Maskura Gateway protects the bucket you have. Maskura Store gives your agent storage without the cloud setup.
Maskura Gateway
Bring your bucket.
Maskura Gateway sits between the agent and your existing S3-compatible storage. It redacts or encrypts supported content on the way through, without creating another clean-data copy to manage.
Maskura Store
Skip the bucket.
Maskura Store handles the bucket, permissions, encryption, and cleanup. Your code uses MCP or S3 and gets back to the feature.
We’re validating uploads, storage limits, and reliable deletion before opening access.
Join Store previewRead + write paths
The same privacy boundary protects supported writes before storage and processed reads before raw data reaches the agent context.
Raw data is plaintext? No problem — read through Maskura, scrubbed on the way to the AI.
Write path — your app PUTs, Maskura cleans before storage.
Live pipeline
Prepare two records in your browser, then process them through Maskura in plain, safe, and joinable modes.
Privacy toolkit
Secure object access and privacy controls for your S3-compatible storage.
Format coverage
Maskura transforms text records and schema-aware Avro OCF objects through format-specific privacy pipelines.
JSONL, JSON, CSV, TSV, plain text, and Avro OCF are selected by Content-Type and can be processed on write and read.
Parquet will add schema-aware columnar processing. Other unsupported binary objects remain raw S3 passthrough.
Clients + tools
Use the same S3-compatible gateway from your CLI, application code, or local MCP server. Writes run the configured pipeline; processed reads opt in with x-maskura-process: read.
Maskura speaks the S3 API — point any S3 client at the gateway. PII is redacted before it lands in your bucket.
# Maskura credentials retain the s4_ and s4s_ prefixes for compatibility
export AWS_ACCESS_KEY_ID=s4_your_access_key
export AWS_SECRET_ACCESS_KEY=s4s_your_secret_key
export AWS_ENDPOINT_URL=https://api.s4.231self.com
# Write an object — email + card are detected and redacted in transit
aws s3 cp customer.json s3://my-bucket/customer.json \
--endpoint-url $AWS_ENDPOINT_URL
# Or with curl (header auth)
curl -X PUT https://api.s4.231self.com/my-bucket/contact.json \
-H "x-maskura-access-key: s4_your_access_key" \
-H "x-maskura-secret-key: s4s_your_secret_key" \
-H "Content-Type: application/json" \
--data-binary '{"email":"alice@example.com","card":"4111111111111111"}'
# Read it back — stored object is redacted
curl https://api.s4.231self.com/my-bucket/contact.json \
-H "x-maskura-access-key: s4_your_access_key" \
-H "x-maskura-secret-key: s4s_your_secret_key"Use boto3 with a Maskura API key as SigV4 credentials and point it at the gateway endpoint.
pip install boto3
import boto3
s3 = boto3.client(
"s3",
endpoint_url="https://api.s4.231self.com",
aws_access_key_id="s4_your_access_key",
aws_secret_access_key="s4s_your_secret_key",
region_name="us-east-1",
)
# Write through Maskura Gateway.
s3.put_object(
Bucket="my-bucket",
Key="customer.json",
ContentType="application/json",
Body=b'{"email":"alice@example.com","card":"4111111111111111"}',
)
# Read the stored representation.
stored = s3.get_object(Bucket="my-bucket", Key="customer.json")
print(stored["Body"].read().decode())Install the public stdio server, create an MCP token in the dashboard, and register the command with your MCP client. Full details are in docs/mcp.md.
cargo install --git https://github.com/231self/maskura maskura-mcp
// claude_desktop_config.json, .cursor/mcp.json, or equivalent
{
"mcpServers": {
"maskura": {
"command": "maskura-mcp",
"env": {
"MASKURA_GATEWAY_URL": "https://api.s4.231self.com",
"MASKURA_MCP_TOKEN": "s4m_your_token"
}
}
}
}
# Available tools:
# maskura_put_object, maskura_get_object, maskura_list_objects, maskura_delete_object
# Legacy s4_* tools and s4-mcp remain aliases during the transition.Open source · Apache-2.0
Maskura Gateway, the MCP server, filters, SDKs, and CLI are developed in public on GitHub. View the source