frad3ail llm gateway

Coding agents read everything. frad3ail llm gateway redacts secrets before egress and turns every Codex session into provable audit evidence.

Comment

Inspiration

Coding agents read far more than the prompt a developer types. Environment files, source code, logs, terminal output, tool results, credentials, and personal information can all end up in model-bound context — often without the developer noticing.

Existing controls mostly sit at the network perimeter or in retrospective logs. I wanted protection closer to where I actually work: a local gateway that inspects what an agent is about to send, applies policy before anything leaves my machine, and produces useful evidence without creating yet another store of sensitive plaintext.

The name "frad3ail" is pronounced "fragile." Powerful agentic systems still operate across fragile trust boundaries, and those boundaries need both enforcement and evidence.

What it does

frad3ail is a local-first, OpenAI-compatible privacy gateway for Codex and other compatible clients. It sits between the client and the upstream model provider and inspects model-bound HTTP and WebSocket traffic before forwarding it.

The gateway extracts inspectable context segments, classifies their content with a local Magika model, and detects credentials, PII, internal infrastructure, and dotenv-style secrets using deterministic detectors, Presidio, and a custom checksum-aware South African ID recognizer.

A versioned YAML policy then decides what happens to each finding:

  • Block real or uncertain credentials — the request never leaves localhost.
  • Tokenize real PII using session-scoped encrypted mappings.
  • Redact internal-sensitive findings such as private URLs and IPs.
  • Allow or audit test values, placeholders, and uncertain PII.
  • Fail closed when required inspection or transformation is unavailable.

Every decision becomes privacy-safe evidence. The dashboard groups it into sessions and turns; each turn shows the safe request view, findings, transformations, the response, a timeline, and the underlying technical runs. Evidence is tamper-evident through a hash chain and exportable as JSONL.

How I built it

I built frad3ail as a pnpm monorepo with clear boundaries between transport, domain logic, persistence, detection, and presentation.

The TypeScript gateway handles OpenAI-compatible HTTP routes, Codex subscription traffic, streaming responses, and bidirectional WebSocket proxying. Shared core services perform context extraction, detection orchestration, policy evaluation, exact-path transformation, tokenization, and evidence recording. Drizzle and SQLite provide local persistence, migrations, session and turn correlation, encrypted token mappings, and hash-chained audit events.

Heavyweight local analysis runs in a separate Python service built with FastAPI, with distinct API, application, domain, and infrastructure layers. Magika model assets are vendored and checksum-verified, and Presidio runs without remote or LLM-backed recognizers. The token vault uses HMAC fingerprints for lookup, HKDF-derived keys, and AES-256-GCM authenticated encryption. Raw payload capture is disabled by default, and the redactor lives on an internal-only Docker network.

The dashboard is React, Vite, TypeScript, Tailwind CSS, and shadcn components. Docker Compose builds and starts the gateway, redactor, and dashboard locally. After installing the dedicated Codex profile once, my normal workflow is just:

docker compose up
codex --profile frad3ail-gateway

Codex with GPT-5.6 was my primary engineering collaborator throughout. I used it to research provider protocols, design boundaries, implement features, restructure the database, diagnose WebSocket behavior, build tests, review the dashboard in a browser, and package the final local workflow. The end-to-end policy smoke test even drives Codex itself through the gateway to prove the block, tokenize, and redact paths against a real session.

Challenges I ran into

The hardest problem was WebSocket enforcement. Proxying frames bidirectionally was not enough: every response.create message had to be queued, decoded, inspected, transformed, and approved before any model-bound bytes reached the upstream provider. I also had to preserve ordering across follow-up prompts, prewarm messages, tool results, and conversation continuations.

Another challenge was making audit evidence useful without turning it into a second leak. Logging that "an email was detected" is valuable; storing or printing the email is not. I designed evidence around paths, classifications, actions, content hashes, counts, and safe placeholders, with raw capture explicitly off by default.

Tokenizing PII brought its own security and data-model problems. Tokens had to stay stable within one session, differ across sessions, survive process restarts, and never expose their original values. That meant encrypted mappings, scoped fingerprints, uniqueness constraints, migrations, and careful failure handling.

I also learned that telemetry shaped around internal requests is hard for humans to read. I reworked the model into sessions, turns, technical runs, and evidence, so a developer can follow the same mental flow they experienced in Codex.

Accomplishments that I'm proud of

frad3ail works with real Codex HTTP and WebSocket sessions, not just a synthetic proxy demo. The same policy pipeline governs both transports, and a blocked request creates no upstream connection and no upstream write.

I built a fully local detection boundary: vendored Magika assets, Presidio, deterministic secret detectors, and a South African identity recognizer with checksum validation. Runtime detection never depends on a hosted classifier and never sends sensitive samples to another service.

I'm also proud of the depth of the evidence model. Sessions contain ordered turns, technical runs, findings, policy decisions, transformations, provider outcomes, and audit events — privacy-safe by default, tamper-evident, exportable, and presented through a dashboard built for investigation rather than raw JSON inspection.

Finally, I reduced a multi-language privacy system to a practical local workflow: one profile installer, one Docker Compose stack, and a normal Codex command.

What I learned

Detection alone is not protection. A system can correctly identify sensitive information and still leak it if inspection happens after forwarding or only covers one transport. Enforcement has to sit directly in the provider-bound path.

False positives need policy context. Test credentials, placeholders, examples, and variable names should not be treated like confirmed secrets. Content type, source, path, confidence, and classification all matter before choosing an action.

Safe observability is a product feature, not a logging decision. Evidence must explain what happened while deliberately excluding the values that made it happen.

And local-first does not mean simplistic. A local system can still provide encrypted tokenization, deterministic policy, tamper-evident evidence, protocol-aware WebSocket enforcement, and a rich investigation experience — no SaaS control plane required.

What's next for frad3ail

Next, I want to complete the token lifecycle by safely detokenizing eligible provider responses, and add a local approval workflow for policy decisions that should pause a request rather than immediately allow or block it.

Provider support will expand beyond the current Codex and OpenAI-compatible path, starting with Anthropic-compatible clients. I also plan to ingest OpenTelemetry data and correlate it with existing sessions and turns. That richer evidence will support token and cost attribution across prompts, files, tools, terminal output, history, and repeated context — and from there, evidence-backed recommendations for cutting unnecessary context, retries, cost, and exposure.

Longer term, I see frad3ail growing into an agent evidence layer for teams: centrally versioned policy, policy simulation against historical sessions, signed evidence export, PostgreSQL storage, SSO, RBAC, and organization-wide reporting — while enforcement stays local and keeps working even when central services are down.

Built With

Share this project:

Updates