REDACTBLOCK
Prompts & messages
Structured rules, entropy checks, PII patterns, and custom terms on model-bound inputs.
OpenSource-available under BUSL 1.1
Your agents move fast.Your secrets don't leave.
Skilak Mesh inspects prompts, files, images, and tool-call payloads, then blocks or redacts sensitive data before it leaves your boundary.
Security event traceALLOW
Agent output
{"role": "user", "content": "Summarize the Q3 performance metrics."}
Mesh inspection
Analysis:None
Provider ingress
{"role": "user", "content": "Summarize the Q3 performance metrics."}
Audit log
{"verdict": "allow", "prompt_chars": 74, "latency_ms": 12}
Security event traceBLOCK
Agent output
File: employee-benefits.pdf (2.4MB)
Mesh inspection
Analysis:US SSN in extracted PDF text
Policy action:BLOCK
Provider ingress
Upload stopped before provider transmission
Audit log
{"verdict": "block", "rule_hits": [{"rule": "pii_ssn", "count": 1}]}
Security event traceBLOCK
Agent output
{"tool": "fetch_data", "params": {"key": "AKIAIOSFODNN7EXAMPLE"}}
Mesh inspection
Analysis:AWS access key ID
Policy action:BLOCK
Provider ingress
Request terminated (HTTP 400)
Audit log
{"verdict": "block", "rule_hits": [{"rule": "aws_access_key_id", "count": 1}]}
DeploymentSelf-hosted
BehaviorFail-closed default
LoggingPayload-free audit
ControlPolicy controlled
ScopeMultimodal egress scan
EcosystemProvider independent
Coverage
One boundary for every AI path
Sensitive information reaches AI systems through more than chat boxes. Mesh inspects every supported, reroutable request before it reaches an external provider.
BLOCKWARN
Tool calls & agent traffic
Inspection of model-bound JSON, tool arguments, metadata, and agent messages.
BLOCK
PDFs & office documents
Bounded text, metadata, rendered-page OCR, and embedded-content inspection.
BLOCK
Images & OCR
Bounded OCR, metadata, raw-string, frame, and QR/barcode inspection.
BLOCK
Archives & email
Recursive scanning of ZIP, TAR, and EML files to enforce policy on nested contents.
RELAY
Provider responses
Relayed to the client unmodified and not inspected. Mesh is an egress control: it enforces policy on what you send and records response metadata payload-free.
BOUNDARY
Coding-agent boundary
Complements OS sandboxing by inspecting outbound traffic routed through the mesh. It does not monitor filesystem reads.
Compatibility
Will Mesh protect my setup?
Search your tool. Mesh inspects outbound requests from any client you can point at a custom API base URL. If a tool cannot be routed, the protection is blocking it at egress and using an approved alternative.
32 tools
No tools match your search.
Check the one rule below for the universal answer.
- What Mesh inspects on the way out
- How to set it up
- Caveat
- Configuration
Not listed? Here is the one rule
If your tool lets you set a custom API base URL, point it at the mesh alias path and it is covered. If it is a closed app with no custom-endpoint option, the answer is block at egress and use an approved routed client instead.
The /p/<alias>/ prefix is required: the alias is the only thing that selects an upstream, and a bare http://localhost:51737 base URL is refused with unknown_provider_alias. The client keeps and sends its own provider credential; the mesh relays it to the pinned provider and holds none of its own.
Can you set a custom API base URL?→ Protected or Conditional coverage
No custom endpoint available?→ Block at egress, use an approved routed alternative
No tool can claim all AI traffic is protected on an unmanaged machine. Supported outbound requests routed through the mesh are inspected; managed egress policy blocks known direct AI paths.
Policy
Policy enforcement in practice
Define policies hierarchically. Mesh resolves precedence across teams, data categories, and global defaults to compute the one correct action.
Inspection request traceID: req_8f72c9
Policy resolutionMatched: Global PII Standard
Evaluation precedence
Team rule
Rule: -
Team category
Rule: -
Global rule
Rule: -
Global category
Rule: -
Default
Rule: -
Final actionREDACT
Files
Sensitive data isn't always text.
Mesh unpacks archives, extracts text from documents, and runs OCR on images to apply policy across formats. Anything it cannot safely process is stopped, not forwarded.
Upload
Intercept stream
Extract
Text & OCR
Scan
Rules & entropy
Policy
Apply rules
Attest
Forward safe
PDF documentemployee-benefits-2024.pdf
Benefits Summary 2024
Employee Name: Jane Doe
SSN: •••-••-6789 PII DETECTED
Plan Type: PPO Standard
Coverage Start: 2024-01-01
Dependents: 2
Authorized Signature:
[Signature Image Data]
Employee Name: Jane Doe
SSN: •••-••-6789 PII DETECTED
Plan Type: PPO Standard
Coverage Start: 2024-01-01
Dependents: 2
Authorized Signature:
[Signature Image Data]
Image OCRid-card-scan.png
PII DETECTED
Archivedata-export.zip
> unzip -l data-export.zip Archive: data-export.zip ├── config.json ├── README.md ├── .env (BLOCKED) └── src/ └── main.py ERR: Policy violation in .env
Architecture
Built for your network boundary
Mesh runs as a standalone gateway. It does not require modifying agent code or sharing policy evaluation with an external service.
Application or autonomous agent
Skilak Mesh gatewayNo egress
Policy engineInspection pipeline
External AI provider (OpenAI, Anthropic, …)
Response relayed (not inspected)Pass
Application or agent
Isolation
Zero provider credentials
The scanner evaluates content independently of the destination. It holds no API keys and makes no outbound calls for policy resolution.
Egress
Outbound enforcement
The request is scanned, audited, and enforced before it is forwarded. Provider responses are relayed unmodified and are not inspected.
Audit
Payload-free audit
Audit records hold metadata about violations (policy ID, byte count, latency), never the sensitive payloads. Your security tool should not become a toxic data spill.
Reliability
Fail closed
Inspection failures and unscannable content block by default. An explicit fail-open setting is limited to documented scanner failures and is recorded as a warning.
Agent safety
DLP is the second boundary.
Mesh can inspect data when an agent sends it through the gateway. It cannot make unrestricted filesystem access inherently safe. Least privilege comes first.
Sandboxed workspace
The agent runs in an isolated container or VM.
Explicit file allowlist
Only necessary files are mounted to the workspace.
Secrets excluded
Environment variables and config files are removed from context.
Egress restricted
Network blocked except for the route to Mesh.
Scoped credentials
Short-lived tokens issued through a secure metadata service.
Mesh inspection
Final boundary scan of prompts, tools, and files.
Quickstart
Install in one command
One policy-controlled boundary between your AI tools and their providers, running in minutes. Clients only need a custom API base URL.
# Install Skilak Mesh (Homebrew)
brew install skilaklabs/tap/smesh
# Start the gateway with the configured policy (Balanced is the default)
smesh start
# Point any client at the mesh alias path
export OPENAI_BASE_URL="http://localhost:51737/p/openai/v1"
export OPENAI_API_KEY="<your-provider-key>"
Use these commands only after a verified version appears on the download page. An unpublished channel is not an installable release. Download page →
Make sensitive data stop at the boundary.
Install it yourself in a minute, or ask us about rolling it out to a team with shared policy.