gate: Instructions file for Claude Code

gate

PII-filtering CLI that transparently intercepts AI agent query commands and redacts sensitive data before it reaches the model context.

Notes

crates/gate/src/run.rs is the production Gate 1 + Gate 2 pipeline. Loads config, runs gate1::extract_columns + gate1::build_plan on the SQL arg, spawns the subprocess, pipes stdout through common::redactor::redact. All subcommands fully implemented.

crates/mcp/ is a separate crate that provides the gate mcp subcommand — a stdio JSON-RPC proxy that forwards traffic between the AI harness and an upstream MCP server. It intercepts tools/call responses and redacts PII via Gate 2 before returning them.

Repository structure

gate/
  Cargo.toml            # workspace root
  crates/
    common/             # config, PII patterns, redactor (Gate 2), error types, harness detection
    gate1/              # SQL tokenizer + column extractor (Gate 1)
    gate/               # main binary (all subcommands)
    mcp/                # stdio MCP proxy: intercepts tools/call responses and redacts PII

Build and test commands

cargo build
cargo test --all
cargo clippy -- -D warnings
cargo fmt --check

Before every commit

Run all checks from the workspace root and fix any failures:

cargo fmt --all
cargo clippy -- -D warnings
cargo test --all

Never commit if any of these fail.

Dependencies (pin these in workspace Cargo.toml)

clap = { version = "4", features = ["derive"] }
serde = { version = "1", features = ["derive"] }
serde_json = { version = "1", features = ["preserve_order"] }
serde_yaml = "0.9"
regex = "1"
shell-words = "1"
anyhow = "1"
thiserror = "1"
tempfile = "3"
criterion = { version = "0.5", features = ["html_reports"] }
ctrlc = { version = "3", features = ["termination"] }

Gate 1 uses a hand-written SQL tokenizer — do NOT add sqlparser-rs.

Safety checklist (required for any redaction changes)

When modifying redaction logic (common/redactor.rs, gate1/lib.rs, mcp/intercept.rs), run this checklist before committing: