Inspiration
AI agents now book tables, refill prescriptions and call rides, so they hold my phone, card and medications. Once that data is in the agent's context it can go anywhere, and one poisoned web page can steal it. I wanted the boundary enforced outside the model.
What it does
Consentry sits between an agent and everything it talks to, including the LLM. For each field it decides to allow, minimize, ask me or deny. It blocks prompt injections coming back, and it writes a tamper-evident receipt of every decision.
How we built it
I built a TypeScript core that runs in both Node and the browser, plus a Hono gateway, a React dashboard and an MCP server, all wired to 12 live public APIs. Injection signals are combined with a noisy-OR, and the ledger is a SHA-256 hash chain:
$$S = 1 - \prod_{i} (1 - w_i) \qquad h_n = \mathrm{SHA256}(h_{n-1} \,|\, e_n)$$
Challenges we ran into
A token named after a drug leaked the medication to Claude without ever sending its value. The firewall also kept flagging its own minimized output, and concurrent tool calls could fork the hash chain.
Accomplishments that we're proud of
The firewall contained all 5 red-team attacks, including a simulated compromised agent that obeys the injection. Claude still finishes real tasks while only ever seeing {{vault:tokens}}.
What we learned
Privacy for agents has to work field by field, not request by request. Consent only means something when you see the exact value next to the minimized one. Data also leaks through side channels like token names and image URLs.
What's next for Consentry: the consent firewall for AI agents
Next up: a semantic classifier to catch paraphrased data, a browser extension for ChatGPT and Claude.ai, and policy packs for GDPR, CCPA and HIPAA.
Log in or sign up for Devpost to join the conversation.