GitHub Tool Anonymizes Pentest Data for AI

Overview

A new open-source project called DontFeedTheAI is addressing a growing privacy concern for cybersecurity professionals and developers who rely on large language models for sensitive workflows. The tool acts as a transparent proxy that intercepts data before it reaches an AI API, stripping out personally identifiable information, credentials, and internal infrastructure details. It then replaces that sensitive data with anonymized surrogates, ensuring that cloud-based models never see the real underlying information.

The project has gained attention in the pentesting and security engineering communities as a practical solution to the dilemma of using powerful AI tools in regulated or confidential environments. By running detection layers locally on the user's machine, the proxy guarantees that no private data crosses the boundary to external servers. This architecture allows teams to leverage cloud reasoning capabilities without exposing client IP addresses, domain names, or authentication tokens.

How It Works

The core innovation of DontFeedTheAI lies in its two-layer detection pipeline. The system operates as a man-in-the-middle between the user’s shell or application and the LLM API. When a request is made, the proxy inspects the payload using two distinct methods: a regex layer for structured data and a local Ollama model for contextual prose.

The regex layer is designed to catch obvious technical artifacts. It scans for patterns such as IP addresses, cryptographic hashes, API keys, and tokens. These are typically easy to identify and can be systematically replaced with unique surrogate strings. For example, a real IP like 10.20.0.10 might be swapped for a placeholder like 203.0.113.47.

The Ollama layer handles more complex, unstructured data. Because raw regex cannot always understand context, a local large language model detects hostnames, organization names, and credentials embedded in natural language. This is critical for situations where a pentester might paste a snippet of code or a report paragraph containing sensitive references. Since this model runs locally, it can reason about what constitutes sensitive information without that information ever leaving the user's hardware.

Once the data is sanitized, the request is forwarded to the cloud API. The API processes the query using only the surrogates and returns a response. The proxy then reverses the process, swapping the surrogates back into the final output so the user sees their original data. This ensures that the workflow remains seamless while the data stream to the AI remains completely anonymous.

The proxy strips IPs, credentials, hostnames, and PII from every request before it reaches the AI, and restores them on the way back. This means the cloud model sees only surrogates, not the actual infrastructure.

Use Cases and Target Audience

While originally designed with penetration testers in mind, the tool’s applications extend to several other professional groups who handle sensitive data daily. Pentesters frequently run tools like Nmap, Mimikatz, and Bloodhound, producing outputs filled with real client infrastructure details. Running these outputs through an AI assistant can inadvertently leak internal network maps or credentials to third-party servers. DontFeedTheAI mitigates this risk by anonymizing the output before it is sent.

Developers and SREs in regulated industries also benefit significantly. When debugging production issues, engineers often need to analyze logs or configuration files that may contain internal hostnames or service endpoints. Sending these directly to an LLM for analysis violates many compliance frameworks. The proxy allows them to use AI for debugging while maintaining strict data boundaries.

Other potential users include legal and consulting firms that need to anonymize client contracts or case files, finance and compliance teams analyzing audit scripts, and researchers working with confidential datasets. In all these cases, the tool provides a way to use the best available reasoning models without sacrificing data privacy.

Technical Architecture and Security Model

DontFeedTheAI is built to work with any OpenAI-compatible client, including Claude Code, the OpenAI SDK, OpenRouter, and Requesty. This flexibility allows users to integrate the proxy into existing workflows with minimal changes. The tool supports deployment via Docker and includes a setup wizard to simplify configuration for both local and remote VPS environments.

The project documentation emphasizes a clear threat model. It explicitly contrasts its approach with alternative methods that fail to provide adequate protection. For instance, using a cloud-based anonymization API combined with an LLM still involves two third parties seeing the raw data. Similarly, using a local LLM like Ollama alone does not prevent the model from reasoning on real sensitive data if the user pastes it directly.

The tool includes testing utilities to verify its effectiveness. Users can run integration tests against a suite of 53 fixtures to ensure zero leaks in the anonymization pipeline. Additionally, a visual audit feature allows users to inspect every original-to-surrogate mapping in real-time, helping them verify that sensitive entities are being correctly redacted.

Critically, the project acknowledges its limitations. The audit page, which shows the full lookup table, is only accessible behind an SSH tunnel to prevent unauthorized reverse lookups. This design choice reflects a commitment to minimizing the attack surface even for the tool itself.

Getting Started

Installation is straightforward for users familiar with Python and Git. The repository can be cloned, and the included wizard.py script guides users through the setup process. For those without a VPS, the wizard can set up a local development environment using Docker Compose.

Works on Windows, macOS, and Linux. The setup process involves creating a virtual environment, installing dependencies, and configuring environment variables to point the LLM client to the local proxy.

Users are encouraged to review the documentation for supported providers and architecture details. The project is actively maintained, with a focus on expanding coverage for different types of sensitive data and improving the local detection models. As AI adoption grows in security and engineering teams, tools like DontFeedTheAI are becoming essential for maintaining operational security in an increasingly connected landscape.