When to use: Engineering teams who accept Blekline-operated keys and want hosted MCP, ingress proxy, and an active PII vault without running a cluster sidecar.
Architecture
flowchart LR
Client[Claude / Cursor / ingress] --> Proxy[Hosted MCP + /api/mask]
Proxy --> Vault[Active vault TTL]
Proxy --> Activity[Activity + audit]
Honesty: Mark is not zero-knowledge. Blekline holds vault keys and can decrypt for support and rehydration within policy.
Prerequisites
- Active Mark workspace — Billing
- Workspace token with
mask:write
Install
npx @blekline/init --path mark
npx @blekline/cursor-hooks init
Confirm .blekline/policy.json has "maskBackend": "hosted" and .blekline/cursor.json has "promptMaskSource": "cloud".
Connect MCP (see Cursor or Claude Code).
Verify
- Send a test prompt with an email address through hosted mask.
- Confirm masked placeholders reach the model.
- Check Usage — guarded tokens increment toward 3M / month.
Operate
| Topic | Detail |
|---|---|
| Included volume | 3M guarded tokens / UTC month |
| Overage | $150 / €150 per 5M GT after included pool (warn at 80%) — see in-app Billing |
| Spend cap | Default 2× platform fee ($998) — fail-closed at cap |
| Vault | Active PII vault; Blekline-operated DEK |
| Enclave path | Need in-cluster only? → Enclave AKS |