# Waqi — an MCP proxy that redacts PII before the model sees it

Waqi is a hosted [MCP](https://modelcontextprotocol.io) proxy that connects AI assistants (Claude, ChatGPT, and any MCP-capable client) to business tools — Stripe, Xero, Zoho, Slack, Jira, Asana, Monday, Notion, Shopify, Twilio and more — with **PII redaction applied to every tool response, mid-pipeline, before it reaches the model**.

Nobody types card numbers at an AI. The leak happens when the AI *reads*: ask "how much did we make this week?" and the charge list that comes back carries customer emails, card metadata, and phone numbers straight into a third-party context window. Waqi sits between your MCP client and your tools and strips that out — while the answer still comes back intact.

**Try it right now, no signup:** the [live demo](https://bilazann.com/waqi/try) runs the real detection ruleset in your browser. Nothing you paste leaves the page — check the network tab.

## How it works

```mermaid
flowchart LR
    A[Claude / ChatGPT /\nany MCP client] -->|one MCP URL\nper team member| B[Waqi proxy]
    B --> C[Stripe · Xero · Zoho · Slack\nJira · Asana · Monday · Notion …]
    C -->|raw response\nwith PII| B
    B -->|"detect → redact →\npseudonymise → log"| A
```

Every tool response goes through the same pipeline:

- **Structured detection** — cards (Luhn-validated), IBANs (mod-97, including spaced print format), emails, phone numbers, government IDs, bank details, secrets, IP addresses. Checksum-gated so order references that merely *look* like card numbers don't get shredded.
- **Deterministic pseudonyms** — the same value always maps to the same placeholder (`[EMAIL:f4b1]`), so the model can still reason "the same customer failed three times" without ever seeing who. Salted HMAC; not reversible.
- **Secrets are the exception** — API keys and tokens are hard-redacted (`[REDACTED:SECRET]`), never pseudonymised.
- **Field-level walls** — any listed free-text field (Slack message text, Jira summaries, …) can be hidden from the model entirely, one click per field.
- **Per-call audit log** — who asked, which tool, what was stripped. The evidence trail for "what exactly did the model see?"

Honest scope note: structured detection catches identifiers with recognisable shape. Names written in prose are a different problem — that's local NER on our roadmap, and deliberately **never** a cloud LLM call (sending your data to a model to protect it from models would be absurd).

## Quickstart

Waqi is hosted — there's no server for you to run. Each team member gets a private MCP URL from the [dashboard](https://waqi.bilazann.com).

**Claude** (claude.ai or desktop): Settings → Connectors → Add custom connector → paste your Waqi URL. Done.

**ChatGPT** (paid plans): Settings → Connectors → enable Developer mode → Create → paste your Waqi URL, authentication "None" (the link carries your access).

**stdio-only clients**: this repo ships a thin bridge:

```bash
npx waqi-mcp https://waqi.bilazann.com/api/mcp/<your-token>
```

or in an MCP client config:

```json
{
  "mcpServers": {
    "waqi": {
      "command": "npx",
      "args": ["waqi-mcp", "https://waqi.bilazann.com/api/mcp/<your-token>"]
    }
  }
}
```

Per-connector setup guides (which read-only key or OAuth scopes each tool needs): [bilazann.com/waqi/docs](https://bilazann.com/waqi/docs).

## Security model

- **Read-only by design.** Connections use read-only OAuth scopes (Xero, Zoho, Slack, Jira, Asana, Monday) or restricted read-only keys (Stripe, Shopify, Twilio). Waqi cannot move money, edit records, or send messages.
- **Credentials** are encrypted with AES-256-GCM before storage and decrypted only for the moment of your own request. Your passwords never touch Waqi — OAuth happens on the provider's site.
- **Your MCP URL is a bearer secret.** Treat it like a password; regenerate it from the dashboard any time (old link dies instantly, only for you, not your teammates).
- Full details: [security & trust](https://bilazann.com/waqi#trust) · [DPA](https://bilazann.com/dpa) · [SECURITY.md](SECURITY.md)

## What's in this repo

The stdio bridge ([`bin/waqi-mcp.js`](bin/waqi-mcp.js)), setup docs, and this README. The hosted service — connectors, detection engine, audit pipeline — is closed source; the [in-browser demo](https://bilazann.com/waqi/try) runs the real structured ruleset so you can verify detection behaviour yourself.

## Pricing

From £99/month, VAT included, per team — [bilazann.com/waqi](https://bilazann.com/waqi). The demo is free forever.

## Feedback

Issues and questions welcome here, or [info@bilazann.com](mailto:info@bilazann.com). Especially interested in: detection false positives/negatives (the demo is the fastest way to find them) and which connectors you'd want next.