BALMAS AI

Your AI agent gets the documents. Not the secrets.

balmas-mcp is a local MCP server that sits between AI agents and your files: every file the agent reads is anonymized on your machine first — names, IDs, phones, companies, and secrets like API keys and passwords become consistent tokens. Read-only, folder-allowlisted, zero cloud.

⚙

Install once

Point Claude Desktop, Cursor or any MCP client at balmas-mcp with the folders you allow

→

⌕

The agent reads through us

Every file passes local detection — the agent receives a cleaned copy with tokens (PERSON_001)

→

↺

The answer comes back real

restore_text puts the real values back into the agent's final output — locally

The regulator's minimization advice — enforced in code

Israel's Privacy Protection Authority recommends strict permission minimization for AI agents. This is what that regime looks like enforced technically, not just on paper:

RECOMMENDATION	HOW BALMAS-MCP ENFORCES IT
Read-only access	The server exposes no write tools at all
Dedicated folders only	A folder allowlist on the command line; everything else is refused
Minimum necessary data	One step further: not just which files — what's inside them is minimized too
Transparency and control	Every access is logged locally on your machine

Install (Claude Desktop example)

{
  "mcpServers": {
    "balmas": {
      "command": "npx",
      "args": ["-y", "balmas-mcp",
               "/Users/me/Documents/work",
               "--level", "strict"],
      "env": { "BALMAS_API_KEY": "bk_..." }
    }
  }
}

Works with any MCP-compatible client. Three tools: list_files (names only), read_clean_file (content after anonymization), restore_text (real values back into the output).

The key (bk_...) is created free on the team & API page — every plan works, free included. Each file the agent reads counts against your monthly document quota (10 free, 200 PRO, 1,000 TEAM); only anonymous counters are sent for metering — content never leaves your machine.

Honest limits: the gateway helps only when the agent reads files through it — grant it instead of raw file access, not alongside. Detection is deterministic (patterns, lexicons, checksums): excellent, not clairvoyant.

FOR ORGANIZATIONS

Starts with one employee. Covers the whole company.

No IT rollout. Each employee installs the gateway in front of the Claude, Cursor or Copilot they already use, and the organization forms itself.

01

Work email = shared workspace

Everyone who signs up with the company domain lands in the same organization automatically — no invites, no admin setup.

02

A personal key per employee

Each employee creates their own bk_ key and gets 10 free documents a month. Usage is attributable, and a leaver's key is revoked without touching anyone else's.

03

Upgrade once, for everyone

When the team needs more, one paid plan pools the quota for the whole organization, and admins see usage per key — counters only, never content.

Agents, yes. Exposure, no.

Available now on npm: npx -y balmas-mcp — or start cleaning documents in the browser right now.

What the regulator recommends →