Skip to content

Back to the catalog

zeroc00I/DontFeedTheAI
github.comrepo

zeroc00I/DontFeedTheAI

DontFeedTheAI is a transparent proxy built for pentesters that intercepts requests to LLM APIs (Claude Code, OpenAI SDK, OpenRouter, etc.), using a local Ollama-based detector plus regex to strip and surrogate real IPs, credentials, hostnames, and PII before the request leaves the machine, then restores the originals on the response. It ships a setup wizard for local Docker or VPS+SSH-tunnel deployment, a visual audit page for reviewing ORIGINAL→SURROGATE mappings, and an integration test suite (53 fixtures) to verify zero leaks across the full pipeline. The goal is to let engagements use cloud-quality LLM reasoning without ever sending real client data (org names, credentials, hostnames) to a third-party API.

TL;DR Local transparent proxy that anonymizes IPs/creds/hostnames/PII before pentest data reaches an LLM API, restoring real values on the response.
Open original ↗
Document

What it is

zeroc00I/DontFeedTheAI — a transparent proxy for pentesters that intercepts requests from an AI client (Claude Code, OpenAI SDK, OpenRouter, Requesty, or any OpenAI-compatible client) to a cloud LLM, replacing sensitive engagement data with surrogates and restoring it on the response. The author positions it explicitly against the alternatives: a cloud anonymization API (adds a second billed third party), Ollama alone (local but no sensitivity awareness), and hitting Claude/OpenAI directly (best reasoning, but real data lands in their logs).

How it works

Detection is two-layer: a local Ollama-based detector plus a regex layer. Both Ollama and the proxy run on your machine; only surrogates cross the boundary to the cloud API. Entities are typed (DOMAIN, CREDENTIAL, TOKEN, HASH, and others). Deployment is via wizard.py, either to a VPS (recommended for teams/persistent engagements) or locally in Docker.

What to do

Local setup without a VPS:

python3 wizard.py setup       # create venv + install dependencies
python3 wizard.py docker up   # start proxy + Ollama in Docker
export ANTHROPIC_BASE_URL=http://localhost:8080
export ENGAGEMENT_ID=my-engagement
claude                        # or any OpenAI-compatible client

Validate coverage — two commands that complement each other:

python3 wizard.py test --integration   # runs all 53 fixtures through LLM + regex, asserts zero leaks
python3 wizard.py improve --cycles 3   # regex layer only, reports leaks + false positives

Note the distinction the page stresses: without --integration, the LLM is mocked and only regex is validated — fast, but not proof the full pipeline holds. improve needs no Ollama; test --integration requires it running.

Visual audit UI (proxy must be running):

python3 wizard.py tunnel --audit

Caveats

The audit page is a debug tool that exposes the full surrogate → original lookup table — i.e. anyone reaching it can reverse every surrogate back to real data. This is why it is only served behind the SSH tunnel. Making it write-only (no reverse lookup over HTTP) is still on the roadmap, not implemented — treat the tunnel as the only thing protecting that mapping. The author states plainly he is "a pentester, not a software architect" and that the design is not novel; effectiveness of detection depends on the community-driven fixture/regex contribution loop, so coverage for tools you use may be incomplete until you add fixtures.

Technologies named here

Techniques named here

  • PII/sensitive data anonymization via surrogate substitution
  • Local detection with cloud reasoning split

Related in AI Security