When to use: Engineering teams who accept Blekline-operated keys and want hosted MCP, ingress proxy, and an active PII vault without running a cluster sidecar.
Architecture
flowchart LR
Client[Claude / Cursor / ingress] --> Proxy[Hosted MCP + /api/mask]
Proxy --> Vault[Active vault TTL]
Proxy --> Activity[Activity + audit]
Honesty: Standard is not zero-knowledge. Blekline holds vault keys and can decrypt for support and rehydration within policy.
Prerequisites
- Standard subscription ($199 / €199) — Billing
- Workspace token with
mask:write
Install
npx @blekline/init --path hosted
npx @blekline/cursor-hooks init
Confirm .blekline/policy.json has "maskBackend": "hosted" and .blekline/cursor.json has "promptMaskSource": "cloud".
Connect MCP (see Cursor or Claude Code).
Verify
- Send a test prompt with an email address through hosted mask.
- Confirm masked placeholders reach the model.
- Check Usage — hosted mask units increment toward 100,000 / month.
Operate
| Topic | Detail |
|---|---|
| Included volume | 100,000 hosted mask units / UTC month |
| Overage | $8 / €8 per 1,000 units (warn at 80%) |
| Vault | Active PII vault; Blekline-operated DEK |
| Fleet path | Need in-cluster only? → Fleet sidecar |