Zero protocol · loopback only
Mr.Rao
offline by design · v1.29.1
Mr. Rao and Mr. Rao Plus are DLP tools for shadow AI: they block and redact personal data in files and in chats with AI. Everything on the computer, locally, before the data leaves the network.
// 01 · engine
Every detector is a pattern plus a validator: the pattern proposes, the validator decides. Nothing is scored, nothing is thresholded, and the same text always gives the same result — every replacement can be explained by pointing at the rule that produced it.
NHS number: mod-11. ABA routing number: the weighted 3-7-1 sum, plus the prefix ranges actually in use. Canadian SIN: Luhn. Australian ABN: mod-89. TFN: weighted mod-11. Passport MRZ: the ICAO 9303 check digits — document, birth, expiry and composite.
NINO, SSN, ITIN and UK postcodes carry no checksum at all. There the detector can only check the structure and rule out the ranges the issuer never assigned — it reduces false positives, it does not eliminate them.
So nothing is redacted on bare digits: either the punctuation identifies the format, or a context word sits next to the number. Measured: on 20,000 random nine-digit sequences the SSN structural check accepts nearly 90% of them.
“3 redactions · 2 to check”. Anything that looks like personal data but cannot be proven is flagged, not hidden — masked to a stub (RS••••••••••••2S), enough to find it in the document, not to read it.
// 02 · threat
To get a model to reason about a contract, almost every tool asks you to upload the file first. In that moment names, NHS numbers and account details are out of the building — on someone else's disk, under someone else's retention policy. Mr. Rao breaks the chain: it converts and redacts here.
// 03 · how it is put to the test
On a real document you cannot tell whether a replacement was warranted: you judge it by eye, and the eye gets tired. So the engine is measured first on paper that contains no personal data at all — there every replacement is an error, and there is nothing left to interpret.
Blank US federal tax forms, collected as a zero-truth set: printed forms, no taxpayer, no figures. The correct number of redactions is zero, so every replacement counts as an error and there is nothing left to interpret. This bench exists because of a defect found exactly that way: on a blank US tax form the engine once produced 22 replacements.
Mailing-list messages in English: how it behaves on text people actually wrote — signatures, quoted replies, addresses in running prose — rather than on sentences built to make it succeed.
Each English validator ships with its own test vectors, and every vector states where the value came from — a published example from the issuing body, or a value built by applying the algorithm. The check digits in the test material are computed by a second implementation, independent of the engine, and verified against the published vectors for ISO 13616 and Luhn. A measurement that asks the product what is correct can never report that the product is wrong.
// 04 · what it does
| Input | PDF, DOCX, XLSX, PPTX, HTML, CSV, images, EML — MarkItDown plus offline OCR |
| Anglo formats | NHS number, National Insurance number, SSN, ITIN, ABA routing number, Canadian SIN, Australian ABN and TFN, UK postcode, passport MRZ lines — each with its own checksum where one exists · they travel together as one pack, which can be switched off in a single move (--no-pack-en) |
| Also redacted | Emails, phone numbers, names, addresses, payment cards (Luhn), IBAN (mod-97), URLs, API keys and secrets |
| Output | Markdown .md, plain .txt and Word .docx, all already redacted · the .docx is rebuilt from the redacted text — it is not the original with black boxes drawn on top, and there is no text hiding under them |
| Interface | In English, picked up from your browser · the produced document follows the same language |
| Local security | Host allow-list, CSRF Origin check, read-only GET, bound to 127.0.0.1 |
| Licence | AGPL-3.0 · the code can be read · does not send data off the computer |
| DLP role | Not network DLP. With Plus: DLP on the gesture — sanitise the file here, stop the paste in the listed AI chats. No third-party prompt proxy. |
// 05 · operational honesty
A security officer trusts whoever declares the limits. Ours are in the README, in PRIVACY.md and in the product itself.
It is assisted redaction. The context of the document remains, and even though the anonymisation engine has been tested on thousands of documents of various kinds, it is always wise to check the redacted content.
Once a document has been redacted, there is no going back. With a PDF you will see the familiar PDF with rectangles hiding the sensitive information, but underneath the data is no longer there. We preferred that the data cannot be recovered. Less convenient, but more secure.
It is not the resolution: between 300 and 100 DPI, on a clean scan, coverage does not get worse. It is the quality of the mark. On a faded photocopy at 200 DPI — a document a person reads without effort — 47% of the data is redacted, 38% is lost silently, and of what stays readable the suspects flag 4 items out of 28. Measured, not estimated.
The UK, US, Canadian and Australian formats listed above have dedicated detectors. A German phone number or a Spanish NIF does not: on those documents the filter sees less than it appears to.
No authentication. Exposing the port to a network without a proxy in front is a deliberate mistake.
// 06 · the last metre
Data typed into an AI chat is a real problem for companies: confidential files land in ChatGPT, Claude or Copilot without the network noticing. Mr. Rao and Mr. Rao Plus help prevent those leaks and reduce the risk of using restricted documents the wrong way.
Mr. Rao works on documents, before. The place where data actually leaves is the message box — where people type fast and press Enter.
Mr. Rao Plus is a browser extension that works there: it looks at what you are about to send to ChatGPT, Claude, Copilot, Gemini, Grok, DeepSeek or Perplexity, and if there is an IBAN, a tax code, a payment card or a person's name in it, it takes the datum out of the box before the message leaves. The first send never goes through, not even when the fix worked: you read what changed, then press again.
Same engine as Mr. Rao, same promise: everything local, no network call — not even to us — and a single permission, to remember your settings. Used together they cover the usual office case: the file is cleaned on the computer, and if someone still pastes a datum into a chat, Plus stops the send. They do not replace network DLP.
Attachments are not inspected: the extension works on the text you type. It says so on the store listing too — a declared limit is worth more than a wide promise.
// 07 · on the phone
On the desktop there is Mr. Rao, in the browser there is Plus. But on a phone AI is used inside native apps — where no extension can reach.
Mr. Rao for Android lives in the share sheet. Share a
.docx, a PDF or a spreadsheet: it comes back as Markdown, with names,
tax codes and bank accounts already replaced, ready to paste into a chat. It costs
fewer tokens, and it does not carry the people along.
Like everything else here it talks to nobody — and this time you can check without trusting us: the app does not declare the network permission, so it is the operating system that refuses every connection. In Android’s settings the permission list is empty.
Not on any store yet: the APK installs by hand, and F-Droid is coming. Free software, AGPL-3.0.
Windows (Store, installer or portable) and Apple Silicon Mac (.dmg). No Python. Or clone the repository and run the tests yourself. If the engine gets something wrong on a document of yours (no real data in issues, please), say so: it is the only way it improves.
One click, no warning: the Store signs the package, and updates arrive on their own.
Double-click and done. Windows will say “unknown publisher”: the package is not signed.
No installation. Runs from a USB stick, with its data next to the program.
Open the disk, drag Mr. Rao to Applications. Apple Silicon (M1+). macOS blocks the first launch: System Settings → Privacy & Security → Open Anyway.
The code, the 2355 tests, and a provenance attestation for every file.
// 08 · direct line
Written and maintained by Antonio Andrea Rao. Send an email or reach me on LinkedIn: no contact forms, no tracking — like the rest of the project.
Google Chrome
Microsoft Edge
Firefox