Privent 2.0: three surfaces, one vault
An agent workflow touches sensitive data in three places. Inside the execution engine, where a node reads a customer record and hands it to a model. Through MCP tool calls, where an agent asks an external server to do something with your data. And in documents, where the contract or the spreadsheet is the payload.
Most security tools cover one of those and call it coverage. As of today Privent covers all three, and this is the part that matters more than the count: they share one vault. A customer email tokenized inside an n8n workflow and the same email tokenized inside a contract resolve to the same entry, restorable in the same session, at the same trusted boundary.
Here is what you can install right now.
The in-engine interceptor
n8n does not expose an API for intercepting individual tool calls, and a community node is not a hook. If you want coverage that does not depend on a builder remembering to place a node on the canvas, you have to run inside the engine.
So we ship an image. You swap your n8n image for ours, keep every other setting, and the preload runs before your workflows do. Main, worker and webhook all use the same image. Nothing else about your deployment changes, and rolling back is a tag change.
Two things worth knowing before you try it.
The image is public. You can pull it right now with no account and no token, which is the only version of installable that means anything.
And it fails closed. Start the container without the Privent variables and it refuses to boot, printing exactly which variable is missing and why. A security layer that silently degrades to no security is worse than none, so this one stops instead.
There is an honest caveat, and it is on the install page too. A developer cannot drop the preload. They can set one env var that permits unmasked egress, and every payload it lets through is logged.
MCP, in two pieces
MCP created a new kind of blind spot. Your agent calls a server you do not control, sends it arguments assembled from your data, and gets results back that flow onward. Two different jobs need doing there, so we ship two different things.
The server gives an agent Privent tools. Tokenize, detokenize, risk scoring, audit events, and document flows behind preview flags. You add it to Claude Desktop or Cursor with npx and the agent gains capabilities it did not have. This is the assist side.
The gateway is enforcement. It sits between the client and the MCP server you already use and tokenizes tool call arguments on the way out and results on the way back. Every string leaf in the arguments, nested or in arrays. Every text block and structured result in the response. The server you are wrapping does not need to know Privent exists.
The gateway fails open by design, which is the opposite choice from the interceptor and a deliberate one. If protection is unavailable the call still passes, and every one of those passes is recorded as a protection event. An agent pipeline that stops because a security service had a bad minute is a security tool that gets uninstalled. We would rather keep your agents running and hand you an honest record of every moment we could not protect.
Both pieces are on npm.
Document jobs
Contracts, spreadsheets, scanned PDFs. Sensitive fields become reversible tokens and the file stays usable, which is the difference between protection and redaction. A redacted contract is evidence. A tokenized contract is still a working document.
Word, Excel and PDF, including scanned PDFs through an opt in OCR build where the models are mounted, never downloaded at runtime. It runs as an asynchronous job API: you submit, you poll, you download the result.
Files live in object storage you choose, local disk by default, never in the database. They are deleted on a retention window. Every download is access audited.
And the tokens are the same tokens. That is the whole point of the vault being shared.
Why one vault matters
Tokenization is easy to demo and hard to make useful. Replace an email with a placeholder and the demo looks fine. Then the agent needs to send that customer a reply, and the placeholder has no memory of who it was, and the workflow is stuck.
Privent mints typed, reversible tokens. ACARS scores each payload using the live session state rather than the isolated string, so a value that looks harmless alone but dangerous in context is treated as dangerous. APE transforms it in place, and the real value is re-injected at the trusted boundary. The model sees a coherent, safe version of the payload. The recipient gets the real one. The workflow never stops.
Sharing one vault across the interceptor, MCP and documents means that logic holds across surfaces instead of within each one.
Self host and air gap
All of it runs inside your boundary. The document engine makes no outbound calls at all. Raw prompt and payload text is never stored, processed in memory only. Self hosted deployments that do not configure a vector store persist nothing beyond event metadata.
If your security team has a written review, the answers to the key management questions are written down too, including the parts where the current answer is no. That page is at privent.ai/security, and we would rather you read it before the call than during it.
SOC 2 Type II is in progress, monitored through DSALTA.
Where to start
The free scan runs against your own n8n instance. No sign up, no API key handover, aggregate counts only, and the results expire in seven days. It is the fastest way to find out whether any of this applies to you.
If you self host n8n, the install page has the compose file and the image pin.
If you are running agents somewhere we do not cover yet, LangGraph and CrewAI are next, and I would like to hear what you are building. gorkem@privent.ai.