Open-Source Proxy Jnvoy: Intercepting Privacy Leaks and Injections Before the LLM Call

When your application sends a request to Claude or GPT-4o, what paths does user data actually travel through? Most developers don't have a clear answer. Names, emails, phone numbers — even social security and financial data — reach third-party servers without any de-identification. One developer built the open-source proxy Jnvoy to try to complete all security checks before data ever leaves the local environment.

The Data Leakage Blind Spot on the Default Path

When an application calls an LLM API, raw user input is typically stuffed directly into the messages array. The only things developers can control are the model name and temperature — they have no fine-grained ability to intercept what's being transmitted. In this mode, three classes of risk exist simultaneously: personal identifiable information leakage, prompt injection attacks, and tool poisoning in the Model Context Protocol.

GDPR and UK FCA compliance requirements place explicit constraints on personal data handling, but most teams in the rapid-iteration phase don't proactively build an independent detection layer. Jnvoy's entry point is precisely this gap — turning the security layer into an HTTP proxy so developers only need to swap the request URL without touching business logic.

PII (Personally Identifiable Information) is a core concept in regulations like GDPR, broadly referring to data that can identify a specific natural person either alone or in combination with other information — including names, emails, phone numbers, ID numbers, and financial accounts. In the context of LLM calls, the special nature of PII risk lies in this: once data enters a third-party inference service, it may be used for log retention, model training, or subsequent retrieval, escaping the original domain of control. The consensus in compliance practice is therefore "de-identification at the source" — completing detection and replacement before data leaves the local network, rather than relying on the vendor's after-the-fact promises.

Prompt Injection is an attack surface unique to LLM applications: an attacker embeds instructions in user input or external content, inducing the model to ignore system prompts, leak secrets, or perform unintended actions. MCP (Model Context Protocol) then extends this risk from the text layer to the tool layer — when a model can invoke external tools, malicious tool descriptions or tool-returned content may be executed as trusted instructions, the so-called "tool poisoning." The stacking of these three risk types makes it hard for mere input validation to cover all paths.

The Architecture Behind a One-Line URL Swap

From the caller's perspective, the change really is small. Initialization code that originally used the Anthropic SDK is replaced with a single httpx.post request pointing at the proxy service. The request body gains a provider field to specify the upstream model vendor.

The key to this design is the proxy's scope of responsibility. It scans request content locally, identifies PII entities and replaces them with reversible tokens, then forwards the de-identified request to the LLM. After the model returns results, the proxy restores the original values on the response path. The whole process is transparent to the caller — business code doesn't need to be aware that the token mapping exists.

The premise of this reversible token mechanism is that the mapping table exists only inside the proxy and never leaks along with the request. In multi-tenant scenarios, each API key corresponds to an independent mapping space, preventing data crossover between tenants.

Reversible token replacement is a de-identification strategy that balances privacy and usability. Unlike irreversible hashing or deletion, it maps identified PII entities (such as "John Smith" or "138xxxx") to placeholders (like [PERSON_1]) and maintains a bidirectional mapping table. The model reasons over the de-identified text, and if the returned result contains placeholders, the proxy restores them to original values based on the mapping table — ensuring downstream business receives responses semantically consistent with the pre-de-identification state. The premise of this mechanism is that the mapping table stays strictly local: once leaked, an attacker can reverse-engineer all sensitive data. Multi-tenant isolation, mapping table encryption, and least-privilege access are therefore its security foundation.

Which Entities Detection Covers

Jnvoy's PII detection is built on Microsoft Presidio, supporting 20+ entity types. On top of that, it adds UK-localized recognizers covering NHS numbers, NI numbers, UK postcodes, and sort codes. For teams handling UK user data, these recognizers are more practical than generic entity detection.

Prompt injection detection targets three attack patterns: jailbreaks, instruction overrides, and system prompt extraction. The MCP security module additionally detects tool poisoning and key leakage in tool responses — a point worth noting given the current rapid expansion of the MCP ecosystem.

Audit logs are written to PostgreSQL for compliance traceability. The project also offers one-click generation of FCA and EU AI Act compliance report PDFs, mapping technical detection results to regulatory frameworks.

Microsoft Presidio is Microsoft's open-source PII detection and anonymization framework, combining regex, named entity recognition (NER) models, and contextual rules to locate sensitive entities. It supports custom recognizers and pluggable NLP engines, and is often used as the engineering foundation for compliance de-identification. FCA (UK Financial Conduct Authority) is the regulator for the UK financial industry, with explicit requirements around customer data handling, outsourcing, and record retention; the EU AI Act is the EU's risk-tiered regulatory framework for AI systems, imposing documentation, audit, and transparency obligations on high-risk scenarios. The compliance report generation mentioned in the article essentially maps technical detection and log data to these regulatory clauses, reducing the cost of manual evidence production.

Caching, Testing, and Deployment Form

On cost optimization, semantic caching is claimed to save 20% to 40% of LLM call costs. For scenarios with high-frequency repeated queries, this ratio directly affects inference budgets.

On engineering maturity, the project includes 164 automated tests, provides a one-click Docker startup stack, and includes a Slack connector for securing AI bot messages. These components show the author is trying to push Jnvoy from experimental script to deployable infrastructure.

Applicable Boundaries and Open Questions

The proxy model is not without cost. All requests pass through the local proxy, so added latency is unavoidable; PII detection itself requires compute resources, and throughput under high concurrency is the key variable in real-world deployment. The security of the reversible token mapping table also depends on the proxy's own level of protection — if the proxy is compromised, its ability to restore original values actually becomes an attack surface.

The project currently offers an online demo and a GitHub repository, and the author has expressed willingness to discuss architecture details. For teams that need to quickly meet compliance requirements without rewriting their model-calling layer, Jnvoy offers a low-refactoring-cost path — but performance and security boundaries in production still require independent verification.

One-line Summary

Open-source proxy Jnvoy intercepts and de-identifies LLM requests locally, covering privacy, prompt injection, and MCP security.

Paragraph Summary

Jnvoy is an open-source HTTP proxy that lets developers route all traffic through local security checks by simply swapping the LLM request URL, with no changes to business logic. It uses Microsoft Presidio to detect 20+ PII entity types and supplements with UK-localized recognizers, performing de-identification and response restoration via reversible tokens while also detecting prompt injection, jailbreaks, system prompt extraction, and MCP tool poisoning and key leakage. The project ships with PostgreSQL audit logging, FCA/EU AI Act compliance report generation, semantic caching (saving 20%–40% on call costs), multi-tenant mapping isolation, 164 automated tests, and a Docker deployment stack. The trade-offs are latency and throughput uncertainty from the local proxy, plus the security boundary of the mapping table itself.