DEFEND · OPEN SOURCEApache-2.0 core · BUSL-1.1 enterprisev0.1.0a0 · pre-alpha

Warded, not redacted

Your teams keep calling external models. RuneLM sits in front of every one of those calls: it classifies what is in the prompt, replaces sensitive entities with placeholders before the request crosses the wire, and routes anything it classifies HIGH to hardware you own. The router has no override for that decision.

Source on GitHub See the live demo

9-stage

classification pipeline

sensitivity tiers

cleartext fallback paths

audit backends

The problem

The prompt outlives the conversation.

Providers log prompts for abuse review, commonly for thirty days or more, whatever the retention page says this quarter. That log is a copy of your data sitting in someone else’s estate, and it is still there after your user has closed the tab.

Four things then follow from it. A breach at the provider exposes every cached prompt, retroactively. A court can order the provider to produce historical prompts, and the provider does not need your consent to comply. Retention windows and training terms can change without notice. And a contract does not physically prevent any of it.

RuneLM cannot prevent a contract breach. What it can do is make sure that when one happens, what leaked was rune-substituted text the provider cannot reverse, because the substitution map never left your side.

One enforced pipeline

Classify, route, rehydrate, in order, every time.

Each outbound prompt runs the full pipeline. An error in any stage blocks the request: a soft NER failure, a decode mismatch, an exceeded entity cap all end as BLOCKED rather than falling back to LOW.

STAGE
Identity
Verify the caller from a signed session, not self-reported headers.
STAGE
Classify
Nine stages, from Unicode normalization through structured parsing, NER, operator lists, coreference and escalation. Later stages can only escalate a level, never lower it.
STAGE
Pseudonymize
Deterministic, session-scoped, type-preserving placeholders with a per-session salt. An IP stays an IP; the same entity gets the same rune inside a session and a different one across sessions.
STAGE
Route
HIGH goes to a local L1 model. MEDIUM goes to a contracted L2 provider carrying a current DPA. LOW goes anywhere. There is no override flag.
STAGE
Rehydrate
Reverse only the runes the outbound map minted. A placeholder the model invented stays masked.
STAGE
Audit
HMAC-SHA-256 over every decision, never the raw prompt. Reading the audit trail is itself audited.

How it compares

Four properties, and where they stop.

Map-bounded rehydration

RuneLM reverses only the placeholders it minted for that session. If a compromised or injected model reply synthesizes a placeholder of its own, a naive rehydrator would fill it in and leak the real value. RuneLM leaves it masked. We did not find this behaviour documented in the six tools we surveyed.

BoundaryThat is our own qualitative assessment of publicly documented behaviour, current as of 2026, not a funded head-to-head benchmark.

runelm.com comparison table · classifier rehydration path

Fail-closed by architecture, not by flag

Any error in classification, pseudonymization, routing or audit blocks the request. There is no configuration that turns this off, because it is not a configuration.

BoundaryFail-closed protects the outbound path. It does not defend a compromised host, a compromised local model, or the semantic inference an attacker can still do on pseudonymized text.

docs/THREAT-MODEL.md §2

HIGH content physically cannot leave the box

Content classified HIGH routes to a local L1 model only. There is no --allow-l3-for-high flag, and the system does not ask. Data residency as code rather than as a policy document.

BoundaryOnly the HIGH path provides full data isolation. The MEDIUM path is probabilistic risk reduction under contract, and it does leave, in pseudonymized form.

router policy · docs/THREAT-MODEL.md

It understands security-tool output

Stage 5 parses JSON, XML, CSV, Nmap and Burp output and sanitizes per field, so a SOC analyst can send scan results to a model without handing over the network they describe.

BoundaryStructured parsing covers the formats it implements. An unrecognised format falls back to text classification, which is broader but blunter.

classifier/structured.py

For the person who has to prove it

Evidence that is not itself a leak.

The audit trail records what happened without storing the sensitive prompt: HMAC hash-chained rows across eight backends, up to write-once S3 Object Lock for compliance-grade retention. runelm audit verify walks the chain and either prints the number of rows verified or names the exact line where it broke. Every read of the audit trail writes its own row recording who read it, how much, and why.

Semantic inference survives pseudonymization.
Replacing names does not erase what the sentence around them implies. Say "sensitive data is replaced with placeholders before reaching external providers", not "your data never leaves".
A compromised host defeats the proxy.
RuneLM protects the outbound path from a trusted host. Host compromise, local-model compromise, and classifier side channels are explicitly out of scope.
The model’s own response is not the proxy’s problem to solve.
Rehydration is map-bounded, which stops placeholder-synthesis exfiltration, but content safety on the reply is a separate layer. BonkLM is ours.
RuneLM does not by itself put you in compliance.
It is a building block that addresses specific control objectives in each framework. The mapping in our threat model says which, and calls itself rough.

Published in full: docs/THREAT-MODEL.md

How to start

One shipped install pattern. We will not invent the others.

pre-alpha · not on PyPI yet · build from source

Get the source
```
git clone https://github.com/BlackUnicornSecurity/runelm.git
cd runelm
```
PyPI and Docker distributions are not published yet. When they are, this section changes and not before.
Point your client at the proxy
```
# your app keeps its OpenAI-compatible client
export OPENAI_BASE_URL="http://localhost:8080/v1"
```
8080 is the runelm serve default, overridable with --port. Classification, routing and audit then apply to every call your app already makes.

The drop-in OpenAI-compatible proxy is the shipped pattern: point your existing client at RuneLM instead of the provider and change nothing else. The Python decorator and direct API are planned and not yet shipped, so they are not documented here as if they were.

Editions

Two distributions, one source tree.

CommunityApache-2.0

The full fail-closed proxy
Nine-stage classification, pseudonymization, routing, rehydration
Memory, SQLite and composite audit backends
LiteLLM, LangChain and OpenAI Agents SDK adapters

CompleteBUSL-1.1

Compliance-grade audit backends, hash-chain file, Loki, S3 Object Lock
Entitlement and attestation server for OEM distribution
A Community install configured for an enterprise audit backend fails closed at boot
Never a silent downgrade

No price is published. Email info@blackunicorn.tech and we will scope the deployment with you.

Buyer questions

Asked before you ask.

Can I pip install it today?

No. RuneLM is pre-alpha and not on PyPI, and there is no published Docker image. Build from source. We would rather say that here than have you find out at a terminal.

So does my data leave or not?

HIGH-classified content does not: it routes to a local model on your own hardware and there is no flag to override that. MEDIUM content does leave, pseudonymized, to a contracted provider with a current DPA on file. That is risk reduction under contract, not isolation, and we will not describe it as isolation.

Where does it come from?

RuneLM is a clean-room extraction of a data-sanitization proxy hardened inside our own multi-agent operations platform, generalized into an application-agnostic component. The upstream proxy went through repeated adversarial cycles against Base64, leetspeak, homoglyph, token-splitting and nested obfuscation.

What does it cost?

The Community distribution is Apache-2.0 and free. The Complete distribution has no published price and is quoted per deployment.

Does it make us GDPR or AI Act compliant?

No, and any vendor who says yes is selling you something. It addresses specific control objectives, which our threat model maps out and openly labels as rough. Compliance is a programme, not a proxy.

Next step

Three ways in, in order of friction.

Watch it classify, liveThe interactive demo on the product site, with its own honesty note about what it simplifies.

Read the threat modelIncluding the section listing what RuneLM does not defend against.

Talk to usFor a deployment inside a regulated boundary.

Your prompts leave your perimeter on every API call. RuneLM makes sure they leave clean. Let's talk.