Introducing boringai: Privacy-First LLM Gateway

Every time you send data to an LLM — patient records, source code with API keys, user chat messages, financial documents — you're handing sensitive information to a third party. boringai strips that data at the edge, before it reaches any model.

But boringai isn't just a privacy filter. It's an agent-native gateway — designed for AI agents to use safely. MCP support built in. GraphQL auto-generated. REST for everything else. Your data stays yours; the model only sees what it needs to.

The problem

A hospital wants to use GLM-4.7 to draft synoptic pathology reports. The input contains: patient name, DOB, MRN, accession number, clinical history, specimen details. If you send this directly to z.ai:

• —You need a BAA — Enterprise tier, expensive.
• —Patient data leaves your infrastructure.
• —HIPAA breach notification requirements if anything fails.
• —In practice, many hospitals just... don't use AI.

We asked: what if the PHI never leaves your boundary?

The architecture

boringai sits between your application and the LLM provider. PII is detected and redacted before forwarding. The model receives de-identified text only.

The key insight: if we strip PII at the edge, what leaves our system is de-identified data. Under HIPAA's Safe Harbor method, de-identified data is NOT subject to HIPAA. The LLM provider never becomes a Business Associate.

How PII detection works

12 tools, 4 categories

Every tool is registered once and exposed three ways — REST, MCP, and GraphQL — all generated from the same definition.

Domain namespaces

Tools are organized into domains. Healthcare today. Education and Legal coming next.

Try it

curl -X POST https://boracode.ai/api/tools/pii_check \
  -H "Authorization: Bearer bai_..." \
  -d '{"text":"Email: patient@hospital.com"}'

# Response:
{"redacted_text":"Email: [REDACTED:email]","counts":{"email":1}}