Overview

PasteGuard is configured via config.yaml. Copy from the example:

cp config.example.yaml config.yaml

Mode

Privacy mode determines how PII is handled.

mode: mask

Value	Description
`mask`	Replace PII with placeholders, send to the upstream AI service, restore in response
`route`	PII requests stay on your local LLM (Ollama, vLLM, llama.cpp), others go to the configured cloud provider

See Mask Mode and Route Mode for details.

Server

server:
  port: 3000
  host: "0.0.0.0"
  request_timeout: 600

Option	Default	Description
`port`	`3000`	HTTP port
`host`	`0.0.0.0`	Bind address
`request_timeout`	`600`	Request timeout in seconds (0 = no timeout)

The OpenAI, Anthropic, and Codex proxy routes reject browser requests. SDKs, CLIs, and other non-browser clients are unaffected. The standalone /api/mask endpoint keeps permissive CORS for the browser extension. Restrict network access when using a configured provider-key fallback.

Dashboard

dashboard:
  enabled: true
  auth:
    username: admin
    password: ${DASHBOARD_PASSWORD}

Option	Default	Description
`enabled`	`true`	Enable dashboard at `/dashboard`
`auth.username`	-	Basic auth username
`auth.password`	-	Basic auth password

Environment Variables

Use ${VAR} or ${VAR:-default} syntax:

providers:
  openai:
    api_key: ${OPENAI_API_KEY}

pii_detection:
  detector_url: ${DETECTOR_URL:-http://localhost:5002}
  detector_timeout: ${DETECTOR_TIMEOUT:-30}

config.yaml controls the proxy’s PII policy and connection to the detector. Backend settings are documented under Semantic Backends.

Getting Started

Use Cases

Concepts

API Reference

Configuration

Mode

Server

Dashboard

Environment Variables

​Mode

​Server

​Dashboard

​Environment Variables

Mode

Server

Dashboard

Environment Variables