![\"Shroud\"](\"logo.png\")
\n\n \n
\n Privacy and infrastructure protection for AI agents.
\n Prevents sensitive data from reaching LLMs — PII, network topology, credentials, OT/SCADA identifiers, and internal infrastructure details are replaced with deterministic fakes before any API call leaves the process. Responses are deobfuscated transparently so users and tools see real values.\n
\n Install ·\n Why Shroud ·\n Configure ·\n Integrations ·\n APP Protocol ·\n Changelog\n
\n\n> Apache 2.0 · Zero runtime dependencies · Anthropic + OpenAI + Google supported · Prompt-caching friendly · Works with [OpenClaw](https://openclaw.ai), [Hermes Agent](https://github.com/nousresearch/hermes-agent), or any agent via [APP](#agent-privacy-protocol-app)\n\n**Detailed integration reference:** [`docs/integrations.md`](docs/integrations.md)\n\n---\n\n## Why Shroud\n\nFrontier LLMs are transformative for infrastructure operations — network troubleshooting, incident response, change planning, compliance audits. But every prompt you send is an API call to a third party. Without protection, you're transmitting:\n\n- **Network topology** — subnets, VLANs, BGP ASNs, OSPF areas, interface descriptions, ACL names, route-maps\n- **Device identities** — hostnames, management IPs, SNMP communities, firmware versions\n- **Credentials** — API keys, connection strings, PSKs, enable secrets, TACACS/RADIUS shared keys\n- **OT/SCADA identifiers** — Modbus addresses, OPC-UA endpoints, IEC 61850 IED names, historian tags, BACnet device IDs\n- **Customer PII** — emails, phone numbers, national IDs, credit cards, physical addresses\n- **Internal URLs** — wiki pages, Jira tickets, admin portals, API endpoints\n\nShroud sits between your agent and the LLM. It detects all of the above (130+ entity types), replaces each with a deterministic format-preserving fake, and reverses the mapping on the way back. The LLM reasons over realistic-looking data. Your real infrastructure stays private.\n\n### Who needs this\n\n| Sector | What leaks without Shroud |\n|--------|--------------------------|\n| **Telecoms & ISPs** | MPLS topologies, BGP peering, customer CPE configs, circuit IDs |\n| **Energy & utilities** | SCADA/ICS endpoints, substation IPs, OPC-UA tags, DNP3 addresses |\n| **Transport & aviation** | ATC sector IDs, NAV frequencies, signalling network topology |\n| **Banking & finance** | Internal API endpoints, database connection strings, customer PII |\n| **Healthcare** | Patient identifiers, internal system hostnames, API credentials |\n| **Government & defence** | Classified network segments, device inventories, operational IPs |\n| **Any enterprise** | Internal URLs, credentials, employee PII, customer data |\n\n### Regulatory context\n\nIf you process personal data of EU residents, **GDPR Article 32** requires \"appropriate technical measures\" to protect it. Sending unredacted PII to a third-party LLM API is a data transfer — Shroud ensures detected PII never leaves your process. Similar obligations exist under CCPA, HIPAA, PCI-DSS, and sector-specific regulations (NIS2, NERC CIP, IEC 62443).\n\nShroud does not guarantee compliance — regex-based detection has limitations (see [SECURITY.md](SECURITY.md)). But it is a meaningful technical control that reduces exposure.\n\n---\n\n## What it does\n\n1. **Detects** 130+ entity types: emails, IPs, phones, API keys, hostnames, SNMP communities, BGP ASNs, credit cards, SSNs, file paths, URLs, person/org/location names, VLANs, route-maps, ACLs, OSPF IDs, IBANs, JWTs, PEM certs, GPS coordinates, ICS/SCADA identifiers, dates of birth, medical record numbers (MRN/NPI/DEA), bank accounts (routing/sort code/SWIFT), tax IDs (EIN/UTR), passport numbers, driver's licenses, court case/docket/patent numbers, cryptocurrency addresses (Ethereum/Bitcoin), AWS ARNs, vendor-specific secrets (Cisco, Juniper, Palo Alto, Check Point, Fortinet, F5, Arista), and custom regex patterns.\n2. **Replaces** each value with a deterministic fake (same input + key = same fake every time). Fakes are format-preserving: IPv4 stays in CGNAT range (`100.64.0.0/10`), IPv6 uses ULA range (`fd00::/8`), emails keep `@domain` structure, credit cards pass Luhn, etc.\n3. **Passes through public URLs** — external URLs (arxiv.org, docs.stripe.com, etc.) are not obfuscated. Shroud resolves FQDNs via DNS: public IPs pass through, RFC 1918 / NXDOMAIN / internal IPs are obfuscated. Well-known platforms (GitHub, YouTube, Wikipedia, etc.) are always passed through.\n4. **Deobfuscates** LLM responses and tool parameters so the user sees real values and tools receive real arguments.\n5. **Audit logs** every event with counts, categories, char deltas, and optional proof hashes — never logging raw sensitive values.\n6. **Preserves prompt caching.** Obfuscation is deterministic — same input + same key = same output every turn. The system prompt prefix stays identical across turns, so provider-side prompt caching (Anthropic, OpenAI, Bedrock) works normally. No cache-busting, no extra token costs.\n\n### Hook lifecycle\n\n| Hook | Direction | What happens |\n|------|-----------|-------------|\n| `globalThis.fetch` intercept | User → LLM | Obfuscate all outbound LLM API requests; deobfuscate SSE responses per content block |\n| `before_prompt_build` | User → LLM | Warm DNS cache for URL classification; pre-seed mapping store |\n| `before_message_write` | Any → History | Deobfuscate assistant messages for transcript; re-obfuscate on next turn |\n| `before_tool_call` | LLM → Tool | Deobfuscate tool parameters + track tool chain depth |\n| `tool_result_persist` | Tool → History | Obfuscate tool results before storing |\n| `message_sending` | Agent → User | Deobfuscate outbound messages (backup — fetch intercept handles primary deob) |\n| `globalThis.__shroudStreamDeobfuscate` | LLM → Agent | Streaming event deobfuscation hook |\n| `globalThis.__shroudDeobfuscate` | Agent → Channel | Global deobfuscation hook — called by OpenClaw before ANY channel send |\n\n> **How it works:** Shroud intercepts ALL outbound LLM API calls (Anthropic, OpenAI, Google, any provider) at the `fetch` level and obfuscates detected entities in every message — including assistant history, Slack `