Waqi — an MCP proxy that redacts PII before the model sees it

Waqi is a hosted MCP proxy that connects AI assistants (Claude, ChatGPT, and any MCP-capable client) to business tools — Stripe, Xero, Zoho, Slack, Jira, Asana, Monday, Notion, Shopify, Twilio and more — with PII redaction applied to every tool response, mid-pipeline, before it reaches the model.

Nobody types card numbers at an AI. The leak happens when the AI reads: ask "how much did we make this week?" and the charge list that comes back carries customer emails, card metadata, and phone numbers straight into a third-party context window. Waqi sits between your MCP client and your tools and strips that out — while the answer still comes back intact.

Try it right now, no signup: the live demo runs the real detection ruleset in your browser. Nothing you paste leaves the page — check the network tab.

How it works

flowchart LR
    A[Claude / ChatGPT /\nany MCP client] -->|one MCP URL\nper team member| B[Waqi proxy]
    B --> C[Stripe · Xero · Zoho · Slack\nJira · Asana · Monday · Notion …]
    C -->|raw response\nwith PII| B
    B -->|"detect → redact →\npseudonymise → log"| A

Every tool response goes through the same pipeline:

• Structured detection — cards (Luhn-validated), IBANs (mod-97, including spaced print format), emails, phone numbers, government IDs, bank details, secrets, IP addresses. Checksum-gated so order references that merely look like card numbers don't get shredded.

• Deterministic pseudonyms — the same value always maps to the same placeholder ([EMAIL:f4b1]), so the model can still reason "the same customer failed three times" without ever seeing who. Salted HMAC; not reversible.

• Secrets are the exception — API keys and tokens are hard-redacted ([REDACTED:SECRET]), never pseudonymised.

• Field-level walls — any listed free-text field (Slack message text, Jira summaries, …) can be hidden from the model entirely, one click per field.

• Per-call audit log — who asked, which tool, what was stripped. The evidence trail for "what exactly did the model see?"

Honest scope note: structured detection catches identifiers with recognisable shape. Names written in prose are a different problem — that's local NER on our roadmap, and deliberately never a cloud LLM call (sending your data to a model to protect it from models would be absurd).

Related MCP server: Bellink MCP Server

Quickstart

Waqi is hosted — there's no server for you to run. Each team member gets a private MCP URL from the dashboard.

Claude (claude.ai or desktop): Settings → Connectors → Add custom connector → paste your Waqi URL. Done.

ChatGPT (paid plans): Settings → Connectors → enable Developer mode → Create → paste your Waqi URL, authentication "None" (the link carries your access).

stdio-only clients: this repo ships a thin bridge:

npx waqi-mcp https://waqi.bilazann.com/api/mcp/<your-token>

or in an MCP client config:

{
  "mcpServers": {
    "waqi": {
      "command": "npx",
      "args": ["waqi-mcp", "https://waqi.bilazann.com/api/mcp/<your-token>"]
    }
  }
}

Per-connector setup guides (which read-only key or OAuth scopes each tool needs): bilazann.com/waqi/docs.

Security model

• Read-only by design. Connections use read-only OAuth scopes (Xero, Zoho, Slack, Jira, Asana, Monday) or restricted read-only keys (Stripe, Shopify, Twilio). Waqi cannot move money, edit records, or send messages.

• Credentials are encrypted with AES-256-GCM before storage and decrypted only for the moment of your own request. Your passwords never touch Waqi — OAuth happens on the provider's site.

• Your MCP URL is a bearer secret. Treat it like a password; regenerate it from the dashboard any time (old link dies instantly, only for you, not your teammates).

• Full details: security & trust · DPA · SECURITY.md

What's in this repo

The stdio bridge (bin/waqi-mcp.js), setup docs, and this README. The hosted service — connectors, detection engine, audit pipeline — is closed source; the in-browser demo runs the real structured ruleset so you can verify detection behaviour yourself.

Pricing

From £99/month, VAT included, per team — bilazann.com/waqi. The demo is free forever.

Feedback

Issues and questions welcome here, or info@bilazann.com. Especially interested in: detection false positives/negatives (the demo is the fastest way to find them) and which connectors you'd want next.