maskkit

Agentic-first data masking and redaction service. Detect and mask PII (personally identifiable information) in text. 19 entity types, 5 masking strategies. Plain text API, MCP-enabled, single Go binary, zero dependencies, no database.

Quick Start

# Build
make build

# Run (default port 7701)
./maskkit

# Mask PII in text
curl -X POST http://localhost:7701/mask -d 'Contact me at john@example.com or call 555-123-4567'

# Detect PII without masking
curl -X POST http://localhost:7701/detect -d 'My SSN is 123-45-6789'

# Mask a single value
curl 'http://localhost:7701/mask-value?value=john@example.com&type=email&strategy=redact'

# List supported types
curl http://localhost:7701/types

# Get help
curl http://localhost:7701/help

PII Types (19)

Type	Description
email	Email address
phone	Phone number
credit_card	Credit card number (Luhn validated)
ssn	Social Security Number
iban	IBAN
ipv4	IPv4 address
ipv6	IPv6 address
api_key	Generic API key
jwt	JWT token
uuid	UUID
url	URL
mac_address	MAC address
btc_address	Bitcoin address
private_key	PEM private key block
aws_key	AWS access key
github_token	GitHub token
slack_token	Slack token
stripe_key	Stripe API key
password	Password assignment

Masking Strategies (5)

Strategy	Description
mask	Keep first/last 2 chars, asterisks in middle (default)
redact	Replace with [REDACTED]
hash	Replace with FNV-1a hash (16 hex chars)
partial	Keep first N chars, mask rest
asterisk	Replace every char with *

API Endpoints

Method	Path	Description
POST/GET	/mask	Mask PII in text
POST/GET	/detect	Detect PII without masking
GET	/mask-value	Mask a single value
GET	/types	List all PII types
GET	/strategies	List masking strategies
POST	/mcp	MCP JSON-RPC 2.0 endpoint
GET	/help	Self-documenting manual
GET	/.well-known/agent.md	Same as /help

Configuration

Source	Variable	Default	Description
Env	MASKKIT_ADDR	:7701	Listen address
Env	MASKKIT_NO_AUTH	false	Disable auth (dev mode)
Flag	-addr	:7701	Listen address
Flag	-no-auth	false	Disable auth (dev mode)

Build

CGO_ENABLED=0 go build -trimpath ./cmd/maskkit

License

MIT