Introduction

Tailrace is agent data governance for TypeScript. It sits inside your process at model, tool, and MCP boundaries - detecting secrets and PII, applying policy, and restoring tokenized values only where you trust.

No proxy. No sidecar. No required network call on the request hot path.

1// User message → model boundary (out)
2const prompt = `
3  Email billing@example.com
4  Key sk_test_…FAKE
5`;

The pipeline

Every check follows the same path:

1. Input: A string or JSON object crosses a boundary (model prompt, tool args, MCP payload).
2. Detect: Tier 0 recognizers find entity spans with JSON-pointer paths.
3. Policy resolve: For each span: entity × boundary × identity → action.
4. Apply: block throws · tokenize writes the vault · mask replaces inline · allow passes through.
5. Audit: Async emit with rule path and content hash; never raw values.

Restore is separate: tailrace.restore() runs only at { kind: "egress", sink } boundaries. Calling restore at a model or tool boundary throws - by design.

Default policy

createTailrace() with no arguments:

Secrets cannot be overridden to allow without dangerouslyAllowSecrets: true.

Where Tailrace sits

Your app ──► wrapModel / wrapTools / MCP wrapper ──► tailrace.check ──► provider or tool
                                                      │
                                                      └──► audit (async)

For the Vercel AI SDK, one line wraps the model:

const model = tailrace.model(openai("gpt-4o"));

Next steps