Lucairn Privacy Gateway

by Declade

350 downloads

Not rated

GitHub

About

Lucairn is an EU-based privacy gateway that sits between your MCP-enabled agent and the upstream LLM (Claude, GPT-4o, o1/o3/o4).

Details

Author: Declade
Downloads: 350
Categories: Other, Security, AI

- EU-based privacy gateway for AI agents
- Pseudonymizes PII before the upstream model
- Returns a signed verification receipt per request
- Free Developer tier: 500 requests per month
- Bring your own provider key (BYOK) for OpenAI or Anthropic
- Routes models automatically based on prefix and keys

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Lucairn Privacy Gateway

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

From the repository

Run npx -y @lucairn/mcp-server to start the server. Configure your MCP client (e.g., claude_desktop_config.json) with the command and environment variables LUCAIRN_API_KEY, ANTHROPIC_API_KEY, and/or OPENAI_API_KEY. The server exposes one tool, chat_via_lucairn, which you call with a messages-style payload.

`chat_via_lucairn`

Send a chat request through the Lucairn privacy gateway with cross-provider BYOK (Anthropic + OpenAI). PII is detected and replaced with placeholders before reaching the upstream LLM. The gateway picks the upstream provider based on the `model` parameter: `claude-*` / `anthropic-*` use ANTHROPIC_API_KEY; `gpt-*` / `openai-*` / `o1-*` / `o3-*` / `o4-*` use OPENAI_API_KEY. Wire format follows the Anthropic Messages API. Developer-tier responses contain raw placeholders; Pro and Enterprise tiers can enable automatic re-linking back to the original values.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "lucairn privacy gateway": {
            "lucairn": {
                "url": "https://gateway.lucairn.eu/mcp",
                "headers": {
                    "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
                }
            }
        }
    }
}

McpServers

{
    "lucairn": {
        "url": "https://gateway.lucairn.eu/mcp",
        "headers": {
            "Authorization": "Bearer <YOUR_LUCAIRN_API_KEY>"
        }
    }
}

MCP server that pseudonymizes PII before your LLM sees it and returns a cryptographically signed receipt for every response.

Official client libraries forLucairn— an EU-based privacy-preserving AI gateway. Lucairn sits between your application (or AI agent) and the upstream LLM provider you choose, removes personal data from prompts before the model ever sees them, and returns a signed Lucairn Certificate proving what was redacted, when, and by which sanitizer layer.

This monorepo hosts four packages at parity:

- @lucairn/mcp-server— Model Context Protocol server (one-linenpxinstall for Claude Desktop, Cursor, Cline, Continue, …)
- @lucairn/sdk— TypeScript / Node SDK
- lucairn— Python SDK
- github.com/declade/lucairn-sdks/go— Go SDK

For most agent use cases, the fastest path is the MCP server. No build step, no install —npxruns it on demand:

Add it to your MCP client config (Claude Desktop'sclaude_desktop_config.json, Cursor'smcp.json, Cline'scline_mcp_settings.json, Continue, etc.):

{ "mcpServers": { "lucairn": { "command": "npx", "args": ["-y", "@lucairn/mcp-server"], "env": { "LUCAIRN_API_KEY": "<your_lucairn_api_key>", "ANTHROPIC_API_KEY": "<optional_byok_anthropic_key>", "OPENAI_API_KEY": "<optional_byok_openai_key>" } } } }

Restart your client. Thechat_via_lucairntool becomes available immediately. Seemcp-server/README.mdfor full details.

Each request through any Lucairn SDK follows the same pipeline:
- PII detectionruns on every user message in three layers:

- Layer 1— Known-entity matching (your tenant's named entities)
- Layer 2— Presidio NER (names, emails, IBANs, addresses, phone numbers, customer IDs, …)
- Layer 3— GPU-hosted custom-trained PII shield (Enterprise tier only, optionally trained on your domain corpus)

- Developer (free)— placeholders are returned verbatim. Useful for testing the redaction surface.
- Pro / Enterprise— placeholders are re-linked back to the originals on the gateway before the response reaches your application.

For Lucairn-hosted Developer-tier callers, on-gateway pseudonymization happens before your LLM sees the request. Enterprise self-host deployments can run the entire stack inside the customer environment, in which case no raw identity data leaves that environment at all.

The gateway picks the upstream provider from themodelparameter you send:

Cross-provider BYOK shipped in@lucairn/mcp-server@1.1.0— set one or both keys in the same MCP config and the server forwards the matching one asX-Upstream-Keyper request, so your provider account is billed directly.

All SDKs are at parity at the observable level. Cross-language byte-equivalence is locked via shared Go-assembler-generated fixtures, so a certificate signed via one SDK verifies identically via the other two.

Pro adds response re-linking, programmatic certificate JSON access, audit-event export, and higher quota. Enterprise adds self-host, BYOK with provider-side billing isolation, and the optional custom-trained PII shield (priced per scope).

See https://lucairn.eu/pricingfor the full tier comparison.

Every response through any SDK gets a signed Lucairn certificate. Two surfaces:

- HTML summary— DPO-friendly, available on every tier including Developer (free). UsegetCertificateSummary(TS) /get_certificate_summary(Python) /GetCertificateSummary(Go), or paste the certificate URL into https://lucairn.eu/verify.
- JSON certificate + local Ed25519 verify— Pro tier and above. UsegetCertificate+verifyCertificate(and language equivalents). The verifier is in-tree — see ts/src/verify-certificate/,python/src/lucairn/verify_certificate/, and theinternal/verifypackage under go/.

External RFC 3161 + Sigstore Rekor anchor verification is currently surfaced as pass-through metadata; full external anchor verification lands in a follow-up release.

Production packages are versioned independently and tagged per the table above. Cross-language byte-equivalence is locked via shared fixtures. Follow CHANGELOG.mdfor release notes.

- Main site:https://lucairn.eu
- Sign up (free Developer tier):https://lucairn.eu/account/signup
- Pricing:https://lucairn.eu/pricing
- MCP setup guide:https://lucairn.eu/developer/mcp
- OpenAI SDK setup guide:https://lucairn.eu/developer/openai
- Verify a certificate:https://lucairn.eu/verify
- Glama listing:https://glama.ai/mcp/servers/Declade/lucairn-sdks
- mcp.so listing:https://mcp.so/server/lucairn-privacy-gateway/Declade
- npm —@lucairn/mcp-server:https://www.npmjs.com/package/@lucairn/mcp-server
- npm —@lucairn/sdk:https://www.npmjs.com/package/@lucairn/sdk
- PyPI —lucairn:https://pypi.org/project/lucairn/

See CONTRIBUTING.md. Security reports:SECURITY.md.

Local, privacy-preserving PII detection & redaction over MCP: the model works on shape (schemas, synthetic twins, masked output) while local code touches the real values and returns only masked, aggregated results. Deterministic (Presidio + checksums, AU ABN/ACN/TFN), no LLM calls, no runtime network.

Zero-Trust Data Sanitization (ZTDS) local PII and secrets scrubber for secure LLM pipelines.

Paid remote MCP for LLM trace PII scanning, payload redaction, sensitive field classification, privacy receipts, and trace audit exports.

Waqi — hosted MCP server that redacts PII from your business tools before the AI sees them. Audit log included.

Security and compliance layer for MCP agents. The analyze_prompt tool checks any input — user messages, RAG retrievals, tool outputs — for prompt injection (22 deterministic signatures, 7 languages) and PII before your model sees it. Every verdict returns a signed audit record (SHA-256 + UUID + UTC) you can retain as GDPR Art. 30 evidence. Free tier: 10,000 requests/month.

KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in. PQC-01-STIG-V1R1 — Full Whitepaper → 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory. The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.

Comprehensive audit logging for agent-to-agent interactions — immutable event trails, tamper-evident hashing, structured log export (SIEM-compatible), and compliance-grade retention for regulated industries.

Cryptographic runtime governance for AI agents. 20 tools. Sealed policy artifacts, continuous measurement, tamper-evident proof. Ed25519 + SHA-256.

AI Agent Supply Chain Security - Intercepts and validates every package installation, git clone, and script download triggered by AI coding agents before it executes.

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

Lucairn Privacy Gateway

About

Details

Jump to

Setting up with Highlight

Setting up with Cursor

JSON

JSON

JSON

Setting up with Claude Desktop

JSON

JSON

JSON

Setting up with Windsurf

JSON

JSON

JSON

Setting up with Cline

JSON

JSON

JSON

Setting up with Goose

JSON

JSON

JSON

From the repository

`chat_via_lucairn`

Claude Desktop / Cursor

McpServers

Install

About

Details

Jump to

Setting up with Highlight

From the repository

chat_via_lucairn

Claude Desktop / Cursor

McpServers

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Context 7

Reactive Resume

`chat_via_lucairn`