chunk-invariance MCP server

LLM-Shield-Proxy

LLM-Shield-Proxy is a self-hosted gateway for OpenAI-compatible LLM APIs. It replaces the personal data and secrets it detects (emails, card numbers, SSNs, API keys and more) before a request goes to the model provider, and puts the original values back into the streamed response before your application sees it. Your application changes only its base_url and the key it sends.

Already running LiteLLM? From LiteLLM 1.106.0 (released 2026-10-18) the Shield is a built-in guardrail, guardrail: llmshieldproxy: LiteLLM keeps its own routing and calls the Shield to redact each request and restore each reply. See LiteLLM's setup page. An older LiteLLM does not stop on that config: it logs one error line, Skipping guardrail 'llm-shield': invalid configuration, proxy is starting WITHOUT this guardrail: Unsupported guardrail: llmshieldproxy, starts, and every request reaches the provider unredacted. Check that line is absent from the startup log, or on an older LiteLLM use one of the wirings in Running behind LiteLLM.

Testing a gateway you already run, rather than adding this one? The benchmark checks whether it sends personal data to its model provider, with no model account and no install of this proxy.

Try it in a minute, with no API key

pip install llm-shield-proxy

UPSTREAM_BASE_URL=http://127.0.0.1:8765 UPSTREAM_API_KEY=unused VALID_VIRTUAL_KEYS=sk-demo llm-shield-proxy --port 4000 &

pii-leak-benchmark selfcheck --target-base-url http://127.0.0.1:4000/v1 --target-api-key sk-demo

The second command starts the proxy. The third sends prompts full of synthetic emails, SSNs, card numbers and API keys through it, and plays the model provider at 127.0.0.1:8765, so it can see exactly what the proxy forwarded. Nothing calls a real model. You should see:

CLEAN

  No fixture value reached the upstream; required restore checks passed.

  Data types tested
    TYPE               RESULT        WHAT IT MEANS
    AWS_ACCESS_KEY_ID  contained     never reached the upstream in this run
    CREDIT_CARD        contained     never reached the upstream in this run
    EMAIL              contained     never reached the upstream in this run
    GITHUB_TOKEN       contained     never reached the upstream in this run
    SLACK_TOKEN        contained     never reached the upstream in this run
    SSN                contained     never reached the upstream in this run

Run the same check with nothing in the middle (--target-base-url capture://self) and every row reads LEAK. On Windows PowerShell, use the PowerShell version of these commands.

Use it with your application

Shortened. The full README is on GitHub.