CassiopeiaCode/CosyRedactGateway

What it is

CosyRedactGateway (Cosy) is an Apache-2.0 Node.js gateway that rewrites JSON request bodies bound for OpenAI or Anthropic APIs. Matched secrets become reversible placeholders before leaving the machine. Its distinguishing feature is high-entropy detection (flag H), which scores text blocks statistically so it can catch random tokens with no vendor prefix and no password= label. Other detectors are structured (S, I, B, E), Gitleaks-compatible (G) and P. The full set is written HPSIBEG.

How it works

Clients point their base URL at a route of the form https://<cosy-host>/<flags>$<full-upstream-url>. An empty flag section enables all detectors. Unknown letters return HTTP 400. Non-empty, non-JSON bodies return HTTP 415 rather than being forwarded unredacted.

Placeholders contain a 64-character SHA-256 digest and are about 75 bytes long. The mapping from original to placeholder lives in memory for one request and its response stream. The salt is generated per runtime or isolate, not per request, so the same secret can yield the same placeholder within one runtime. Restoration happens only if the model returns a known, unmodified placeholder. It covers ordinary responses, supported SSE streams and tool-call arguments. Cosy does not execute tools or authorize them.

Some control fields, URLs and image or audio payload fields are skipped. Supported user messages get an inserted Notice, which can be disabled or pinned to the start of a session. Some request headers are filtered. Cosy does not translate between OpenAI and Anthropic formats.

Preconditions / Affected

Node.js 20+, Git and a terminal are needed. HTTP examples need Bash and curl 7.76+. The gateway has no runtime dependencies. The client must support a custom base URL and must preserve the embedded upstream URL. Remote-executed clients cannot reach 127.0.0.1. The page makes no version-specific compatibility claim for Cursor, Claude Code or Codex and advises testing the real request path with synthetic data.

What to do

Run locally and check it offline, with no API key:

git clone https://github.com/CassiopeiaCode/CosyRedactGateway.git
cd CosyRedactGateway
npm start
curl --fail --silent --show-error http://127.0.0.1:8787/healthz
node scripts/demo-high-entropy.mjs

The demo prints results for the same unlabeled synthetic string with PSIBEG (high entropy off), H only, and empty flags (all on). It also checks exact restoration. For the broader suite:

npm test
npm run entropy-report

SDK base URLs:

• OpenAI Python: http://127.0.0.1:8787/$https://api.openai.com/v1
• Anthropic JS: http://127.0.0.1:8787/$https://api.anthropic.com. Do not add /v1, because the SDK appends /v1/messages.

Quote the route URL in shells so $ is not expanded.

Before any non-local deployment (Cloudflare Workers via npx wrangler deploy, or Deno via deno run --allow-net --allow-env worker.js):

REDACT_ALLOWED_HOSTS=api.openai.com,api.anthropic.com

Set it as a Worker variable, since a local shell variable does not configure a deployed Worker. Keep REDACT_BLOCK_PRIVATE_UPSTREAMS on unless the private upstream is deliberate. Add external authentication, because the host allow-list restricts destinations and does not authenticate callers.

Caveats

• Authorization and x-api-key headers are still forwarded to the upstream, so this protects body content only.
• Traffic that bypasses the gateway, skipped fields and missed secrets are not covered.
• A cloud-hosted gateway receives the raw request first, so the host becomes part of the trust boundary.
• Default CORS is *, which is not access control. Default limits are 16 MiB per body and 16,384 distinct replacements per request. The built-in private-host check is not full SSRF protection.
• The only published calibration is synthetic: 296 of 30,000 natural-word concatenations (0.9867%) were flagged as high entropy, and recall on random hex and base62 strings rises with length. The page says this is not a production leak rate, an independent re-test or a security audit.
• Redaction can remove useful context through false positives, and tasks that need the original value may break.
• The G detector is Gitleaks-compatible but not claimed equivalent to the Gitleaks CLI. A checksum match does not prove an account exists.
• SSE restoration is tested for supported formats, including every split point of a 75-byte placeholder. Arbitrary streaming formats are not claimed.