Agent PII Redactor cleans prompts, support transcripts, incident notes and LLM logs before they leave a private workspace. It detects common personal data and high-risk tokens locally, replaces them with stable placeholders, and writes a JSON report that an operator can audit.
This pack is for teams that already use LLMs in support, ops, product research or engineering triage and need a repeatable pre-flight sanitizer. It does not claim perfect legal compliance, identity proofing or DLP coverage. It is a practical guardrail: deterministic first, LLM review optional.
What It Catches
- Email addresses
- Phone-like numbers
- US SSN patterns
- Luhn-valid payment cards
- Bearer tokens and API-key-shaped secrets
- Private/local IPv4 addresses
- 12-word recovery-phrase-shaped text
Quick Start
cd agent-pii-redactor-v1
python3 agent.py --help
python3 agent.py init-sample --dir examples
python3 agent.py redact --deterministic \
--input examples/sample_prompt.txt \
--policy examples/policy.example.json \
--out out/redacted.json
python3 agent.py status --report out/redacted.json
Install on a Debian or Ubuntu VM:
sudo bash install.sh
Run without installing a service:
bash install.sh --no-service
venv/bin/python agent.py run --once --deterministic
How It Works
input prompt/log
|
v
+-------------------+
| deterministic scan |
+-------------------+
|
v
+-------------------+ optional BYO-LLM
| redaction engine |----> review redacted report only
+-------------------+
|
v
JSON report + redacted_text
The optional LLM review uses your local Claude Code, Kimi Code or Codex CLI through llm_adapter.py. The LLM is never required and the raw input text is not sent to the LLM reviewer. Only the redacted preview and structured findings are passed along.
Outputs
The report contains:
summary: counts by detector kind and whether redaction was applied.redacted_text: safe text with placeholders such as[EMAIL_1].findings: kind, placeholder, offset and reason.llm_review: optional reviewer output or deterministic fallback status.
Customization
Edit examples/policy.example.json or pass --policy /path/to/policy.json.
{
"allowlist": ["example.org", "support@your-company.test"],
"disabled_kinds": []
}
Use the allowlist for values that are safe in your workflow. Disable a detector only when the downstream process accepts that risk.