Back to catalog
Grepture
AGPL-3.0Grepture is an open-source AI gateway replacing hosted proxies with in-flight PII redaction, token vaulting, and local request inspection.
Open-source alternative to — compare it against:
Overview
An internal support application routes customer queries directly to external foundation models, exposing emails and payment records to third-party endpoints. Grepture intercepts those outbound requests at the private network boundary, stripping identified data before tokens cross the wire. A single Bun container handles inspection, rule enforcement, and upstream forwarding without altering model response semantics.
Why Grepture instead of Cloudflare AI Gateway
Cloudflare AI Gateway routes model traffic through Cloudflare's hosted edge, requiring requests to leave your environment and conform to Cloudflare endpoint schemas. That model suits global edge caching, but leaves payload inspection outside your private VPC. Grepture deploys directly inside your cluster as a forward proxy. Integrations rely on HTTP headers: services call the proxy with X-Grepture-Target pointing to the upstream provider and X-Grepture-Auth-Forward carrying the credential. This keeps prompt inspection, redaction, and detokenization entirely inside your infrastructure.
Request body transformation marks the primary integration divide. Commercial gateways like Cloudflare AI Gateway, Kong AI Gateway, and Vercel AI Gateway manage routing, rate limits, and caching, but lack native tokenization that swaps sensitive values before reaching external providers and restores them in streaming responses. Grepture applies JSON path matching and regex rules from rules.json to redact or tokenize in flight. Conversely, it lacks the multi-region edge caches, turnkey failover pools, and billing dashboards that hosted platforms provide out of the box.
What it does well
- In-flight PII redaction: Matches patterns for emails, phones, cards, IPs, and birth dates, replacing them with placeholders or synthetic tokens before prompts leave the cluster.
- Reversible token vaulting: Swaps fields with isolated tokens and stores originals in memory, restoring plaintext values when upstream responses return.
- Streamed chunk detokenization: Reassembles token boundaries across Server-Sent Events, ensuring streaming completions from Anthropic or OpenAI retain rehydrated values.
- Header-based routing: Dispatches calls to model endpoints via
X-Grepture-Target, letting backend services use a single internal proxy URL across providers.
