Data Airlock

Clean sensitive datasets with AI agents—without uploading raw data. WebMCP enables local analysis, human-approved cleaning, capability-gap detection, and safe tool evolution.

Comment

Inspiration

AI agents are extremely useful for understanding and cleaning data, but there is a fundamental problem with sensitive datasets: normally, the agent needs access to the data itself.

Data Airlock explores a different model:

An agent can work on a dataset it can never read.

The raw file stays on the user's device and is processed locally in the browser. The agent receives only bounded, pseudonymized and aggregate evidence through WebMCP.

What it does

Data Airlock is a local-first environment for analyzing and cleaning JSONL and CSV datasets with an AI agent while keeping raw records outside the agent boundary.

A user can ask ChatGPT to analyze a dataset in natural language. Data Airlock performs the actual work locally and exposes safe WebMCP tools that let the agent:

  • inspect aggregate dataset profiles and quality findings;
  • identify affected pseudonymous fields without revealing their original values;
  • prepare cleaning actions;
  • run a real local second-pass simulation;
  • inspect aggregate simulation impact;
  • detect structural patterns that are not covered by any active capability;
  • create or evolve capabilities with Forge;
  • evaluate candidates locally using aggregate coverage, specificity, overlap and stability metrics;
  • retrieve the open-source source code of cleaning tools when needed;
  • access an interactive Data Airlock guide.

The included production demo is a real 500 MiB dataset processed by the same local engine used for user files.

Human authority by design

The agent can analyze, reason, propose and simulate, but it cannot approve a destructive operation on behalf of the user.

The cleaning lifecycle is deliberately:

PROPOSE → SIMULATE → HUMAN APPROVAL → EXECUTE

Human approval happens independently in the Data Airlock UI. Changing an approved plan invalidates that approval and requires a new simulation and review.

This separates two different security boundaries:

data access and execution authority.

Capability Gap Scan and Forge

A fixed set of tools cannot anticipate every structure that may appear in real-world data.

Data Airlock therefore includes a local Capability Gap Scanner. It recognizes broad structural families such as date/time formats, locale-dependent numbers, identifiers, encoded tokens, network formats, structured text, Unicode/script mixtures, length distributions and other patterns.

If a field contains meaningful structure that no active capability explains, the agent can receive safe aggregate evidence about that gap without seeing the values that caused it.

The agent can then use Forge to create a new capability or evolve a related existing one.

Before adoption, candidates go through bounded validation and can be evaluated locally against the gap. The agent receives only aggregate metrics such as structural coverage, specificity, overlap and stability.

The principle is:

The agent can expand its capabilities, not its access to your data.

Why WebMCP

WebMCP is what makes the architecture possible.

Instead of building a separate agent backend or uploading the dataset to an API, the website exposes a controlled set of capabilities directly to the agent.

The browser owns the dataset and computation. WebMCP provides the agent with a narrow semantic interface containing only the information it actually needs.

This means the agent can participate in a useful end-to-end workflow while the raw dataset remains local.

Data Airlock currently exposes read-only analysis and guidance tools, controlled plan-management tools, Forge, and a dynamically gated execution capability that exists only after real human approval.

Privacy boundary

The agent never receives raw dataset records or original field values through the Data Airlock WebMCP tools.

It can receive things such as:

  • aggregate counts;
  • finding categories;
  • pseudonymous field IDs such as field_003;
  • cleaning-plan metadata;
  • aggregate simulation impact;
  • aggregate capability-gap evidence;
  • aggregate candidate-evaluation metrics;
  • safe receipts and state;
  • open-source tool source code.

The application requires no backend, no account and no API key for local dataset processing.

Building it

Data Airlock is built in TypeScript and React and runs entirely in the browser.

Large datasets are processed using automatic Web Workers. JSONL and CSV are streamed through the local processing pipeline, and output can be written using browser-local storage / file capabilities depending on the environment.

The WebMCP layer is intentionally separated from the raw-data engine. Agent-visible results are projected through bounded privacy-safe representations before leaving the local runtime.

The production deployment is hosted on Cloudflare Pages.

Challenges

The hardest part was not detecting data-quality problems. It was preserving a meaningful agent experience while keeping a strict capability boundary.

We had to make sure that:

  • raw values never leaked through normal results, errors or edge cases;
  • the agent could not manufacture human approval;
  • stale approvals could not be replayed after a plan changed;
  • WebMCP registrations remained safe across browser-host lifecycle changes;
  • large files stayed practical without moving processing to a backend;
  • Forge could evolve functionality without becoming an arbitrary-code escape hatch;
  • capability discovery produced useful evidence without exposing examples from the dataset.

We also built extensive deterministic, privacy, lifecycle and end-to-end tests around those boundaries.

What we learned

The most interesting lesson was that hiding raw data does not have to make an agent useless.

If the local application exposes the right abstractions, an agent can still reason about counts, structural families, impact, coverage and state transitions.

That led to the third principle behind Data Airlock:

Airlock does not only hide data from the agent — it gives the agent enough safe evidence to know when it still does not know how to handle something.

What's next

The same architecture can extend beyond dataset cleaning.

The broader idea is a capability-oriented interface where agents can work with sensitive local information through safe evidence and constrained actions rather than unrestricted access to the underlying data.

Data Airlock is one demonstration of that model.

Built With

Share this project:

Updates

Submission history