Control what AI can see
Sensitive reads from supported services can be reviewed before the content enters the AI context. Optional PII detection runs locally.
Open source · Local-first · Human-in-the-loop
Give AI assistants access.
Not authority.
PrivacyFence sits between an MCP-compatible AI assistant and supported business systems, adding independent policy, human approval, PII checks and audit before sensitive reads or actions are executed.
AI assistant
PrivacyFence
PolicyHuman approvalPII checksAudit
GmailDriveSlackSalesforceJiraConfluenceCalendarMore
PrivacyFence governs defined connectors and supported operations. It is not a generic proxy for arbitrary MCP tools.
Why PrivacyFence
Permission does not equal intent.
Traditional access control can tell you whether a user may access a system. It does not necessarily tell you whether an AI assistant should perform this specific action, on this specific data, right now.
Control what AI can do
Writes and consequential operations can require explicit approval, with the intended action shown in business terms.
Keep the decision independent
The AI assistant is not the authorization boundary. PrivacyFence applies policy and approval separately from the model making the request.
Informed human approval
See the content before the AI does.
PrivacyFence translates supported operations into human-readable review screens. Instead of approving an opaque tool name or JSON payload, you can inspect the content, target, warnings and reason for the request.
- Review the actual content or action
- See locally detected PII warnings
- Understand why the assistant requested access
- Record accepted, denied and automated decisions locally
Actions need context too
Review what will change before it changes.
For supported write operations, PrivacyFence presents the target and values before execution, so approval is tied to the actual business action rather than a broad permission granted earlier.
Privacy by architecture
Your enterprise data does not need to pass through PrivacyFence infrastructure.
PrivacyFence is designed so credential ownership, policy enforcement, PII checks and audit can remain in the environment you control. Credentials stay in the PrivacyFence daemon rather than the AI-facing bridge.
PrivacyFence runs on macOS, Windows and Debian/Ubuntu Linux, integrating with Claude through MCP. IT can instead opt into org mode — one shared instance on a Linux server, with each person signing in through your organization's own identity provider — for centralized, multi-user deployment. Neither mode runs on PrivacyFence-operated infrastructure. The project governs a defined set of enterprise connectors and operations.
Supported services
Built around real business workflows.
PrivacyFence provides connector-level governance for common enterprise systems rather than pretending every arbitrary MCP tool is understood.
GmailGoogle DriveGoogle DocsGoogle SheetsCalendarContactsTasksSlackTelegramSalesforceJiraConfluence
See governed operations on GitHub →
Open source
Run it yourself. Inspect everything.
PrivacyFence is released under Apache 2.0. Try it locally, inspect the implementation, and tell me what does not work.
0 release downloads
0 GitHub stars