Blekline | Non-Human Identity & Runtime Enforcement

Primary MCP client. Works in Agent, Composer, and Chat across all models.

Plug-and-play setup

pnpm install && pnpm build:packages
pnpm generate:mcp-configs --local

Set BLEKLINE_WORKSPACE_TOKEN in repo-root .env or webapp/.env.local before generating (or paste into generated configs).

Reload Cursor: Cmd+Shift+P → Developer: Reload Window

Verify:

Settings → MCP — blekline and blekline-proxy green
Settings → Hooks — Blekline hooks loaded
Send a test prompt with an email + fake AWS key — Blekline should block and copy masked text to clipboard

What you get

Layer	Behavior
Cursor hooks	Auto-mask on chat send + attachment guard + shell/tool/MCP/read guards
MCP server	`blekline_mask_prompt`, `blekline_evaluate_tool_call`, etc.
MCP proxy	Tool-call governance before downstream MCP
Project rule	Agent backup: call mask tools on sensitive content

BLEKLINE_CLIENT_SURFACE=cursor

Chat auto-mask (important)

MCP tools alone do not intercept Cursor's native chat HTTP path. Blekline ships Cursor hooks for chat ingress:

Your prompt is cloud-masked via /api/mask before the model sees it
If entities are found, the raw prompt is blocked (100% — secrets never reach the model)
A short notice appears (entity count + trace ID) — not the full masked body in chat
Masked text goes to clipboard — Cmd+V + Enter to send the safe version
That resubmit is recognized automatically (passthrough) and allowed through
Metadata-only audit events appear in workspace Activity (cursor_prompt_governance)

Auto-send without paste: Cursor's beforeSubmitPrompt hook cannot rewrite the compose box in-place (Cursor schema: continue + user_message only). True silent auto-send in native Cursor chat is not available today. For zero-click masking, use Ingress proxy on agents you control (SDK/LangChain/custom runtime).

Configure in .blekline/cursor.json:

Field	Default	Purpose
`promptPolicy`	`auto_mask`	Local mask + block + clipboard (default)
`promptGuardMode`	`local_first`	Skip scan path when nothing detected locally
`promptMaskSource`	`local`	Instant local mask on secrets (`cloud` = Azure, slower)
`showMaskedInUi`	`false`	Set `true` only for air-gapped demos (shows masked body in banner)
`emitAuditEvents`	`true`	Metadata events to Activity
`copyMaskedToClipboard`	`true`	Safe text on clipboard when blocked
`mcpGuardMode`	`local`	Local MCP scan only (no network on allow path)

`promptPolicy`	Behavior
`auto_mask`	Local mask + block + clipboard (default)
`block`	Cloud mask + block, no clipboard
`agent`	Block hard secrets locally only; fastest — no cloud on send
`off`	Disable prompt hook

Latency

Default (promptMaskSource: local): clean prompts <5ms; secret prompts masked in-process and blocked in <20ms — no network wait.

Cloud (promptMaskSource: cloud): only if you need Azure PII quality for DPO demos — max 3.5s, then local fallback.

Delayed block after cancel: fixed — hook no longer waits on /api/mask by default, so you should not see a redaction notice seconds after stopping.

Reload required: after config changes, quit and reopen Cursor (not just Reload Window).

Shell/tool/MCP hooks: local-only by default.

Repo config files

MCP: .cursor/mcp.json.example → .cursor/mcp.json
Hooks: .cursor/hooks.json.example → .cursor/hooks.json
Hook config: config/blekline/cursor.json.example → .blekline/cursor.json
Live: pnpm generate:mcp-configs --local

Headless verify

pnpm verify:integrations
pnpm demo:cursor-hook-smoke

MCP tools in Agent mode

blekline_mask_prompt — mask text via control plane before LLM/tool use
blekline_evaluate_tool_call — read-only tool policy check
blekline_log_governance_event — metadata-only audit event

The agent chooses when to invoke MCP tools. Hooks + rules add enforcement; hooks block unmasked chat sends when entities are detected.

Troubleshooting

MCP shows red / disconnected

Run pnpm build:packages
Regenerate: pnpm generate:mcp-configs --local (inlines token — do not rely on ${env:...} alone)
Reload Cursor

Tools show but calls fail with 401

Regenerate token in Admin → API keys with mask:write and events:write.

Hooks don't run / SyntaxError in Hooks log

Cursor expects "command": ".cursor/hooks/script.sh" (one path string). Do not use "command": "node" with separate args — Cursor feeds JSON to stdin of node alone and you get Unexpected token ':'.

After fixing .cursor/hooks.json, save the file (Cursor reloads hooks) or quit and reopen.

Prompt not masked automatically

Hooks block-and-replace via clipboard — paste masked text after block. If nothing happens, check token in .blekline/cursor.json and Billing tryout/subscription.

Agent never calls Blekline tools

Add or keep .cursor/rules/blekline-chat-guard.mdc. In Agent, explicitly test: Call blekline_mask_prompt with: ...

Model coverage

MCP is model-agnostic. One Blekline server covers all Cursor models. See Model Matrix.

Next steps: Quick start · MCP Proxy · Troubleshooting · Open workspace