A lab that ships. The model never sees your patient records.
boracode is a software studio and experiment journal in Kampala. Most of what we try gets killed. boringai is the first one to survive — an LLM gateway that strips PII, credentials and secrets from any payload at the edge, before a single token reaches a provider. Two more are still running.
$ curl -s boracode.ai/api/tools | jq '.tools | length'
Three practices, one building.
Products fund the school. The school staffs the products. Research feeds both.
Build
We ship production software. boringai strips PII at the edge — real product, real users.
Teach
Coding bootcamps and AI workshops in Kampala. From UX research to distributed computing.
Experiment
We push boundaries. ML research, WASM compute, edge-deployed AI, healthcare standards.
Boring is the whole strategy.
The boring marketers got there first: unglamorous fundamentals, run consistently, compound — while the exciting tactic gets relaunched every quarter. The same is true of software. Boring means it does the work, says plainly what it does, and behaves on a Tuesday night exactly as it did in the demo.
Say what the thing does
The name, the docs, and the homepage all describe the same function. No metaphor.
Do the work, do not render a dashboard
The API is the product. The dashboard is a convenience layer on top, not the deliverable.
Take the unglamorous half
Regex PII detection is less impressive than a transformer. It is also 1000x faster and never hallucinates a false positive.
Ship the smallest thing that survives contact
v1 had four regex patterns and one endpoint. It worked. Everything else is iteration.
Kill it in public
The journal below lists what died and why. Honesty is the point.
Boring compounds
Each unglamorous fundamental added makes the next feature cheaper to build.
The experiment ledger.
boringai.
A privacy-first, agent-native LLM gateway. It sits between your application and the model provider. PII, credentials, and secrets enter. De-identified text exits. The provider never sees the difference.
Four methods, four profiles
mask / replace / hash / shift dates — under HIPAA, GDPR, research, or minimal. Audit trail on every call.
MCP, not a bolt-on
POST /api/mcp — tools/list and tools/call. Any MCP-compatible agent works out of the box.
One registry, three surfaces
REST, MCP, GraphQL — all generated from the same tool definitions. Add a tool once.
Tools a hospital can use
HL7 v2 field-aware redaction. CAP synoptic reports. 11 patient languages, six East African.
Bootcamps in Kampala.
Silver — Design & UX
Gold — AI & Advanced
Get a boringai API key.
Keys are issued in batches while the gateway is in preview. You get credits to test with, full access to all tools, and the APEX SDK if you're integrating with an LIS.
No card. Apache 2.0 core. Self-host anytime.
Ask AI about boracode.
Dig into our work in privacy-first AI, the boringai gateway, open-source medical tools, or East African language support. These links open AI assistants pre-loaded to search for us.
