Deliverd Screen · open source, MIT
A check before every prompt.
Open source, and it runs on your machine.
Find and redact personal data, secrets and your own confidential terms before text goes to an AI model. For TypeScript, Python and Rust, with no account, no key and no network call.
Try it
Paste a prompt and see what would leave.
The same detectors as the packages, running in this page. Nothing you type is sent anywhere.
The model would receive this, with placeholders that restore() puts back in its answer.
Reply to [EMAIL_1] about the refund to [IBAN_1]. She rang from [PHONE_1] on Tuesday and wants it by Friday.
It contains 1 email address, and goes to the model, which is not approved to receive personal data.
It contains 1 phone number, and goes to the model, which is not approved to receive personal data.
It contains 1 IBAN, and goes to the model, which is not approved to receive personal data.
Checked in this browser by the code in the npm package. Nothing you type leaves this page.
Install
One package for each language.
import { screen } from "@deliverd/screen";
const checked = await screen("Reply to mary.byrne@example.ie about IBAN IE29AIBK93115212345678");
checked.text; // "Reply to [EMAIL_1] about IBAN [IBAN_1]"
const answer = await model.generate(checked.text);
checked.restore(answer); // the real values, back in the answerWhat it finds
Structured identifiers, secrets and your own words.
Email addresses, phone numbers, IBANs, payment card numbers (Luhn-checked), UK National Insurance numbers, Irish PPS numbers, US Social Security numbers, IP addresses, dates of birth, API keys and tokens, private keys, passwords in connection strings and .env files, words that mark special-category data such as health or religion, and your own terms.
Allow
Nothing the model may not receive. Send the text as it is.
Redact
Values become placeholders such as [EMAIL_1]. Send the rest, and restore() puts them back in the answer.
Ask
A person has to decide, special-category data by default. The library can't ask anyone, so it says no and says why.
Deny
Send nothing. Secrets are refused by default: a key sent to a model is a key disclosed.
Where it runs
Wherever text is about to reach a model.
In code
screen() before you call a model, with the same answer in all three languages.
In the Vercel AI SDK
screenMiddleware() wraps a model, screens the whole conversation and restores the answer, streamed ones included.
In CI and pre-commit
The deliverd-screen command fails a build when an eval set or a fixture has a customer's details in it.
In your coding agent
A local MCP server with one tool, screen_text, for Claude Code, Cursor or Codex. It never returns the values it replaced.
With your own model for names
A detector is any function from the text to spans. Adapters read a Hugging Face token classifier's or a Presidio analyzer's output.
Held to one set of cases
The three packages, the SDKs and the servers are tested against the same shared cases, so they find the same things.
In Deliverd
When a person has to decide: Data Gate
A library can tell you to stop. Deliverd's Data Gate makes the call. The same detectors run on your machine and send only the counts, such as two email addresses and one IBAN. The verdict comes from your organisation's policy and from what your AI register approves each model to receive. On an ask, the question goes to the right person in Slack, Teams, email or on their phone, and every check is recorded.
Included on Team, Business Starter, Business and Enterprise. On Free it runs report-only: checks are recorded and nothing is held back, so you can see what it would have stopped.
Questions
What it does, and what it doesn't.
Does my text leave my machine?
Not with the library. It makes no network call, and needs no account or key. With Data Gate, the detectors still run where your agent runs, and Deliverd receives only the counts of what was found.
Does it find people's names?
Not reliably on its own, because a name looks like any other word. Plug in a model you run yourself, such as a Hugging Face token classifier or Presidio, and names are found as well as that model finds them.
Is redacted text anonymous?
No. Redacted text about a person is still personal data under GDPR. Screen means fewer identifiers sent, never proof that a prompt was clean.
What licence is it under?
MIT. The TypeScript and Python packages have no runtime dependencies, and the Rust crate's library has one, regex.