# boringai

> Privacy-first, agent-native LLM gateway. Strips PII at the edge before any token reaches a provider.

boringai is an LLM gateway that strips sensitive data (PII, credentials, PHI, secrets) from payloads before forwarding to AI model providers. It sits between your application and the LLM. Sensitive data enters; de-identified text exits. The model provider never sees the original.

## Tools

Tools belong to a **domain** namespace: `healthcare`, `education`, `legal`, or `general` (default). Every tool works through the same three transports (REST, MCP, GraphQL). The same tool can be invoked domain-scoped or unscoped.

- **pii_check** (healthcare): Strip PII from text. 4 methods (mask/replace/hash/shift_dates), 4 profiles (HIPAA/GDPR/research/minimal), 14 categories.
- **hl7_redact** (healthcare): Field-aware PII redaction for HL7 v2 messages.
- **draft_synoptic_report** (healthcare): Draft CAP protocol pathology reports. Reviewer-gated output.
- **simplify_for_patient** (healthcare): Translate medical reports to plain language. 11 languages including Kiswahili, Luganda, Runyankole.
- **clinical_ner** (healthcare): Extract clinical entities from text.
- **drug_interactions** (healthcare): Check drug-drug interactions.
- **icd10_lookup** (healthcare): Look up ICD-10 codes.
- **lab_interpret** (healthcare): Interpret lab results.
- **medical_translate** (healthcare): Translate clinical text.
- **image_analyze** (healthcare): Analyze medical images.
- **scan_interpret** (healthcare): Interpret medical scans.
- **batch** (general): Execute any tool on multiple documents.

## Quick start

POST /api/tools/pii_check
Authorization: Bearer bai_your_key
Content-Type: application/json
{"text": "Email: patient@hospital.com"}

Domain-scoped (only tools in that domain are listed/invoked):

GET /api/healthcare/tools       → list healthcare tools only
POST /api/healthcare/tools/pii_check  → execute under the healthcare domain
POST /api/healthcare/mcp        → MCP JSON-RPC scoped to healthcare

## Endpoints

- POST /api/tools/{name} — Execute a tool, unscoped (searches all domains, backward-compat)
- GET /api/tools — List all tools with schemas (all domains)
- POST /api/[domain]/tools/{name} — Execute a tool scoped to a domain (404 if tool not in domain)
- GET /api/[domain]/tools — List tools in a domain
- POST /api/mcp — MCP JSON-RPC (tools/list, tools/call), all domains
- POST /api/[domain]/mcp — MCP JSON-RPC scoped to a domain
- POST /api/graphql — GraphQL (auto-generated)
- GET /api/health — Health check
- GET /api/usage — Usage summary

## Links

- [Full docs](/docs)
- [Playground](/playground)
- [GitHub](https://github.com/afrog33k/boracode)