Data Protection - Barndoor AI | Secure Access and Governance for AI and MCP

Data protection

One policy engine enabling enterprises to inspect, transform, or block sensitive data at every prompt, tool call, tool response, and answer.

Works with both Barndoor LLM Gateway and MCP Governance

You set the policies. Barndoor enforces them.

Prevent PII leaks, social engineering attempts, prompt injections, data exfiltration, and more.

LLM Gateway

LLM prompt

WHAT GETS CAUGHT

PII, credentials, API keys, sensitive data, and more

LLM response

WHAT GETS CAUGHT

Generated PII, policy violations, sensitive data in outputs, and more

MCP Governance

MCP tool input

WHAT GETS CAUGHT

Confidential data exfiltration, indirect prompt injection, malicious instructions, and more

MCP tool output

WHAT GETS CAUGHT

PII, confidential files, data exfiltration to third-party servers, and more

Enforce data protection across every prompt, tool call, and response

METHODOLOGY

How it works

Detects

Pattern-based

regex

Built-in classifiers for well-formed values used to match character combinations in strings.

Model-based

transformer

Natural language classifiers that read surrounding context. Same mechanism powers prompt detection.

Custom

user-defined

Your own patterns or example-based for formats specific to your business. Configured in the policy editor.

Key capabilities

PII, secrets, injections under one policy

Detection groups bundle SSNs, cloud keys, API tokens, DB credentials, and prompt injection patterns into a single reusable rule you attach to any enforcement policy.

Enforce data policies across any LLM or MCP server

Data protection designed for agents, connected MCP, and any model.

Apply data policy by person, groups, and roles

Scope enforcement to specific groups and roles based on your identity provider.

Enterprise data protection across LLMs and MCPs

CAPABILITY

LLM Gateway

Detection & Redaction

Who Policies Apply To

Solution Scope

MCP Governance

Detection & Redaction

Who Policies Apply To

Solution Scope

Detection & Redaction

Inspect prompts, responses, and tool I/O for sensitive content.

PII & credential detection

Regex + transformer detectors

Tokenize, mask, redact, omit

Per-field redaction options

Custom detectors

Your patterns or example-based rules

Direct prompt injection & jailbreak detection

User prompts to the model

Indirect prompt injection detection

Malicious instructions in tool/MCP responses

WHO POLICIES APPLY TO

Identity-aware scoping powered by your IdP.

All users

Groups via IdP

Okta, Azure AD, Google Workspace

Agents & service identities

Non-human callers, scoped credentials

SOLUTION SCOPE

Where each policy can target

Per-model

Different rules for all your LLM models

Per-tool / per-MCP server

Different rules per connected tool

Metadata-condition policies

Match on tool name, arguments, headers

Built for enterprise environments

Deploy Barndoor where you need it—with the architecture and controls your organization requires.

SaaS

Fully managed deployment for fast setup and ongoing updates.

Private Cloud

Deployed in your cloud environment to meet security and compliance requirements.

On-Prem

Run entirely within your infrastructure for maximum control and data residency.

Frequently asked questions

AI agents can leak sensitive data through MCP when they pass context they’ve already retrieved. These include customer records, internal documents, account numbers and more that are used as arguments into the next tool call.

A single user prompt can fan out into a dozen tool calls. For example, an agent querying a CRM, enriching the data with a third-party server, and summarizing a document from SharePoint can expose SSNs, financial identifiers, and confidential content before a human ever sees a response.

Barndoor data protection provides the DLP enforcement layer for MCP tool calls. Barndoor MCP Governance sits between every agent and every MCP server it’s allowed to call, and Barndoor data protection runs inline on every tool input and output, applying tokenization, masking, redaction, or blocking per policy before the call continues.

Indirect prompt injection is when malicious instructions are embedded inside content an agent retrieves such as a document, a ticket, a wiki page that the agent then follows because it can’t distinguish data from instructions. The content comes back from the server, lands in the agent’s context window, and the agent acts on whatever it says.

Barndoor MCP Governance runs a transformer-based classifier on every tool output before that content reaches the model, flagging and blocking injection attempts before the agent ever reads them. This is a distinct enforcement layer from what an LLM gateway provides because by the time a prompt injection reaches the model, it’s already inside your context.

No, an LLM gateway governs what goes to the model and what comes back, but MCP tool calls are a separate traffic surface that an LLM gateway never sees.

When an agent calls a CRM, queries a data warehouse, or writes to a ticketing system, those requests route directly to the MCP server and bypass the LLM model entirely.

Barndoor MCP Governance covers the tool surfaces: every input an agent sends to an MCP server and every output that comes back. Barndoor data protection supports both and uses the same detector classes and transformation options as the Barndoor LLM Gateway so teams don’t maintain two separate sets of rules. For full DLP coverage across an agentic workflow, you need both.

Barndoor data protection offers seven transformation options for MCP tool traffic: block, redact, mask, omit, tokenize, alert-only, and allow. Each is suited to a different combination of sensitivity level and whether the receiving server needs to operate on the value.

The choice comes down to two questions: does the MCP server need the real value to function, and is any transformed version acceptable to pass through at all? If the answer to both is no, block, so the call never leaves Barndoor MCP Governance.

If the server needs to match or process on the value, tokenize: the real identifier is swapped for a reversible placeholder before the request leaves your environment, the MCP server runs the lookup against the token, and the original is restored on the way back.

If the server doesn’t need the value but the agent needs to know a value was there, redact or mask, redaction replaces it with [REDACTED]. Masking preserves a useful suffix like the last four digits of an SSN. If the field shouldn’t appear at all, omit drops it entirely with no marker.

Alert-only passes the content through unchanged but logs the detection, useful early in a rollout when you’re measuring hit rates before turning on enforcement.

Allow creates an explicit exception for a server or value pattern that should never generate noise.

A single policy in Barndoor MCP Governance can apply different transformations to different tools on the same server, scoped by user group or agent identity.

Deploy enterprise AI agents with confidence

Start a free trial and get setup in minutes.