@conarium-ai/core · pre-1.0

Technical overview

What Conarium actually does, how it fails, and — just as important — what it does not protect against. Written for the engineer who has to put this in the path between an AI assistant and a real database.

What it is

Conarium is a self-hosted governance layer that sits between an AI assistant (Cursor, Copilot, Claude Code, Windsurf, or any MCP client) and your data. Every query the assistant issues passes through Conarium first. Sensitive values are masked before the model sees them, writes are refused, and every access is written to a tamper-evident, PII-safe audit log. It runs entirely inside your perimeter — the vendor never receives your data.

How it works

AI assistant ──MCP──▶  Conarium  ──▶  your database / docs / APIs
                          │
                          ├─ parse & analyse the SQL
                          ├─ enforce read-only + allow/deny + row caps
                          ├─ mask PII in the result before it returns
                          └─ append a hash-chained audit entry
                          ▼
              masked result ──▶ AI assistant     real values ──▶ you

The assistant reasons on masked tokens it cannot de-anonymize; the operator sees the real values on the way back. The SQL gate accepts Postgres, Microsoft SQL Server, and Oracle. MySQL is not implemented. Oracle does not resolve synonyms or database links. Connectors cover Postgres, internal docs, OpenAPI specs, Jira and Slack, exposed to every assistant over MCP.

Guarantees

These are enforced in code, not policy prose:

Read-only by default. Only SELECT/WITH queries pass. DROP, DELETE, UPDATE, INSERT, ALTER, CREATE, TRUNCATE are blocked — including when smuggled inside comments or stacked queries (SELECT 1; DROP …).
Fail-closed. If a query cannot be parsed, if a masked column's output cannot be safely redacted, or if a table/connector isn't allowed by policy, the request is denied (a PolicyError is thrown) — never passed through. Uncertainty resolves to refusal, not leakage.
PII masking before the model. Emails, national IDs, phone numbers and card numbers are redacted in the response stream — plaintext and base64-encoded, so encode-tricks don't slip through. A field longer than policy.scanCharCap (default 16 384) is replaced whole with [MASKED_PII], even when it contains no identifier.
Row caps. A hard per-query limit (default 100) stops silent bulk exfiltration.
Tamper-evident, PII-safe audit. Every access is appended to a hash-chained JSONL ledger — who, what, when, rows, decision. Alter one entry and the chain breaks on the next read. The audit itself is masked, so it never stores raw PII.
Self-hosted. Runs on your infrastructure. Raw protected values stay inside your perimeter; what reaches your AI client is the policy-approved disclosure, and the receipt records exactly which bytes those were.

Policy model

Policy is a small JSON document. Nothing is allowed unless you allow it; anything on a deny list is refused first.

{
  "allowTables":   ["public.customers", "public.orders"],
  "denyTables":    ["*.secrets", "*.admin_users"],
  "maskColumns":   ["*.email", "*.phone", "*.tax_id"],
  "maxRows":       100,
  "allowConnectors": ["postgres", "docs"]
}

Read this before you trust it

What Conarium does not do

A security tool that hides its limits isn't a security tool. Conarium is a governance layer in the AI data-access path — not a silver bullet.

It doesn't stop access you configured. If you allow a table and a column, the (masked) data flows. Conarium enforces your policy; it doesn't second-guess it.
It doesn't prevent re-identification by correlation. Masking a name doesn't stop someone inferring identity from a unique combination of allowed columns (e.g. salary + city + title). Mask or deny correlating fields yourself.
It isn't network security, authentication, or database permissions. It complements them; it doesn't replace your IAM, your DB grants, or your firewall.
It doesn't secure the assistant itself. Prompt-injection or a compromised AI client is a different layer (AI firewalls). Conarium limits the blast radius of what a tricked assistant can reach and proves it in the audit — but it isn't a prompt-injection defence.
It can't govern data it doesn't sit in front of. A human with direct database credentials, or an integration that bypasses Conarium, is outside its scope.
The in-browser demo is a pattern preview. It highlights structured secrets with regex, client-side. Production masking analyses your live SQL and goes deeper, but pattern-based masking of free text can still miss a novel format. Treat it as defence-in-depth, not a guarantee of zero leakage.

Still not caught by content scanners — by design

What the production scanner refuses to pretend

These are design decisions, not gaps we forgot. A half-working detector is worse than none: it increments a count and still hands the value to the model.

Street addresses and bare names in running prose. An address detector cannot tell “Atatürk Caddesi No:15” from “Atatürk Barajı” without a gazetteer. A name detector cannot tell Deniz / Güneş / Umut from the words. Both would need a dictionary or a model; this gateway's decisions are deterministic. Close those gaps with maskColumns and conarium-suggest-policy (a name-based guess that does not write your config).
Passport numbers outside MRZ. Free-text passport patterns collide with product and order numbers. MRZ is caught: two TD3 lines × 44 characters, P in position 1, 7-3-1 check digits. TD1/TD2 are not implemented.
Double-encoded escapes such as &#64;. One decode pass; a lone 5@ store is left alone.
An identity split across two unrelated fields. A TCKN split across two similarly named fields on the same row is concatenated when the checksum holds. Unrelated columns are not combined.
A cut from the end of the receipt chain. A hash chain cannot see a tail that is no longer in the file. Pin length with --expect-count / --expect-last-hash, or an external OpenTimestamps anchor.

What the scanner does catch, when the bytes are there: IBAN (mod-97), TCKN, cards (Luhn), TR phones (mobile / landline / 08xx / +90 / spaced), email, MRZ as above, and IP (IPv4/IPv6) only if policy.detectors.ip is true. Identity detectors (TCKN, card, IBAN, email) cannot be turned off — the schema rejects the key. A field longer than policy.scanCharCap (default 16 384) is replaced whole with [MASKED_PII]; it is never skipped.

Threat model

Defends against

An AI assistant reading raw customer PII / secrets straight out of a production database.
Write, delete or bulk-exfiltration via AI-generated SQL — including obfuscated or stacked attempts.
Unaudited AI access — you can prove, after the fact, exactly what the model saw.
Access to deny-listed tables (secrets, admin, system catalogs).

Out of scope

A malicious human with direct DB credentials.
Compromise of the host infrastructure Conarium runs on.
Your chosen LLM provider's retention policy — self-hosting lets you pick a zero-retention endpoint, but that choice is yours.

Run it yourself

Conarium runs as a single service inside your infrastructure (local or VPC). It's a standard MCP stdio server — your assistant launches it and speaks MCP over stdio. It needs no inbound port. The only outbound call is an npm version check at startup, disabled with CONARIUM_NO_UPDATE_CHECK=1.

From npm (current published package: @conarium-ai/core)

npm i @conarium-ai/core
npx conarium-init
npx conarium-doctor --config ./conarium.config.json --no-net

init prints that doctor line itself. The package ships these commands: conarium, conarium-doctor, conarium-init, conarium-verify, conarium-countersign-verify, conarium-coverage, conarium-reconcile, conarium-stamp, conarium-anchor-upgrade, conarium-console, conarium-suggest-policy.

Get the code

git clone https://github.com/dogrucanemek-alt/conarium.git
cd conarium

With Docker

docker build -t conarium .
docker run --rm -i \
  -v "$PWD/conarium.config.json:/app/conarium.config.json:ro" \
  conarium --config /app/conarium.config.json

With Node (≥20)

npm ci
npm run build          # tsc → dist/
node dist/index.js --config ./conarium.config.json

Point your assistant at it

{
  "mcpServers": {
    "conarium": {
      "command": "node",
      "args": ["/path/to/conarium/dist/index.js", "--config", "/path/to/conarium.config.json"]
    }
  }
}

From then on, every query the assistant issues passes through Conarium first. It sits in the query path, so plan for it as you would any component there. Its default is to fail closed: if it can't make a safe decision, the assistant gets a refusal — never raw data.

Source: github.com/dogrucanemek-alt/conarium — MIT-licensed. Read it, run it, fork it. Questions: e.dogru@conarium.dev.

Status & maturity — honestly

Conarium is early. It is pre-1.0, built and run by a solo founder, with one production deployment so far (the author's own company ERP: 121,374 records, 121,366 identities masked, zero leaked to the model — the figure cannot be verified from outside). It has no third-party security certification (SOC 2 / ISO). Neither is planned. No independent penetration test — that one is on the roadmap. If you need a certified, multi-customer, enterprise-hardened vendor today, Conarium isn't there yet, and we'd rather tell you than pretend. What we offer right now is a genuinely self-hosted, inspectable governance layer and a direct line to the person who built it.

Continuity — what if the founder disappears?

A fair concern for a solo-founder tool in your data path, and the answer is the license: Conarium is MIT-licensed. You can read the source, run it, fork it and maintain it yourself — forever, no permission needed. If the project stops tomorrow, you're not left with an orphaned black box; you keep a governance layer you fully control. That's the whole point of self-hosted + open-core: your risk isn't tied to our survival. Need a formal source-escrow arrangement on top of that for procurement? Just ask.

Security disclosure & questions → e.dogru@conarium.dev (answered by the founder)
© 2026 Conarium · Self-hosted. Fail-closed. Governed by you.
VERAX TEKNOLOJİ LİMİTED ŞİRKETİ · Maltepe / İstanbul, Türkiye · VKN 9241165625