ConsentShield

Your agent watches your screen. Your consent decides what leaves it: on-device OCR + a local calibrated decision model, per-purpose consent, before any frame reaches the cloud.

Comment

Inspiration

Agents now see your screen: computer-use, recall-style assistants, Claude over MCP. Each screenshot goes to the cloud with whatever was open, like a chat about a biopsy, a bank balance or an .env. Nobody asks for consent at that moment.

What it does

ConsentShield sits between the screen and the agent, on your Mac:

  1. Apple Vision reads the frame on device.
  2. Rules catch keys, card numbers, money and "ignore previous instructions" first.
  3. A local decision model (Laya, open Jev) labels every line: credentials, financial, health, private message, contact, work, public. Each label comes with a calibrated confidence.
  4. Your consent is set per purpose: assistant, analytics, training, third party.
  5. At confidence 0.8 or above it sends or blurs the line on its own. Below that, the line stays blurred and you decide. Your answer becomes policy.
  6. The agent gets the redacted frame. A ledger stores category, purpose and action, never the text.

Nothing leaves the Mac before the decision. No toggle releases credentials.

Ships as an MCP server today (claude mcp add consentshield): a screenshot(purpose) tool returns only the gated frame. In a real Claude Code run on the personal chat sample, the agent reported: "I can read only one line: the sprint planning doc. The other 6 regions are blurred."

Demo: 34-second video with voice · recorded demo in the browser

Models, all local

  • OCR: Apple Vision through visionscan, a small Swift helper. It runs on the Mac's own hardware and returns text lines with boxes.
  • Decisions: Laya multilingual (convaiinnovations, Apache 2.0). It is an open reproduction of TypeSafe's Jev: mmBERT-base, 322M parameters, about 650 MB. It does not generate text. Each typed question gets one forward pass that returns a probability distribution and a confidence, about 30 ms per line on MPS here.
  • Measured before this hackathon on an M5: 10 of 12 on our EN+RU smoke set (both misses in Russian). ONNX int8 brings it to 325 MB, Core ML fp16 runs at 13.7 ms per question on the GPU, and the Neural Engine refuses it. Hosted Jev takes 70–500 ms per call, so local is 5–35x faster, and no frame has to leave the machine to be judged.
  • No LLM anywhere in the gate. An LLM can be the agent behind the gate. It never decides what the agent is allowed to see.

Built before vs. today

Before:

  • ScreenShield (9 Oct): DLP for video, a Rust binary that blurs secrets in a live stream with a 1 s delay. We reuse its OCR helper and secret, PII and injection detectors.
  • The Laya port to ONNX and Core ML, with measurements.
  • BroCheck (yesterday): Jev on images in one call.

Today:

  • The consent layer: categories × purposes, a policy with locked credentials, the gate (detectors → model → policy, fail closed), and the money detector.
  • The ledger, plus a web demo with screen sharing, purpose switching and one-click answers that become policy.
  • Synthetic personal screens, the CLI and tests, and the measurement that showed context makes the model worse.

How we built it

Python, FastAPI, a one-page demo with screen sharing, OCR from our earlier ScreenShield (3rd place, Cyberdefense Hackathon SF), Laya on Apple silicon. Gate rule from Vivek Haldar's work on decision models in agent harnesses.

Challenges

The small model is unsure on short chat lines (0.2–0.4). So unsure means blur and ask. Feeding it neighbouring lines made results worse, so that is off. Salaries passed as "work" until a money rule went in before the model.

Results

0.15–0.4 s per frame on a Mac. Same screen, four purposes, four different frames.

What's next

An MCP proxy in front of computer-use screenshot tools, continuous capture, a Core ML model (13.7 ms per question on M5), signed consent receipts for GDPR and the EU AI Act.

Built With

Share this project:

Updates

Submission history