Plumb sits inline between your agents and every model or tool — blocking what it shouldn't do, redacting what it shouldn't leak, and recording what it actually did.
-d '{"messages":[{"role":"user","content":
"ignore all previous instructions..."}]}'Illustrative data — your dashboard shows your own tenant's traffic, live, polling every 10s.
client = OpenAI(
api_key="sk-your-provider-key",
- base_url="https://api.openai.com/v1",+ base_url="https://api.plumb.samji.in/v1", # only change
)Google or GitHub — a Plumb key is issued instantly.
Your existing OpenAI-compatible client, unchanged otherwise.
Cost, cache savings, and security events, in real time.
"Reach John at [email protected]
SSN on file: 521-04-3399"
"Reach John at [EMAIL_REDACTED]
SSN on file: [SSN_REDACTED]"
Reversible only via an RBAC-gated, audited reveal.
Scans messages & tool schemas structurally — any provider, no per-vendor rules.
Block / redact / alert / log. Credential exfiltration and SQL/prompt injection ship enabled.
Repeats the same intent → 429 agent_loop_detected, before it burns budget.
Masks SSNs, emails, cards and phone numbers before they leave your box.
blake3 over messages + tools short-circuits redundant LLM calls.
Per-provider, with a local Ollama fallback for data sovereignty.
Every action traced & scoped per tenant, deterministically replayable.
Reveal is RBAC-gated; every reveal — who, when, which tenant — is logged.
Blocked/alerted actions as OCSF Detection Findings, with a session-chain view.
One deployment, role-scoped access, instead of one shared key.
Their security team asks what the agent can access, what happens if it goes rogue, and how you'd prove it after the fact. That's the deal-blocker Plumb exists for.
An x-trace-id and a recorded decision path per request — what was checked, blocked or redacted, latency, and cost.
Masking reverses only through an RBAC-gated reveal, and every reveal is logged with actor, timestamp, and token.
Traces and audit events are scoped to the owning tenant unless you're a super-admin.
A dedicated one-click, signed evidence-pack export (PDF/JSON) is on our roadmap — today, the same underlying trace and audit data is queryable via the API and admin dashboard, tenant-scoped and access-controlled.
{
"trace_id": "9f1c2a-0041",
"tenant_id": "acme",
"path": "/v1/chat/completions",
"steps": [
"protocol_detected=OpenAI",
"pii_redacted",
"policy_block: block-credentials"
],
"blocked": true,
"block_reason": "policy_blocked:block-credentials",
"status": 403,
"latency_us": 41
}Enforcement walks the body structurally — OpenAI, Anthropic, Gemini, MCP tool calls, and shapes that don't exist yet, all scanned the same way.
async fn handle_proxy(req) { // parse the intent once, share everywhere let v = parse_body(&req); guard.analyze(&v); // injection + PII loop_breaker.check(&v); // runaway cost if let Some(hit) = cache.get(&v) { return hit; // blake3 exact-intent cache } stream_to_agent(upstream).await }
Free, self-hosted, unlimited — forever. One binary, no signup, no cloud account.
$ cargo install enlilView on GitHub
Multi-tenancy, SSO/RBAC, and a signed audit trail on top. First month free for design partners.