-
-
SAFE MODE OUTPUT
-
WARN MODE OUTPUT
-
BLOCK MODE OUTPUT
Inspiration
Developers and students paste prompts into ChatGPT and Claude every day — and those prompts routinely contain API keys, passwords, tokens, and personal data. The moment you hit send, that secret has left your control. Companies are banning LLMs over exactly this risk. We wanted a seatbelt: something that catches sensitive data before it ever leaves your machine.
What it does
PromptGuard is a local privacy firewall for LLMs. Paste a prompt and it scans the text entirely on your own device, then returns one of three clear verdicts:
- BLOCK — a secret was found (AWS/OpenAI/Anthropic/Google keys, GitHub & Slack tokens, JWTs, private keys,
password=assignments) - WARN — personal data found (emails, Luhn-validated credit cards)
- SAFE — nothing sensitive, send freely
It names every finding with a masked preview and hands you a redacted safe version to send instead. No network calls, no disk writes — the tool that protects your privacy never compromises it.
How we built it
Spec-first in Kiro: 9 requirements with testable EARS acceptance criteria → a design doc → a task plan, then built task-by-task against it. One scanner.py engine holds all detection logic; two thin surfaces delegate to it — a zero-dependency http.server web UI and an MCP server (FastMCP) exposing scan_prompt and redact_prompt, so Kiro itself can call PromptGuard. Steering rules enforced our privacy-first principles. Covered by 45 tests — unit + Hypothesis property-based.
Challenges we ran into
Kiro's agent caught a real bug during the performance task: catastrophic regex backtracking in the JWT and EMAIL patterns (~13 seconds on 100k characters) and fixed it with boundary anchors — down to under 150ms. We also tuned detection to avoid false positives (Luhn validation on card numbers) and wired the MCP stdio server correctly.
Accomplishments that we're proud of
A complete, tested, fully local, zero-dependency product with our own MCP server — and genuine spec-to-code alignment: what we shipped matches what we specified.
What we learned
Spec-driven development with Kiro, how to build and register an MCP server, and sound engineering judgement — knowing that deterministic detection beats an LLM for structured secrets (faster, explainable, private).
What's next for PromptGuard
An optional local-LLM layer (Ollama) for contextual/unstructured PII, a browser extension for ChatGPT/Claude web, more detection patterns, and a CI pre-commit hook.
Log in or sign up for Devpost to join the conversation.