Local-first privacy for agents and LLM calls

Open source · Apache-2.0

Mask sensitive Chinese data before it ever leaves the machine.

YinShield sits between your app and the model. It detects Chinese PII locally, replaces it with placeholders or stable aliases, and restores the response after inference. It ships as a Python package, a local HTTP bridge, and a thin OpenClaw plugin.

Start In 2 Minutes

OpenClaw Setup Read Docs View GitHub

Chinese PII ready
Placeholder and alias modes
OpenClaw and OpenAI-compatible flows
Token-protected local bridge

Local masking example

Raw input

收件人：张三，手机号13812345678，地址北京市朝阳区建国路88号。

Masked for model

收件人：<PERSON_1>，手机号<PHONE_1>，地址<ADDRESS_1>。

Restored for user

收件人：张三，手机号13812345678，地址北京市朝阳区建国路88号。

Launch snapshot

Placeholder precision 97.65%

Placeholder recall 97.65%

Recovery rate 100%

Recommended default Placeholder mode

46 tests passing

97.65% placeholder precision / recall

100% placeholder recovery rate

Mask locally, call the model, restore only after inference returns.

Why it exists

Most privacy tools are platforms. YinShield is the layer you can actually ship.

You do not need a vault, a data pipeline, or a control plane to start protecting prompts. You need a local layer that developers can install fast and agents can call consistently.

Built for current workflows

Ship the reliable path first, then expand.

Today the strongest default is placeholder mode: deterministic, reversible, and easier to reason about in production. Alias mode remains useful, but it should be framed as an advanced tradeoff rather than the default promise.

Placeholder mode is the safest launch shape
HTTP bridge keeps non-Python stacks simple
OpenClaw plugin stays thin on purpose

Why teams choose it

A tighter privacy boundary with less operational drag.

YinShield gives teams a local masking layer they can install quickly, validate locally, and plug into existing AI workflows without standing up a full privacy platform first.

Why it feels practical

Sensitive fields are replaced locally before inference, so the model sees placeholders instead of raw identifiers.
You can start from a deterministic placeholder flow, then move to alias mode only when your workflow benefits from more natural text.
Python package, local HTTP bridge, and OpenClaw integration cover the most common ways teams ship agent workflows today.

What teams can validate quickly

The current release already includes local tests across the core engine, HTTP API, installer, and OpenAI-compatible wrappers. On the bundled mini realistic benchmark, placeholder mode currently reaches 97.65% precision, 97.65% recall, and 100% recovery.

That gives teams a simple launch path: start with the clearest boundary, verify it locally, and expand only where the workflow asks for more.

Terminal demo

See the privacy boundary in one terminal window.

Run the local bridge, send one request, and inspect exactly what leaves the machine. This is the fastest way to understand what YinShield is doing for you.

$ pip install yinshield
$ yinshield serve --auth-token change-me
[yinshield] listening on http://127.0.0.1:27811

$ curl -X POST http://127.0.0.1:27811/mask \
  -H "Authorization: Bearer change-me" \
  -H "Content-Type: application/json" \
  -d '{"text":"我叫张三，手机号13812345678，地址北京市朝阳区建国路88号。","mode":"placeholder"}'

{
  "text": "我叫<PERSON_1>，手机号<PHONE_1>，地址<ADDRESS_1>。",
  "mapping": {
    "<PERSON_1>": "张三",
    "<PHONE_1>": "13812345678",
    "<ADDRESS_1>": "北京市朝阳区建国路88号"
  }
}

What this shows

Raw sensitive fields stay local while the outbound payload becomes deterministic placeholders.
The mapping remains available on the local side so restored output can stay readable for the user.
The same local bridge can then be reused by Python apps, HTTP clients, or the OpenClaw plugin.

Quick start

Show the boundary in under a minute.

OpenClaw

curl -fsSL https://yin-shield.site/setup-openclaw-yinshield.sh | bash

Python

from yinshield import Shield

shield = Shield(mode="placeholder", strategy="balanced")
masked, mapping = shield.mask("我叫张三，手机号13812345678")
restored = shield.unmask(masked, mapping)

Workflow

A narrow path with a clear boundary.

Detect locally

Recognize Chinese names, phones, ID cards, addresses, company IDs, order numbers, and more before the request leaves the host.

Replace intelligently

Choose strict placeholders for control or stable aliases for better semantic preservation. Persist sessions to keep multi-turn consistency.

Restore after inference

Send masked content to the model, then unmask the result for the operator or end user on the local side.

Integrations

Designed for where agents actually run.

The homepage keeps the shape simple. Full config, auth, and API details live in Docs.

OpenClaw plugin

Use YinShield as a thin privacy tool layer inside OpenClaw. Keep the plugin small and the masking engine in Python.

{
  "plugins": {
    "entries": {
      "openclaw-yinshield": {
        "enabled": true,
        "config": {
          "baseUrl": "http://127.0.0.1:27811",
          "mode": "placeholder",
          "authToken": "change-me"
        }
      }
    }
  }
}

See the full OpenClaw integration guide →

HTTP bridge

Bridge any local runtime with a simple API. This is the cleanest path for agent frameworks that do not want a Python dependency inside the host process.

POST /health
POST /mask
POST /unmask
POST /messages/mask

OpenAI-compatible clients

Wrap chat and responses flows with automatic masking, unmasking, streaming support, and provider compatibility through base_url.

client = ShieldedOpenAI(
  api_key="...",
  base_url="https://api.openai.com/v1"
)

Modes and strategy

Control the tradeoff instead of hard-coding one.

Placeholder mode

Best when you want deterministic masking and maximum control over what the model sees.

张三 → <PERSON_1>

Alias mode

Useful when downstream reasoning needs more natural text and stable identities across turns, but not yet the safest mode to market as the default.

张三 → 陈明

Policy strategy

loose, balanced, and strict give you control over coverage versus false positives.

balanced is the default