Definitions · I · Runtime enforcement
Ingress masking
Ingress masking redacts or tokenizes sensitive values in prompts and tool arguments before they reach models, sandboxes, or downstream MCP servers. Blekline applies mask decisions at the MCP proxy, SDK, and `/api/ingress/v1/*` boundary.
Ingress masking applies redaction or tokenization to prompts and tool arguments before they reach models, sandboxes, or downstream MCP servers.
Decision points
| Surface | API / tool |
|---|---|
| MCP client | blekline_mask_prompt, MCP proxy |
| SDK / API | POST /api/mask, /api/ingress/v1/* |
| Sidecar | Ingress proxy on agent pod network path |
Mask outcomes include allow, mask (placeholder), or block — evaluated against workspace policy and never-share keywords.
In Blekline
- Configure baseline rules in
/onboarding(step 2) and/operations/policies. - Trust Vault tokenization is a stronger variant for secrets — see Trust Vault.