Agenten stärken
Der eigene Befehl des Herausgebers. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
npx -y @bulkhead-ai/[email protected]Claude Code hat keinen Installationslink für einen lokalen Befehl. Kopieren Sie den Befehl unten und führen Sie ihn in einem Terminal aus.
claude mcp add bulkhead-ai-core -- npx -y @bulkhead-ai/core@0.9.1In einem Terminal ausführen.
{ "mcpServers": { "bulkhead-ai-core": { "command": "npx", "args": [ "-y", "@bulkhead-ai/[email protected]" ] } }}claude_desktop_config.json
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenVom Herausgeber
Cascading content protection for AI-powered development tools.
Bulkhead detects and redacts sensitive content -- PII, secrets, prompt injection, and system prompt leakage -- before it leaks through LLM-powered features. It runs as a VS Code extension, an HTTP REST server, or an MCP server for AI coding assistants.
Cascading content protection engine — PII detection, secret scanning, prompt injection defense
| Deployment | VS Code extension, HTTP REST server, MCP server, Docker |
| Detection | 154 secret patterns across 13 categories, 45+ PII entity types across 20+ countries, prompt injection, system prompt leakage, test data detection |
| Architecture | Three-layer cascading classifier (regex, BERT, LLM) |
| Policy | Named policies (strict, moderate), composable compliance overlays, risk assessment with classified issues |
| Tests | 185 tests including adversarial suite, policy system, and performance benchmarks |
Every time a developer uses an AI coding assistant, the IDE sends context to an LLM -- not just the active file, but adjacent tabs, terminal output, clipboard contents, and project-wide search results. That context routinely includes .env files with database credentials, test fixtures with real customer data, and config files with API keys.
This leakage happens at edit time, not commit time. It is continuous, invisible, and bypasses every existing control: git hooks don't see it, SAST doesn't scan it, WAFs don't intercept it. There is no diff, no PR, no audit trail. By the time a secret scanner catches something at commit, the AI assistant has already sent it to an LLM provider dozens of times.
Bulkhead sits between your editor and the AI, catching sensitive content before it leaves. Three detection layers trade speed for depth -- expensive inference only runs on the fraction of content that needs it:
flowchart LR
A["Input Text"] --> B["Layer 1: Regex\nsub-ms"]
B -->|"60-70% resolved"| C["Confirmed"]
B -->|"remaining"| D["Layer 2: BERT\n20-50ms"]
D -->|"~90% resolved"| C
D -->|"~5-10% ambiguous"| E["Layer 3: LLM\n500ms-2s"]
E --> C
Every detection carries provenance -- which layer flagged it, at what confidence, and why. Your compliance team gets "regex matched SSN with Luhn validation" or "BERT flagged a name at 0.92 confidence," not "the AI said so."
Same engine, same 154 secret patterns, same 45+ PII types, same policies. Different transports.
For the full business case with industry scenarios, architecture walkthroughs, and comparison with alternatives, see Why Do We Need Content Protection for AI Dev Tools?
The core innovation is the cascading classifier -- three detection layers that progressively trade speed for depth, so expensive inference only runs on the small fraction of content that actually needs it. Regex handles the bulk (sub-millisecond, every keystroke). A BERT model resolves contextual entities like names and locations. An LLM disambiguates the genuinely hard cases ("Is 'Jordan' a person or a country?"). Each detection carries full provenance -- which layer flagged it, at what confidence, and why.
The detection patterns themselves are ported from established open-source projects (see Attribution). Bulkhead's contribution is the cascade architecture, the BERT worker thread integration, the LLM disambiguation layer, the multi-platform server architecture, and the deduplication logic that ties it all together.
Every time you use an AI coding assistant, your editor content gets sent to an LLM. That content can include:
Bulkhead sits between your code and the AI, catching sensitive content before it leaves.
npm install @bulkhead-ai/core
Also available as @floatingsidewal/bulkhead-core via GitHub Packages and as a Docker container at ghcr.io/floatingsidewal/bulkhead.
import { createEngine, getPolicy } from "@bulkhead-ai/core";
const engine = createEngine({
enabled: true, debounceMs: 500,
guards: { pii: { enabled: true }, secret: { enabled: true }, injection: { enabled: true }, contentSafety: { enabled: false } },
cascade: { escalationThreshold: 0.75, contextSentences: 3, modelEnabled: false, modelId: "Xenova/bert-base-NER" },
policy: "strict",
});
const policy = getPolicy("strict");
const { risk } = await engine.policyScan("My SSN is 123-45-6789", policy);
console.log(risk.level); // "high"
console.log(risk.issues); // [{ category: "pii", entityType: "US_SSN", severity: "high", isTestData: true }]
For JSON-compatible payloads, use the document API so Bulkhead owns traversal, overlap handling, date treatment, reconstruction, and residual validation:
import { sanitizeDocument } from "@bulkhead-ai/core";
const result = await sanitizeDocument(payload, "eval", {
localizedDateOrder: "reject-ambiguous",
});
if (!result.metadata.postTreatment.safe ||
!result.metadata.postTreatment.structurallyValid) {
throw new Error("Sanitization boundary rejected output");
}
send(JSON.stringify(result.value));
See the How-To Guide for comprehensive examples including medical record scanning, bulk data redaction, and custom policies.
bulkhead/
packages/
core/ @bulkhead-ai/core Detection engine, guards, cascade, policies
vscode/ bulkhead VS Code extension
server/ @bulkhead-ai/server HTTP REST server + MCP server
docs/ Guides: architecture, API, policies, patterns
Dockerfile Multi-stage build (HTTP + MCP modes)
docker-compose.yml HTTP and MCP service definitions
Bulkhead uses the cascading classifier -- three detection layers that trade off speed against depth:
Each detection carries provenance -- which layer flagged it, at what confidence, and whether it's confirmed or needs review.
Patterns ported from Microsoft Presidio with checksum validation (Luhn, IBAN mod-97, Verhoeff) and context-aware scoring.
Patterns sourced from HAI-Guardrails, GitLeaks, and public provider documentation.
16 regex patterns + heuristic similarity matching against known attack phrases. Catches: "ignore previous instructions", role-play attacks, DAN mode, jailbreak attempts.
7 regex patterns + heuristic matching. Catches: "reveal your system prompt", "repeat everything above", extraction techniques.
git clone https://github.com/your-org/bulkhead.git
cd bulkhead
npm install
npm run build
bulkhead/ folder in VS CodeF5 to launch the Extension Development HostBulkhead: Scan File -- regex scanBulkhead: Deep Scan -- regex + BERT + LLM cascade# Development
cd packages/server && npm run dev
# Production
npm run build && node packages/server/dist/main.js
# With API key authentication
BULKHEAD_API_KEY=my-secret-key node packages/server/dist/main.js
# Scan text
curl -X POST http://localhost:3000/v1/scan \
-H "Content-Type: application/json" \
-d '{"text": "My SSN is 123-45-6789"}'
# Scan and redact
curl -X POST http://localhost:3000/v1/redact \
-H "Content-Type: application/json" \
-d '{"text": "My SSN is 123-45-6789"}'
Add to .mcp.json in your project root:
{
"mcpServers": {
"bulkhead": {
"command": "npx",
"args": ["tsx", "packages/server/src/mcp/index.ts"]
}
}
}
Add to .github/copilot/mcp.json:
{
"mcpServers": {
"bulkhead": {
"command": "npx",
"args": ["tsx", "packages/server/src/mcp/index.ts"]
}
}
}
# HTTP server on port 3000
docker compose up bulkhead
# MCP server on stdio
docker compose run --rm -i bulkhead-mcp
import { GuardrailsEngine, PiiGuard, SecretGuard } from "@bulkhead-ai/core";
const engine = new GuardrailsEngine();
engine.addGuard(new PiiGuard());
engine.addGuard(new SecretGuard());
const results = await engine.analyze("Email: [email protected], Key: AKIAIOSFODNN7EXAMPLE");
// results[0].detections -> [{ entityType: "EMAIL_ADDRESS", source: "regex", disposition: "confirmed", ... }]
// results[1].detections -> [{ entityType: "AWS_ACCESS_KEY", source: "regex", disposition: "confirmed", ... }]
npm test # Run all 185 tests
npm run test:watch # Watch mode (core package)
npm run lint # Type-check all packages
The test suite includes an adversarial test suite covering evasion techniques, false positive resistance, mixed-threat documents, performance benchmarks with ASCII bar charts, and a "kitchen sink" document that triggers all threat types simultaneously.
Bulkhead derives detection patterns and guard architecture from two open-source projects. The cascading classifier, BERT integration, LLM disambiguation, VS Code extension, server architecture, and deduplication logic are independently developed. See ATTRIBUTION.md for full details and NOTICES for original copyright notices.
See CONTRIBUTING.md for guidelines.
Cascading content protection engine — PII detection, secret scanning, prompt injection defense
{ "mcpServers": { "bulkhead-ai-core": { "command": "npx", "args": [ "-y", "@bulkhead-ai/[email protected]" ] } }}Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
@bulkhead Ai/core läuft lokal über stdio.
Zuletzt geprüft: 2026-11-14. Cascading content protection engine — PII detection, secret scanning, prompt injection defense