DataFog — The Privacy Firewall for Agents

The Privacy Firewall for Agents.

DataFog detects and redacts PII locally — in Claude Code hooks, LiteLLM gateways, and Python pipelines — before it leaves your machine.

100% Open source

$pip install datafog

Pick your enforcement point.

Three ways to put DataFog between your data and the model. Everything runs locally, and matched values are never echoed into logs or transcripts.

SDKs

Python library

Scan, redact, or block PII in prompts, outputs, and pipelines. Regex engine by default; spaCy and GLiNER are opt-in.

$ pip install datafog

>>> import datafog
>>> datafog.sanitize(
...     "Contact ada@example.invalid",
...     engine="regex")
'Contact [EMAIL_1]'

Library docs →

Coding Agents

Claude Code

Gates agent tool calls — shell commands, file writes, web requests, MCP tools — and warns the model when prompts or results carry PII.

/plugin marketplace add
    DataFog/datafog-claude-plugin
/plugin install datafog@datafog

# blocked before the tool runs:
✗ Bash denied — SSN in command

Plugin repo →

Gateways

LiteLLM

An in-process guardrail for any LiteLLM-proxied provider. Redacts or blocks at the gateway, with no sidecar service to deploy.

# litellm --config config.yaml
guardrails:
  - guardrail_name: datafog-pii
    litellm_params:
      guardrail: datafog.integrations.litellm_guardrail.DataFogGuardrail
      mode: ["pre_call", "post_call"]
      action: redact  # or: block

Guardrail example →

More surfaces

The same firewall ships as fogclaw for OpenClaw agents — openclaw plugins install @datafog/fogclaw — and more enforcement points are on the way. Follow the roadmap →

Defaults to the high-precision entity set — EMAIL · PHONE · CREDIT_CARD · SSN. Noisier types, German locale packs, and allowlists are opt-in. Presidio-style entity names are accepted as aliases.

100x+ faster than NER-based scanners.

DataFog's guardrail runs inside your gateway process. The common alternative is a NER service beside it, which adds a deployment to manage and a network hop to every request. Benchmarked on identical payloads and entity types; reproduce it with one command.

	DataFog guardrail	Sidecar scanner (e.g. Presidio)
Deployment	in-process — `pip install datafog`	separate service to run and scale
Latency per scan	231µs on a 1.2KB document	22.8ms on a 1.2KB document

Medians from the reproducible benchmark suite, measured on identical payloads and entity types.