When to use: Developers on the Local plan who want Cursor, Claude Code, or Claude Desktop protected without sending prompts to Blekline-hosted mask APIs.
Architecture
flowchart LR
IDE[Cursor / Claude / Codex] --> Hooks[Local hooks]
Hooks --> LocalMask[Local mask engine]
LocalMask --> Model[Model or MCP stdio]
Secrets are masked on your machine. Blekline Activity receives metadata only when you configure a workspace token.
Prerequisites
- Workspace (Local)
- Node 20+
Install
npx @blekline/init --path local
npx @blekline/cursor-hooks init # if using Cursor
Set blw_... in .blekline/policy.json (maskBackend is local).
Verify
- Submit a prompt containing a fake API key in Cursor native chat.
- Confirm block + clipboard paste (not silent auto-send).
- Open Operations → Activity — event appears without raw prompt storage.
Operate
- Do not set
promptMaskSource: cloudin.blekline/cursor.jsonon Local — hosted mask requires Mark. - Upgrade to Mark hosted when you need team policy and 3M guarded tokens / month.