	DE89370400440532013000	`{{IBAN_1}}`

Masked Prompt for LLM:
"Error at {{IP_1}} for user {{EMAIL_1}} while processing IBAN {{IBAN_1}}."

When the LLM provides the fix, I will automatically swap {{IP_1}} back to 192.168.1.45 before displaying the result to you.

Next steps

Review the masked prompt above to ensure no custom secrets remain.
Proceed with the LLM analysis using the redacted text.
Observe the final output where the local vault restores the original identifiers.

Connects securely to your tools. The creator never sees your data.

About this skill

Sending PII to cloud LLMs violates compliance and risks data breaches. ScrubVault acts as a local privacy airgap, ensuring sensitive data never leaves your infrastructure. It intercepts raw text in local RAM, replaces sensitive entities with deterministic tokens, and restores them only after the LLM responds.

What it does

PII Detection identifies emails, IBANs, IP addresses, credit card numbers, SSNs, and phone numbers.
Local Masking replaces sensitive data with deterministic tokens like {{EMAIL_1}} in local memory.
Zero-Leak Transmission ensures only redacted prompts are sent to external cloud APIs.
Deterministic Unmasking restores original values into the LLM response based on the local session mapping.
MCP Integration provides a standard interface for Claude Desktop, Cursor, and other MCP-compatible clients.

How it works

Initialize the ScrubVault instance or start the MCP server locally.
Mask raw input containing sensitive data to generate a redacted string and a session ID.
Process the masked string through your preferred cloud LLM.
Unmask the LLM's response using the session ID to restore original PII for the end user.

Frameworks & tools

This is a pure-Python package with zero third-party dependencies. It supports the Model Context Protocol (MCP) and integrates with Claude Desktop, Cursor, and Cline.

Why this beats prompting it yourself

System prompts for redaction often fail or "leak" data under pressure. ScrubVault handles masking programmatically in local RAM, providing a technical guarantee that PII never reaches the network layer.

Use cases

Log Analysis Redacting server IPs and credentials before debugging with an AI.
Customer Support Processing support tickets containing emails and bank details for summarization.
Financial Auditing Analyzing invoices and IBANs while maintaining GDPR and HIPAA compliance.
Database Refactoring Masking user records during schema migrations or query optimization.

Known limitations

Mappings are stored in-memory only and are lost if the local process restarts. The skill relies on pattern-based detection for standard PII formats.

Links & Resources

GitHub Repository: https://github.com/tastenkasperle/scrub-vault
PyPI Package: https://pypi.org/project/scrub-vault/

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Free forever

No account required to browse

ScrubVault - Zero-Data-Leak PII Masking