An on-device AI firewall. It watches the AI traffic going in and out of your apps — browsers, IDEs, native apps, MCP servers — and blocks what shouldn't get through: prompt injections, leaked secrets, shadow AI. Everything runs locally, nothing is sent to a cloud, and it works with any provider (Claude, OpenAI, Gemini, Copilot, Ollama, …).
Patronus Ark is the scanning engine underneath the app: a Rust core with Python bindings that scans in three escalating layers, so most traffic is resolved before a transformer ever runs.
| Layer | What runs | Cost |
|---|---|---|
| L1 | Native rule-based detectors | microseconds |
| L2 | Small classifiers sharing one encoder | milliseconds |
| L3 | Full quantized transformers, lazily loaded | only for the uncertain rest |
Across those layers it catches prompt injection and jailbreaks, PII, secrets and DLP leaks, sensitive documents, risky agentic tool use and MCP policy violations, plus routing and threat classification — all on the endpoint.
Ark will be open source (dual license available). It is not public yet — the repository link will appear here at launch.
Our detectors, trained for the firewall and shared openly — use them, fine-tune them, benchmark against them, and tell us where they fall short:
Deliberately small: ModernBERT under the hood, ONNX-quantized (INT8/INT4), a few hundred MB of RAM — they run happily on a laptop instead of a GPU rack.
The app, with downloads for macOS and Windows, lives at patronus.studio. Come say hi.