One checkpoint for every AI call

What the AI Node is

The Vrymdor™ AI Node is a checkpoint between your code and the AI models and tools it calls. Your workflow sends text to the node; the node hides the private details, checks your rules, and only then lets anything go on. The model reads [REDACTED:EMAIL] where your text had an email address, and your audit gets a record of the run, never the text.

Every call, from every platform, gets the same four steps:

1. Identity. The agent's short-lived token is checked. A stopped or expired agent is refused.
2. Policy. Your rules decide whether this agent's role may take this action, on this upstream, with this tool.
3. Masking. Personal data and secrets are replaced with [REDACTED:<TYPE>] before anything leaves, and the answer is checked the same way on the way back.
4. Proof. The forwarded request is signed and a metadata-only audit record is written. It holds counts, never text, and it is hash-chained so tampering shows.

The node never runs code it is sent. It runs one allowed action against a destination you configured:

Any of llm, tool and webhook can run as a dry run: every check runs and nothing is forwarded.

What it finds

Always on, and no rule, plan or workflow step can turn it off:

• Secrets: private keys, sign-in tokens (JWT), bearer tokens, Vrymdor access tokens, and Anthropic, OpenAI, Stripe, GitHub, AWS, Google and Slack keys. Also when they are hidden in base64, hex, ROT13, reversed text, spaced out letters, look-alike letters or invisible characters. Secrets are never put back into an answer.
• Fail closed: an error, a timeout or text the node cannot read blocks the request. Nothing goes out unchecked.
• Tools: denied by default. A tool whose description changes is blocked, and a critical tool is always held.
• Limits: rate limits, hop limits, a loop breaker and a daily token budget per agent, and an instant stop for a killed or quarantined agent.
• Prompt injection: known attack phrases are at least flagged. You choose flag or block.

On by default, and adjustable:

• Personal data: email addresses, phone numbers (US and Canada, and international numbers that start with +), US Social Security numbers and card numbers. Plans with custom policy can turn these off.
• Your own words and patterns (Pro and up), each marked as a secret or as personal data. A new pattern must catch a made up example before it is saved.

What it does not find, so plan for it yourself: names of people, street addresses, dates of birth, bank account and routing numbers, IBANs, IDs from outside the US, private information written in plain words, and prompt injection beyond known phrases. The node matches patterns; it does not understand meaning. Anything sent to a model without going through the node is not protected. The full list is in What your AI Node protects.

Rehydrate: real values back in the answer

Masking keeps private details away from the model. Rehydrate puts them back into the model's answer inside your own node, so the reply your customer gets is normal and personal.

• Each distinct value gets a numbered token: [email protected] becomes [REDACTED:EMAIL_1]. The model answers with tokens, and your node swaps the real values back in.
• All or nothing. If the answer holds a token the model made up, a damaged token or one that does not belong, nothing is put back and the step answers rehydrate_check_failed. No setting turns this off.
• Only for one person. Add only_for with the recipient's details, and only that person's details can come back.
• The map stays in your node for 15 minutes by default (5 minutes to 1 hour), then it is deleted. It is never sent to the model, to your workflow or to Vrymdor. Secrets are never put back.

Turn it on with one call: add "params": {"rehydrate": true, "only_for": ["[email protected]"]} to an llm action. The two step form, the n8n options and the settings are in Rehydrate.

Where your node runs

Each hosted node has its own container, storage, network and keys. Steps for both are in Run your node.

The API in two calls

Every platform needs the same three values from your dashboard: the Node Host URL, the Agent ID (agt_...) and the Agent Secret (vrym_agent_..., shown once). Exchange the secret for a short-lived token, then call the node:

GW=https://node.vrymdor.com/t/k3v9q2m7x4ab
TOKEN=$(curl -s -X POST "$GW/v1/token" -H 'Content-Type: application/json' \
  -d '{"agent_id":"agt_...","agent_secret":"vrym_agent_..."}' | jq -r .access_token)

curl -s -X POST "$GW/v1/node/run" -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"action":{"type":"sanitize"},"input":"Card 4111 1111 1111 1111, mail [email protected]"}'

{"node_version":"1","ok":true,"decision":"allow","output":"Card [REDACTED:CREDIT_CARD], mail [REDACTED:EMAIL]",
 "redactions":{"CREDIT_CARD":1,"EMAIL":1},"asi":[],"rules":["redacted"],"hold_id":null,"error":null,
 "attestation":{"payload_sha256":"<hex>","signature":"t=<unix>,v1=<hex>"},
 "audit":{"hash":"<hex>","trace_id":"<hex>"},"latency_ms":3.8}

Refusals carry a stable code, such as tool_not_allowed, rate_limited or quota_exhausted, and a retryable flag. A repeated idempotency_key from the same agent gets the first answer back for ten minutes instead of running twice. Every code is in Troubleshooting, and the full request examples are in Any HTTP client.

Connect your platform

Python

from vrymnox_node import VrymnoxNode

node = VrymnoxNode("https://node.vrymdor.com/t/k3v9q2m7x4ab", agent_id="agt_...", agent_secret="vrym_agent_...")
print(node.sanitize("Customer [email protected] called"))       # Customer [REDACTED:EMAIL] called
tools = node.langchain_tools()      # only the tools your policy allows this agent

The client renews its token by itself. node.llamaindex_tools() gives the same tools to LlamaIndex.

MCP clients

The node is an MCP server. Its tools are vrymnox_sanitize, vrymnox_rehydrate, vrymnox_check (dry run), vrymnox_hold_status, vrymnox_llm when a model upstream is set up, and every tool your policy allows, named <upstream>__<tool>. Add it to Claude Desktop, Cursor or VS Code:

{
  "mcpServers": {
    "vrymdor": {
      "command": "uvx",
      "args": ["--from", "vrymdor-node", "vrymdor-mcp"],
      "env": {
        "VRYMNOX_NODE_URL": "https://node.vrymdor.com/t/k3v9q2m7x4ab",
        "VRYMNOX_AGENT_ID": "agt_...",
        "VRYMNOX_AGENT_SECRET": "vrym_agent_..."
      }
    }
  }
}

What you type into the chat goes to the client's own model before any tool runs, so the node protects what the tools send and receive, not your prompt.

GitHub Actions

One workflow file checks every pull request through your node and fails the check, naming what it found and where, when the pull request has:

• a secret in its description or in any line its changes add,
• a file that holds secrets by its name, such as .env, *.pem, *.key or id_rsa (templates such as .env.example pass),
• personal data in its description (set BLOCK_PERSONAL_DATA to "false" to allow it),
• a known prompt injection phrase in its description.

It needs three repository secrets (VRYMDOR_NODE_URL, VRYMDOR_AGENT_ID, VRYMDOR_AGENT_SECRET) and read access to the pull request. It reads the description and the changes through GitHub's API and never runs the pull request's code.

Policy and rules

Masking works without a policy. Tools do not: a tool call is refused with tool_not_allowed until your policy lists the tool for the agent's role. Set rules in the dashboard under Custom rules (words, patterns, detectors, replies, prompt injection, Rehydrate, and tools and roles); your nodes apply a saved change within about 5 seconds. Or keep the policy as a YAML file in your own repository and check it in CI:

docker run --rm -v "$PWD":/w:ro vrymdor/node-proxy:latest policy-check /w/vrymnox-policy.yaml

A valid file prints Policy valid. and an invalid one exits 1. The format is in Set your policy.

Plans and limits

Community is a hard cap: at its limit the node answers 402 quota_exhausted until the month resets. Paid plans are never blocked for volume. One request is one call the node evaluated; calls refused for a bad credential, a plan limit or a rate limit do not count. Pro and Business start with a 14 day free trial.

Try it before you sign up

• Live Playground: type text and watch it turn into numbered tokens, in your browser, then export a cURL or n8n setup.
• Free secret scanner: scan an n8n workflow, a .env file, an HTTP request or a prompt for keys and personal data. Nothing you paste is uploaded.
• n8n template: one model call through the node with Rehydrate on.
• The Arena: AI Rivals try to sneak fake secrets past a copy of the node, and you can watch every attempt. Every break gets patched and becomes a permanent test.

Questions? Email [email protected] and a person answers.