Ship models. Not leaks.
Connect agents through the cloakit MCP server with grant-derived tool manifests — tokenize, search, mask and protect by default. Detokenize is never a default tool; single-use reveal grants let a human fetch values out-of-band, so plaintext never enters agent context, transcripts, or memory.
Why this buyer hurts.
Prompt leakage
PII in prompts becomes PII in logs, traces, and vendor systems — permanently.
Agent overreach
Agents with broad data access exfiltrate by design; every tool call needs a grant, not just a policy decision.
Memory you cannot wipe
Once plaintext reaches model context, traces, or vector stores, it cannot be un-seen.
Agents get tools, never data.
Each agent receives a scoped tool manifest derived from its grant — ungranted operations do not even appear as tools. Run trees attribute every call; monotonic scope shrink means sub-agents can never exceed their orchestrator.
Reveal-token flow: the agent requests, the human’s browser redeems a single-use 5-minute grant. Detokenize requires an explicit grant plus typed purpose.
The workflow, end to end.
Connect the agent
The agent talks to cloakit through the MCP server with a run-scoped token; the manifest lists only granted operations.
Substitute identifiers
Names, emails, account IDs, and secrets become opaque, referenceable tokens. Structure survives — identity does not.
Reveal out-of-band only
When a human must see a value, they fetch it directly in their browser via a single-use grant — the agent only ever sees that it was revealed.
Asked by teams like yours.
Do models train on tokens?
Features and labels keep their shape on token references; raw identifiers never enter training corpora.
What about retrieval context?
Known identifier fields in retrieved records are substituted before the model sees them — cloakit works on declared fields and JSON paths, not on discovering unknown PII in free text.
How does the reveal-token flow work?
The agent calls cloak_reveal; the vault mints a single-use, 5-minute grant bound to the vault, element, user session, and purpose. The user’s UI fetches the value directly — the agent gets a reference, never the value.
See it on your own workflow.
Bring one sensitive flow. We will map it to a vault schema live in 30 minutes.
Works with the agents you already run.
Point your assistant, copilot, or framework at the cloakit MCP server. Grants — not prompts — decide what each agent can touch.
Claude
Cursor
GitHub Copilot
LangChain
Windsurf
Hugging Face
Ollama
Google GeminiThird-party names and marks are property of their respective owners, listed for compatibility.
Useful models, blind to identities.
Prompts and tool calls pass a sanitize gateway; the model sees tokens, and originals resolve only under policy.
declared fields"] --> G["Sanitize gateway
substitute identifiers"] G --> M["Model
tokens only"] M --> Q{"Needs original?"} Q -- no --> D["Done"] Q -- yes --> POL{"Policy check
role · purpose · region"} POL -- allow --> R["Resolve + audit"] POL -- deny --> X["Denial + audit"]