CassiopeiaCode/CosyRedactGateway

What it claims

Cosy is a JavaScript gateway with no runtime dependencies. It is configured per request through a URL prefix of the form /<flags>$<full-upstream-url>, and its headline detector is high-entropy scoring (flag H). That detector flags random-looking strings with no vendor prefix and no password=-style label. The published calibration, on synthetic fixtures, judged 296 of 30,000 concatenated natural-word samples (0.9867%) as high-entropy. Recall on random hex and base62 strings rises with length. The project states these are synthetic results, not production leak rates, and were not re-measured for the current README.

How it works

Each hit is replaced with a placeholder carrying a 64-character SHA-256 digest of the value plus a runtime salt. The real placeholder is 75 bytes long. The original-to-placeholder map lives in memory for one request and its response stream, then is discarded.

The salt is generated per runtime or isolate, not per request. Within one runtime, the same value can therefore produce the same placeholder. A placeholder is restored only if the current request created it and the model returned it unmodified. Placeholders from older requests are not restored.

sequenceDiagram
  participant C as Client
  participant G as Cosy (trusted)
  participant U as Upstream LLM
  C->>G: Raw JSON + auth header
  G->>G: Detect, swap for placeholders
  G->>U: Redacted body + auth header (forwarded)
  U-->>G: Response / SSE with placeholders
  G-->>C: Known, unaltered placeholders restored

Restoration also covers tool-call arguments, but Cosy does not execute or authorize tools. For supported user messages it inserts a Notice, which can be turned off or pinned to the start of a session so the prompt prefix stays stable.

Evidence

According to the docs, the tests cover every split position of the 75-byte placeholder, single-byte HTTP chunks, supported SSE formats, tool and reasoning deltas, and the local HTTP and Node adapters. The page states this is not a throughput benchmark or an independent security audit.

How to use it

It requires Node.js 20+ and Git. The HTTP examples use Bash and curl 7.76+.

git clone https://github.com/CassiopeiaCode/CosyRedactGateway.git
cd CosyRedactGateway
npm start

The local adapter listens on http://127.0.0.1:8787. The following commands need no API key:

curl --fail --silent --show-error http://127.0.0.1:8787/healthz
node scripts/demo-high-entropy.mjs
npm test
npm run entropy-report

The demo prints results for flags PSIBEG (high-entropy off), H only, and empty (all on). An empty flag field means HPSIBEG, which enables every detector. An unknown flag letter returns HTTP 400. G is a Gitleaks-compatible rule set suited to serverless runtimes and is not guaranteed to match the Gitleaks CLI.

SDK base URLs:

• OpenAI Python: http://127.0.0.1:8787/$https://api.openai.com/v1
• Anthropic JS: http://127.0.0.1:8787/$https://api.anthropic.com (do not add /v1)

In a shell, quote the route URL in single quotes so $ is not expanded. To deploy on Workers, run npx wrangler deploy and set REDACT_ALLOWED_HOSTS=api.openai.com,api.anthropic.com as a Worker variable. For Deno, run deno run --allow-net --allow-env worker.js. The licence is Apache 2.0, and some rule signatures come from Gitleaks.

Limits

• Auth headers. Authorization and x-api-key headers are forwarded to the upstream by design. Only the body is redacted.
• Not encryption. This is neither encryption nor irreversible anonymization. The surrounding prompt still goes upstream, and the hashes do not remove inference or correlation risk.
• Trust boundary. The gateway holds the raw request, provider keys and the mapping. A Worker or remote Deno instance receives secrets in plaintext.
• Request handling. Non-empty, non-JSON bodies get HTTP 415. Some control fields, URLs and image or audio payloads skip redaction. OpenAI and Anthropic formats are not converted into each other.
• Defaults. The body limit is 16 MiB and the cap is 16,384 distinct replacements per request. CORS defaults to *. The host allowlist restricts targets but does not authenticate callers, so public deployments need external access control.
• Private upstreams. Literal private, loopback and link-local upstreams are blocked unless REDACT_BLOCK_PRIVATE_UPSTREAMS is disabled. The page says this is not full SSRF or egress protection.
• Tool compatibility. Cursor, Claude Code and Codex are not certified. Remote-executing clients cannot reach 127.0.0.1.
• Side effects. False positives can strip useful context, and tasks that need the original value may break.