Grepture

Grepture Proxy stands between an application and an AI provider and cleans the traffic on the way through. It detects and redacts personal data, blocks content you do not want leaving the building, and swaps sensitive JSON fields for tokens, all before the request reaches the model.

Each request carries a target header naming the upstream API, so one proxy can front several providers. It authenticates the caller, applies input rules, forwards the request, applies output rules to the reply, restores anything it tokenized and returns the result. Buffered and streaming responses both work, and token restoration spans streamed chunks. Rules sit in a JSON file that reloads when it changes or on SIGHUP, each with conditions, a target of input, output or both, and a sampling rate.

Actions are the part you configure.

• Redact PII: regex patterns catch email addresses, phone numbers, SSNs, credit cards, IP addresses, postal addresses and dates of birth.
• Find and replace: literal or regex substitution rewrites matching text.
• Tokenize: JSON fields become tokens, with the originals kept for restoration on the way back.
• Block request: the call stops with a status code and message you choose.
• Log only: the request is tagged for logging and passes through unchanged.

The proxy runs on Bun, listens on port 4001 and builds into a Docker image with the rules file mounted in. An optional API key restricts who may use it, and bodies over 50KB offload to S3-compatible storage during the log flush, after the client has its response.