privllm is a self-hosted, OpenAI-compatible privacy gateway for AI agents. It transparently redacts sensitive data before it reaches upstream LLM providers, then restores the original values in the response so the client never sees aliases, and the provider never sees secrets.

privllm is not a one-way scrubber. It performs a bidirectional rewrite:

• Outbound: Every string in the request is scanned. Detected values are replaced with stable, realistic aliases and stored in an in-memory mapping table.
• Inbound: Every string in the response is scanned. Known aliases are replaced with their original values before the client sees them.
• Stable aliases: The same original value always gets the same alias within a namespace/TTL window, multi-turn conversations stay consistent.
• Namespace isolation: Each client API key gets its own isolated mapping (SHA-256 hash of the bearer token). No cross-tenant leakage.
• TTL-bounded: Mappings expire after a configurable TTL (default 12 hours).
• Schema-aware: For chat completions, content in all messages (user/system/developer/tool/assistant) is redacted.

privllm proxies to a single upstream provider defined in the config file. Clients point directly at privllm's address and pass their own real API key — it is forwarded unchanged.

export OPENAI_BASE_URL="http://127.0.0.1:8080/v1"
export OPENAI_API_KEY="sk-your-real-api-key"

This works with any OpenAI-compatible SDK, CLI, or agent framework.

Configure opencode (~/.config/opencode/opencode.jsonc) to route through privllm:

{
  "$schema": "https://opencode.ai/config.json",
  "model": "privllm/deepseek-v4-flash",
  "provider": {
    "privllm": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "PrivLLM",
      "options": {
        "baseURL": "http://127.0.0.1:8080/v1",
        "apiKey": "{env:OPENAI_API_KEY}"              // your API key for the provider defined in privllm.toml
      },
      "models": {
        "deepseek-v4-flash": {
          "name": "DeepSeek V4 Flash"
        }
      }
    }
  }
}

opencode sends requests → privllm redacts → upstream responds → privllm restores → opencode sees originals. Privllm logs the alias mappings locally — the upstream provider never sees the real values.

GOOSE_PROVIDER=openai \
GOOSE_OPENAI_BASE_URL=http://127.0.0.1:8080/v1 \
GOOSE_OPENAI_API_KEY=$OPENAI_API_KEY \
goose run

curl http://127.0.0.1:8080/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "deepseek-v4-flash",
    "messages": [{"role": "user", "content": "My email is john.doe@acmecorp.com"}]
  }'

The response will contain john.doe@acmecorp.com restored, the provider saw only user-a1b2c3@example.local.

privllm --bind 127.0.0.1:8080 --config privllm.toml

Default config (OpenAI upstream, 12h TTL, all categories enabled, blacklist.txt):

blacklist_path = "blacklist.txt"

[upstream]
base_url = "https://api.deepseek.com/v1"

[mapping]
ttl_hours = 12

[redaction]
urls      = true
domains   = true
emails    = true
paths     = true
ips       = true
phone_numbers = true
credit_card_numbers = true
social_security_numbers = true
names     = true
addresses = true
headers   = true
secrets   = true
blacklist = true

Disable any category by setting it to false. Use DeepSeek, Anthropic, or any OpenAI-compatible provider by changing upstream.base_url.

• GET /v1/models
• GET /v1/models/{model}
• POST /v1/chat/completions (streaming + non-streaming)
• POST /v1/responses (streaming + non-streaming)
• POST /v1/embeddings (non-streaming)