I built Spring AI Privacy Guardrails — PII protection across RAG, tools, MCP, and outputs

[ultramancode]

Hi everyone,

I've been working on an open-source library called Spring AI Privacy Guardrails.

The project was also mentioned in the Spring Blog post This Week in Spring — August 18, 2026.

PII detection is an important first step. I wanted to focus on what happens next: controlling where original sensitive values are allowed to travel through a Spring AI application.

When protection is applied to a ChatClient, detected sensitive values are replaced with request-scoped opaque tokens before model calls. Tool disclosure is deny-by-default: only original values for entity types explicitly allowed for that tool are restored immediately before execution, and detected sensitive values in the tool result are protected again before model re-entry.

The same protection model also covers supported RAG context, chat memory, local tools, dynamically discovered MCP tools via ToolCallbackProvider, and optional final-response protection.

The core privacy logic is Spring-independent. The Spring AI integration applies it through public Advisor and ToolCallback extension points.

The integration keeps the standard Spring AI ChatClient programming model:

@Bean
ChatClient privacyChatClient(
        ChatClient.Builder builder,
        PrivacyChatClientConfigurer privacyConfigurer
) {
    return privacyConfigurer.configure(builder).build();
}

PII detection is pluggable, with built-in Regex support, a custom analyzer SPI, and optional integrations with Presidio (an open-source framework for PII detection) and Apache OpenNLP. For Spring Boot applications, dedicated starters are published on Maven Central.

Final-response protection is optional and can TOKENIZE, REDACT, or BLOCK completed responses.

To make the boundary behavior easier to inspect, the repository includes a Privacy Boundary Inspector backed by a deterministic local ChatModel, so no cloud model credentials are required.

The Inspector shows the protected input actually visible to the model, scoped disclosure to local and MCP tools, retrieved versus model-visible RAG context, and tool-result re-protection. The MCP scenario uses an actual local Streamable HTTP round trip.

Protection applies to ChatClient instances configured with the privacy integration. Direct ChatModel calls remain outside the automatic protection boundary. The project focuses on privacy enforcement across supported Spring AI execution paths rather than general-purpose moderation or a complete DLP system.

Documentation:
https://ultramancode.github.io/spring-ai-privacy-guardrails/

Boundary demo:
https://youtu.be/IeeA5ogIX_I

If you're using Spring AI in privacy-sensitive applications, I'd really appreciate any feedback if you get a chance to try it out.