Blekline masks secrets and PII, enforces tool policy, and writes metadata-only audit events before prompts and tool calls reach models. Start on Local (free). You do not need to clone the open-source repo.
1. Who you are
| Path | Best for | Platform fee | Start here |
|---|---|---|---|
| Local | Local hooks and stdio MCP — secrets never leave your machine | $0 | Blekline Local |
| Mark | Hosted MCP, team policy, active PII vault (Blekline-held key) | $499/mo | Mark-hosted |
| Redact | In-cluster sidecar, K8s admission, customer vault on PVC | $1,490/mo | Enclave AKS |
| Enterprise | In-VPC admission, SSO/SCIM, Sentinel, optional eBPF | from $5k/mo | Enterprise in-VPC |
Create a workspace — Local is local mask only; Mark adds hosted proxy and vault. Enclave node billing is a Redact+ data-plane SKU. Full matrix: Plan comparison · Pricing FAQ.
2. Connect a client
Wedge order (do one, then expand):
| Client | What you get | Guide |
|---|---|---|
| Claude Code | Project .claude/ MCP — mask and evaluate tool calls in the CLI | Claude Code |
| Claude Desktop | Workspace OAuth connector or local stdio MCP | Claude connector · Desktop |
| Cursor | MCP + chat hooks (block + clipboard on native chat) | Cursor |
Other surfaces: VS Code (extension first) · MCP self-serve eval · browser extension.
3. Prove it
- Send a test prompt that includes an email address or a fake API key.
- Confirm the model sees the masked text.
- Open Operations → Activity — events are metadata only (no raw prompt storage). See Data handling.
Platform and cluster eval
Need in-VPC Trust Vault or a merge-blocking cluster gate? After the Local path:
- [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart) (no account required)
- Enclave AKS · Docker sidecar
- [Eval journey](/docs/get-started/eval-journey) — Track 01 / 02 / 03
Next: Quick Start · Plan comparison · Claude Code · Open workspace