ArchAI - Data Broker

Inspiration

AI applications often send logs, conversations, source files, and credentials directly to model providers without clearly showing what left the machine.

We built ArchAI to create one transparent control layer between an AI client and its models. It lets people use local runtimes such as Ollama and vLLM alongside OpenAI while retaining control over privacy, context, routing, and audit data.

What It Does

ArchAI is a lightweight, database-free MCP service that:

• Removes API keys, tokens, private keys, emails, and other sensitive information.
• Organizes context into traceable layers.
• Enforces configurable token budgets.
• Records which sources were included or excluded.
• Routes requests between Ollama, vLLM, and OpenAI-compatible providers.
• Produces metadata-only audit events without storing user conversations.

Every outgoing context packet receives a SHA-256 identity, making it possible to verify exactly what was sent without retaining its contents.

How We Built It

ArchAI is implemented in Node.js using MCP over standard input and output. It requires no application database, background telemetry service, or inbound network port.

Context is divided into ordered layers:

1. Identity
2. Instructions
3. Task
4. Memory
5. Evidence
6. Recent activity

ArchAI estimates the token cost of each layer using:

$$ \hat{T}(x)=\left\lceil\frac{|x|}{4}\right\rceil $$

It then selects layers while respecting the configured budget:

$$ \sum_{i\in I}\hat{T}(L_i)\le B $$

Here, $L_i$ represents a context layer, $I$ is the set of included layers, and $B$ is the total token budget. Layers that do not fit are listed in the manifest with an exclusion reason rather than disappearing silently.

MCP Capabilities

ArchAI exposes six focused tools:

• archai_redact removes sensitive information.
• archai_context creates a layered context packet.
• archai_route selects an available inference provider.
• archai_status reports provider availability.
• archai_ask performs a governed model request.
• archai_audit returns recent metadata-only events.

This makes ArchAI compatible with any MCP-capable application without requiring the application to adopt ArchAI's internal storage system.

What We Learned

The most useful AI control layer is not necessarily the one that stores the most information. It is the one that can explain exactly what it sent and why.

Source tags, exclusion reasons, redaction counts, and payload hashes proved more valuable than an opaque retrieval pipeline. We also learned that model runtimes should remain interchangeable infrastructure rather than becoming hard dependencies.

Users can keep Ollama on a laptop, operate vLLM on a GPU server, or call OpenAI without changing the MCP contract presented to their application.

Challenges

The largest challenge was making ArchAI useful without owning a database.

We solved this by accepting context directly through MCP requests and treating persistence as an optional external interface. Audit events can remain in bounded memory, be written to JSONL, or flow through a callback into an existing logging platform.

Another challenge was preventing provider-specific behavior from leaking into the product contract. ArchAI normalizes every response around the selected provider, model, answer, and context manifest.

Privacy was also difficult to communicate honestly. Pattern-based redaction cannot replace a complete security review. ArchAI therefore reports what it removed and hashes the final payload, presenting an inspectable safeguard instead of promising perfect detection.

Built for OpenAI Challenge Week

ArchAI turns privacy, provenance, token management, and local-to-cloud routing into one reusable MCP product.

A user installs one lightweight service, connects an MCP-capable application, and gains a governed path across Ollama, vLLM, and OpenAI—without surrendering ownership of their data or database.

Built With

• json-rpc
• mcp
• node.js
• ollama
• openai
• vllm