open-index/open-npm huggingface dataset:
npm package: @fastino/pii-guard
Description: Blocks outbound messages containing PII using a local encoder model
Latest version: 0.2.0

# @fastino/pii-guard

An [OpenClaw](https://openclaw.ai) plugin that automatically detects and blocks outbound AI responses containing personally identifiable information (PII).

## What it does

PII Guard intercepts every assistant response before it is written to the session. If the response contains PII above a confidence threshold, it is replaced with a warning message:

> ⚠️ My response was blocked as it may contain personal information. Please ask me again.

Detection is powered by [`urchade/gliner_multi_pii-v1`](https://huggingface.co/urchade/gliner_multi_pii-v1), a local encoder model that runs entirely on your machine. No data is sent to external services.

## Detected PII types

Person names, email addresses, phone numbers, physical addresses, dates of birth, social security numbers, credit card numbers, passport numbers, driver's licenses, bank account numbers, IP addresses, usernames, passwords, and organisations.

## Requirements

- OpenClaw gateway
- [uv](https://docs.astral.sh/uv/) — installed automatically if not present
- Python 3.10+ (managed by uv)
- `curl` (standard on macOS and Linux)

## Install

```bash
openclaw plugins install @fastino/pii-guard
openclaw gateway restart
```

On first start, the plugin automatically:
1. Installs `uv` if not present
2. Creates a Python virtual environment
3. Downloads and caches the PII detection model from HuggingFace (~500MB, one-time)

Subsequent starts load the model from cache and are fast.

## Uninstall

```bash
openclaw plugins uninstall pii-guard
openclaw gateway restart
```

## How it works

The plugin runs a local Flask sidecar process that holds the GLiNER model in memory. On each assistant response, a synchronous check is made to the sidecar over localhost before the message is written to the session. If any entity is detected with a confidence score ≥ 0.9, the response is replaced with the warning message.

The sidecar binds to `127.0.0.1` only and is protected by a random secret generated on first run (stored in `~/.openclaw/config/pii-guard.json`).

If the sidecar is unreachable for any reason, the plugin fails open — messages are allowed through and a warning is logged.

## Security notice

OpenClaw's plugin scanner will flag this plugin for `child_process` usage and environment variable access. These are expected: the plugin spawns a Python sidecar process and passes a locally-generated secret to it over localhost. No credentials are harvested or transmitted externally.