接入你的智能体
发布者自己的命令。不是 PlugMCP 端点。
用我们的密钥与日志托管一份副本。
npx -y @bulkhead-ai/[email protected]Claude Code 没有针对本地命令的安装链接。复制下方命令并在终端中运行。
claude mcp add bulkhead-ai-core -- npx -y @bulkhead-ai/core@0.9.1在终端中运行。
{ "mcpServers": { "bulkhead-ai-core": { "command": "npx", "args": [ "-y", "@bulkhead-ai/[email protected]" ] } }}claude_desktop_config.json
远程 URL 还是本机命令？ 两种安装方式的区别
来自发布者
Cascading content protection for AI-powered development tools.
Bulkhead detects and redacts sensitive content -- PII, secrets, prompt injection, and system prompt leakage -- before it leaks through LLM-powered features. It runs as a VS Code extension, an HTTP REST server, or an MCP server for AI coding assistants.
Cascading content protection engine — PII detection, secret scanning, prompt injection defense
| Deployment | VS Code extension, HTTP REST server, MCP server, Docker |
| Detection | 154 secret patterns across 13 categories, 45+ PII entity types across 20+ countries, prompt injection, system prompt leakage, test data detection |
| Architecture | Three-layer cascading classifier (regex, BERT, LLM) |
| Policy | Named policies (strict, moderate), composable compliance overlays, risk assessment with classified issues |
| Tests | 185 tests including adversarial suite, policy system, and performance benchmarks |
Every time a developer uses an AI coding assistant, the IDE sends context to an LLM -- not just the active file, but adjacent tabs, terminal output, clipboard contents, and project-wide search results. That context routinely includes .env files with database credentials, test fixtures with real customer data, and config files with API keys.
This leakage happens at edit time, not commit time. It is continuous, invisible, and bypasses every existing control: git hooks don't see it, SAST doesn't scan it, WAFs don't intercept it. There is no diff, no PR, no audit trail. By the time a secret scanner catches something at commit, the AI assistant has already sent it to an LLM provider dozens of times.
Bulkhead sits between your editor and the AI, catching sensitive content before it leaves. Three detection layers trade speed for depth -- expensive inference only runs on the fraction of content that needs it:
flowchart LR
A["Input Text"] --> B["Layer 1: Regex\nsub-ms"]
B -->|"60-70% resolved"| C["Confirmed"]
B -->|"remaining"| D["Layer 2: BERT\n20-50ms"]
D -->|"~90% resolved"| C
D -->|"~5-10% ambiguous"| E["Layer 3: LLM\n500ms-2s"]
E --> C
Every detection carries provenance -- which layer flagged it, at what confidence, and why. Your compliance team gets "regex matched SSN with Luhn validation" or "BERT flagged a name at 0.92 confidence," not "the AI said so."
Same engine, same 154 secret patterns, same 45+ PII types, same policies. Different transports.
For the full business case with industry scenarios, architecture walkthroughs, and comparison with alternatives, see Why Do We Need Content Protection for AI Dev Tools?
The core innovation is the cascading classifier -- three detection layers that progressively trade speed for depth, so expensive inference only runs on the small fraction of content that actually needs it. Regex handles the bulk (sub-millisecond, every keystroke). A BERT model resolves contextual entities like names and locations. An LLM disambiguates the genuinely hard cases ("Is 'Jordan' a person or a country?"). Each detection carries full provenance -- which layer flagged it, at what confidence, and why.
The detection patterns themselves are ported from established open-source projects (see Attribution). Bulkhead's contribution is the cascade architecture, the BERT worker thread integration, the LLM disambiguation layer, the multi-platform server architecture, and the deduplication logic that ties it all together.
Every time you use an AI coding assistant, your editor content gets sent to an LLM. That content can include:
Bulkhead sits between your code and the AI, catching sensitive content before it leaves.
npm install @bulkhead-ai/core
Also available as @floatingsidewal/bulkhead-core via GitHub Packages and as a Docker container at ghcr.io/floatingsidewal/bulkhead.
import { createEngine, getPolicy } from "@bulkhead-ai/core";
const engine = createEngine({
enabled: true, debounceMs: 500,
guards: { pii: { enabled: true }, secret: { enabled: true }, injection: { enabled: true }, contentSafety: { enabled: false } },
cascade: { escalationThreshold: 0.75, contextSentences: 3, modelEnabled: false, modelId: "Xenova/bert-base-NER" },
policy: "strict",
});
const policy = getPolicy("strict");
const { risk } = await engine.policyScan("My SSN is 123-45-6789", policy);
console.log(risk.level); // "high"
console.log(risk.issues); // [{ category: "pii", entityType: "US_SSN", severity: "high", isTestData: true }]
For JSON-compatible payloads, use the document API so Bulkhead owns traversal, overlap handling, date treatment, reconstruction, and residual validation:
import { sanitizeDocument } from "@bulkhead-ai/core";
const result = await sanitizeDocument(payload, "eval", {
localizedDateOrder: "reject-ambiguous",
});
if (!result.metadata.postTreatment.safe ||
!result.metadata.postTreatment.structurallyValid) {
throw new Error("Sanitization boundary rejected output");
}
send(JSON.stringify(result.value));
See the How-To Guide for comprehensive examples including medical record scanning, bulk data redaction, and custom policies.
bulkhead/
packages/
core/ @bulkhead-ai/core Detection engine, guards, cascade, policies
vscode/ bulkhead VS Code extension
server/ @bulkhead-ai/server HTTP REST server + MCP server
docs/ Guides: architecture, API, policies, patterns
Dockerfile Multi-stage build (HTTP + MCP modes)
docker-compose.yml HTTP and MCP service definitions
Bulkhead uses the cascading classifier -- three detection layers that trade off speed against depth:
Each detection carries provenance -- which layer flagged it, at what confidence, and whether it's confirmed or needs review.
Patterns ported from Microsoft Presidio with checksum validation (Luhn, IBAN mod-97, Verhoeff) and context-aware scoring.
Patterns sourced from HAI-Guardrails, GitLeaks, and public provider documentation.
16 regex patterns + heuristic similarity matching against known attack phrases. Catches: "ignore previous instructions", role-play attacks, DAN mode, jailbreak attempts.
7 regex patterns + heuristic matching. Catches: "reveal your system prompt", "repeat everything above", extraction techniques.
git clone https://github.com/your-org/bulkhead.git
cd bulkhead
npm install
npm run build
bulkhead/ folder in VS CodeF5 to launch the Extension Development HostBulkhead: Scan File -- regex scanBulkhead: Deep Scan -- regex + BERT + LLM cascade# Development
cd packages/server && npm run dev
# Production
npm run build && node packages/server/dist/main.js
# With API key authentication
BULKHEAD_API_KEY=my-secret-key node packages/server/dist/main.js
# Scan text
curl -X POST http://localhost:3000/v1/scan \
-H "Content-Type: application/json" \
-d '{"text": "My SSN is 123-45-6789"}'
# Scan and redact
curl -X POST http://localhost:3000/v1/redact \
-H "Content-Type: application/json" \
-d '{"text": "My SSN is 123-45-6789"}'
Add to .mcp.json in your project root:
{
"mcpServers": {
"bulkhead": {
"command": "npx",
"args": ["tsx", "packages/server/src/mcp/index.ts"]
}
}
}
Add to .github/copilot/mcp.json:
{
"mcpServers": {
"bulkhead": {
"command": "npx",
"args": ["tsx", "packages/server/src/mcp/index.ts"]
}
}
}
# HTTP server on port 3000
docker compose up bulkhead
# MCP server on stdio
docker compose run --rm -i bulkhead-mcp
import { GuardrailsEngine, PiiGuard, SecretGuard } from "@bulkhead-ai/core";
const engine = new GuardrailsEngine();
engine.addGuard(new PiiGuard());
engine.addGuard(new SecretGuard());
const results = await engine.analyze("Email: [email protected], Key: AKIAIOSFODNN7EXAMPLE");
// results[0].detections -> [{ entityType: "EMAIL_ADDRESS", source: "regex", disposition: "confirmed", ... }]
// results[1].detections -> [{ entityType: "AWS_ACCESS_KEY", source: "regex", disposition: "confirmed", ... }]
npm test # Run all 185 tests
npm run test:watch # Watch mode (core package)
npm run lint # Type-check all packages
The test suite includes an adversarial test suite covering evasion techniques, false positive resistance, mixed-threat documents, performance benchmarks with ASCII bar charts, and a "kitchen sink" document that triggers all threat types simultaneously.
Bulkhead derives detection patterns and guard architecture from two open-source projects. The cascading classifier, BERT integration, LLM disambiguation, VS Code extension, server architecture, and deduplication logic are independently developed. See ATTRIBUTION.md for full details and NOTICES for original copyright notices.
See CONTRIBUTING.md for guidelines.
Cascading content protection engine — PII detection, secret scanning, prompt injection defense
{ "mcpServers": { "bulkhead-ai-core": { "command": "npx", "args": [ "-y", "@bulkhead-ai/[email protected]" ] } }}工具
暂无工具列表。远程服务器在首次健康检查后会获得工具列表。
常见问题
在本页复制适用于 Cursor、Claude Desktop、Claude Code 或 VS Code 的 stdio 配置。它使用发布者的安装方式，而不是 PlugMCP 代理。
此记录未列出必需的环境变量。
@bulkhead Ai/core 通过 stdio 在本地运行。
上次检查时间：2026-11-15。 Cascading content protection engine — PII detection, secret scanning, prompt injection defense