# Openmaskit > What your AI agent can't see won't leak - **Type:** MCP server - **Install:** `agentstack add mcp-maskitmcp-openmaskit` - **Verified:** Pending review - **Seller:** [MaskitMCP](https://agentstack.voostack.com/s/maskitmcp) - **Installs:** 0 - **Category:** [Integrations](https://agentstack.voostack.com/c/integrations) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [MaskitMCP](https://github.com/MaskitMCP) - **Source:** https://github.com/MaskitMCP/openmaskit - **Website:** https://www.openmaskit.com ## Install ```sh agentstack add mcp-maskitmcp-openmaskit ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About OpenMaskit™ Secure MCP proxy that keeps your secrets out of AI context windows ⚠️ Early stage — expect breaking changes. Read the docs → --- ## What it does AI coding assistants see everything your MCP tools return — production hostnames, API keys, customer emails. OpenMaskit sits between your AI and your MCP servers and replaces sensitive values with stable aliases (`host_1`, `email_2`, `api_key_1`) so the model never sees the real data. When the agent passes an alias back in a tool call, OpenMaskit swaps in the real value before forwarding. It also lets you block dangerous tool calls (guardrails), force safe defaults (injections), hide tools from agents, and install pre-configured servers from a marketplace. Your browser doesn't support inline video. Watch the masking demo. Mask sensitive fields before they reach the model. Your browser doesn't support inline video. Watch the guardrail demo. Block dangerous tool calls with guardrails. ``` AI Agent (Claude, Cursor, …) │ HTTP :9474/{server}/mcp ▼ OpenMaskit ── Dashboard :9473 │ stdio / HTTP ▼ Real MCP Server ``` ## Quick start OpenMaskit ships as a Python CLI. Requires Python 3.10+ — if you don't have it, the recommended installer (`uvx`) will fetch a compatible one for you. **With [uv](https://docs.astral.sh/uv/) (recommended):** ```bash # Install uv if you don't have it (one line, no Python prereq): curl -LsSf https://astral.sh/uv/install.sh | sh # Then run OpenMaskit: uvx openmaskit ``` `uvx` downloads a compatible Python (if needed), installs OpenMaskit in an isolated environment, and runs it — one command, no venv to manage. **With [pipx](https://pipx.pypa.io/) (alternative):** ```bash pipx install openmaskit openmaskit ``` `pipx` doesn't auto-fetch Pythons, so you'll need a 3.10+ interpreter available first. Then open the dashboard at **http://127.0.0.1:9473** — add servers from the marketplace, connect your AI agent with one click, and configure masking from the UI. ## Configuration OpenMaskit runs with no config at all — add servers from the dashboard. If you'd rather pre-declare servers, drop a `openmaskit.yaml` next to where you run it: ```yaml targets: time: upstream: transport: stdio command: uvx args: ["mcp-server-time"] rules: - tool_name: get_time field_path: timezone postgres: upstream: transport: stdio command: docker args: ["run", "-i", "--rm", "-e", "DATABASE_URI", "crystaldba/postgres-mcp"] env: DATABASE_URI: postgresql://user:pass@localhost:5432/mydb guardrails: - pattern: "DROP TABLE" message: "Destructive SQL blocked" datadog: upstream: transport: http url: https://mcp.datadoghq.eu/api/unstable/mcp-server/mcp headers: DD-API-KEY: replace-with-your-key DD-APPLICATION-KEY: replace-with-your-key # Optional overrides (defaults shown) web_port: 9473 mcp_port: 9474 # container_runtime: podman # auto-detected from docker/podman/nerdctl/finch ``` ### CLI ```bash openmaskit # use ./openmaskit.yaml (or start empty) openmaskit path/to/config.yaml # custom config openmaskit -c path/to/config.yaml # same, via flag openmaskit -w 9473 -m 9474 # override ports openmaskit -s ~/.openmaskit/store.db # override SQLite path openmaskit --version ``` ### Environment variables | Variable | Purpose | |---|---| | `OPENMASKIT_HOST` | Bind address (default `127.0.0.1`; Docker image uses `0.0.0.0`) | | `OPENMASKIT_ENCRYPTION_KEY` | Override the at-rest encryption key (otherwise read from `~/.openmaskit/.key`) | | `OPENMASKIT_LOG_FORMAT` | `text` (default) or `json` | | `OPENMASKIT_SHUTDOWN_TIMEOUT` | Graceful shutdown deadline in seconds (default 30) | | `OPENMASKIT_TRAFFIC_DB_PATH` | Path to the traffic audit database (default `~/.openmaskit/traffic.db`) | | `OPENMASKIT_TRAFFIC_MAX_ROWS` | Cap on stored audit rows (default 10000, oldest evicted first) | | `OPENMASKIT_ALLOWED_ORIGINS` | Comma-separated extra origins allowed to call `/api/*` | | `OPENMASKIT_MAX_REQUEST_BYTES` | Max HTTP request body size in bytes for the dashboard and MCP endpoints (default 1 MiB). Oversized requests get a 413. | | `OPENMASKIT_MAX_PARSE_BYTES` | Max length of an upstream text block (in chars) handed to the JSON / Python-repr parser (default 1 MiB). Oversized blocks skip parsing and fall through as plain text. | | `OPENMASKIT_DISABLE_MARKETPLACE` | Set to `1` to opt out of all calls to `api.maskitmcp.com` (catalog, server detail, version check). Custom servers continue to work. | ## Dashboard Everything is configurable from the UI at `http://127.0.0.1:9473`: - **Marketplace** — one-click install of pre-configured MCP servers (with OAuth where needed). - **Custom servers** — add stdio or HTTP servers at runtime; deactivate or delete without losing config. - **Tools** — browse schemas, try calls, hide tools from agents, set per-tool masking rules, regex output mappers, guardrails, and argument injections. - **Traffic** — encrypted, paginated audit log of recent calls. Connect an AI agent to a server with the "Connect Agent" button on its page — it generates the snippet for Claude Code, Cursor, VS Code, Windsurf, JetBrains, Codex, or OpenCode. > 💡 **Built-in tutorials.** Each configuration panel in the dashboard has a small help icon next to its title. Click it for a guided, step-by-step walkthrough of input masking, output mappers, guardrails, injections, and hiding tools — no docs to dig through. ## Highlights A few things worth knowing about: - **Container runtime auto-detection** — Marketplace servers shipped as `docker run …` automatically run on Podman, nerdctl, or Finch if that's what you have. No flag needed; override with `container_runtime` in `openmaskit.yaml` if you want to pin a specific one. - **Container lifecycle management** — When you deactivate, delete, or stop OpenMaskit, any containers it spawned are stopped with it. No orphaned containers sitting around using ports. - **Stable aliases across restarts** — `prod-db.internal.net` always becomes `host_1`, the same alias your agent saw last week. Aliases are persisted, so multi-turn conversations stay coherent. - **Encrypted traffic audit log** — Every tool call is recorded with its unmasked args and response, Fernet-encrypted at rest. Lazy-loaded from the UI on demand and capped at 10k rows by default. - **Two OAuth install paths today** — Marketplace servers can ship as **BYO** (paste your own `client_id`/`client_secret`, OpenMaskit runs the flow locally) or **DCR** (OpenMaskit registers a client with the provider automatically). DCR discovery follows the MCP authorization spec — it probes the MCP URL, reads the `WWW-Authenticate` challenge for the protected-resource metadata link, and follows it to the authorization server, which can live at a different host than the MCP endpoint (Supabase, Atlassian). The "Re-authorize" button on each server card runs a fresh flow when tokens expire. Setup guides for the BYO ones live at [openmaskit.com/connect](https://www.openmaskit.com/connect/). A third **hosted-broker** path (zero-setup, with the OAuth code exchange handled by `auth.maskitmcp.com`) is fully implemented but **currently disabled** while we work through every security aspect of it — we'd rather ship it later and right than early and questionable. - **Multi-tenant servers in the marketplace** — Catalog entries that need a user-supplied identifier in the upstream URL (Supabase `project_ref`, similar patterns for project- or workspace-scoped servers) declare a `meta.params` list; the install modal collects them and the install handler URL-encodes them onto the upstream URL. Discovery and DCR then run against the resolved URL so the authorization server sees the right resource identifier. - **API-key auth for non-OAuth HTTP servers** — Marketplace and custom HTTP servers can authenticate with static headers (Datadog `DD-API-KEY`, Stripe `Authorization: Bearer`, etc.). Header values are stored Fernet-encrypted alongside everything else. - **Hot add/remove servers** — Marketplace installs, custom server adds, deactivations, and deletes all happen live. No restart needed. - **Argument guardrails and injections** — Block `DROP TABLE` before it leaves your machine; silently inject `read_only: true` on every database call (if supported by the underlying MCP server). - **Field stripping** — Some fields shouldn't be aliased, they should just be gone. SSNs, credit cards — strip them from responses entirely. - **Localhost-safe by default** — `Origin` allow-listing, CSRF protection, and OAuth `state` validation are on out of the box, so a malicious webpage can't reach into your local OpenMaskit. ## Docker ```bash docker build -t openmaskit . docker run -p 9473:9473 -p 9474:9474 openmaskit ``` The container supports HTTP-based MCP servers. For stdio servers (`uvx`, `npx`), run OpenMaskit natively. ## Data safety Two files matter: - `~/.openmaskit/.key` — encrypts OAuth tokens, the traffic audit log, and stored server configs (env vars, HTTP headers, OAuth secrets). Worth backing up — without it, the stored credentials can't be decrypted and servers will need to be re-installed. - `~/.openmaskit/store.db` — masking rules, aliases, server configs. `~/.openmaskit/traffic.db` is the audit log; safe to drop. For production-style setups, hold the key in `OPENMASKIT_ENCRYPTION_KEY` instead of on disk. ## Telemetry OpenMaskit generates a random 25-character anonymous installation ID on first run, stored at `~/.openmaskit/.installation_id`. The ID, along with the running version (in `User-Agent`), is sent to `api.maskitmcp.com` on three endpoints: catalog browse, server detail, and version check. The backend uses it to validate that requests come from a real OpenMaskit install and to count active installations. **That's it.** No tool calls, masking rules, MCP server contents, response bodies, OAuth tokens, or usage events are sent. There's no account, no email, no IP-based linking. The backend is only contacted when the marketplace is used. **To opt out**, set `OPENMASKIT_DISABLE_MARKETPLACE=1`. Catalog browse and server detail return empty; custom HTTP/stdio servers continue to work normally. See [CHANGELOG.md](CHANGELOG.md) for upgrade notes between versions. ## Contributing Bug reports, feature requests, and pull requests are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, testing, and PR guidelines. To run from source instead of a published wheel: ```bash git clone https://github.com/MaskitMCP/openmaskit.git cd openmaskit uv sync uv run openmaskit ``` ## License Apache 2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE). ## Trademark "OpenMaskit"™ and the OpenMaskit logo are trademarks of Amin Malekloo. The Apache 2.0 license does not grant trademark rights — see [TRADEMARKS.md](TRADEMARKS.md) for permitted uses (forks must use a different name; "compatible with OpenMaskit" is fine). ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [MaskitMCP](https://github.com/MaskitMCP) - **Source:** [MaskitMCP/openmaskit](https://github.com/MaskitMCP/openmaskit) - **License:** Apache-2.0 - **Homepage:** https://www.openmaskit.com Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: flagged — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-maskitmcp-openmaskit - Seller: https://agentstack.voostack.com/s/maskitmcp - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.