See what your agent saw·Trace Inspector·free
Access granted.
Disclosure denied.
The database said YES.
The policy said NO.
The policy said NO.
Define what AI may see.
Runs entirely in your browser. Nothing is uploaded.
Connect any agent
One line of code away from data security and full control.
$ claude mcp add -s user nodata -- npx -y @nodatachat/mcp@latest
Give any agent an identity, and you decide what it may decrypt. With no key, the command walks you through the next step. Works with Claude, Codex, and any MCP client.
the paradox
You found the key. It changes nothing.
The agent is connected. The key is valid. The query is legal. The sensitive data still never reaches it.
Agent request
full_name:John Doe
email:john@example.com
phone:+1 415 555 0132
salary:$180,000
bank_account:8842-4417-2290
ssn:512-84-9330
Agent actually receives
full_name:John Doe
email:john@example.com
phone:+1 415 555 0132
salary:key not derived
bank_account:key not derived
ssn:key not derived
✓ The query is valid✓ The data exists✓ The keys are valid
✗ The denied fields never became readable.
How? Policy is enforced before plaintext exists — the key for a denied field is never derived.
The system doesn't block access. It blocks disclosure.
Most AI security products filter after retrieval.
NoData decides before plaintext exists.
Possession is not permission. Disclosure is computed.
◆ Your control board
enforcedDefine it once. It applies everywhere.
POLICY
↓
✓OpenAI
✓Claude
✓Gemini
✓Cursor
✓MCP
✓REST
✓Internal agents
You define for the data, not the agent.
The integration changes. The policy doesn't.
Policy travels with the data.
See exposure→Generate policy→Enforce disclosure→Reuse everywhere
Try it on your own
The sample usually finds: SSN · Salary · Bank account · Internal notes · Attachment URL
No setup · no routing · no API keys — runs entirely in your browser, no trace is sent.
next
Wire it in 5 minutes →
Developers — Hello-World, grant, agent read.
why it holds
Why it can't be bypassed →
Platform — ciphertext-at-rest, per-request keys.
Any Agent. Any API. Your Policy.
Your policy stays with the data, not the connection.