Status: [UNTESTED]

Endpoints found:
http://127.0.0.1:8787/v1/chat/completions

Source: https://github.com/adagora/ai-audit

# ai-audit
Local proxy that sits in front of OpenAI and Anthropic APIs. It inspects each request (text, tool results, images, PDFs) for secrets and PII before forwarding, and writes a hash-chained audit log for every call (AI Act Art. 12-style). TypeScript, zero runtime deps.

## Quickstart
```sh
npm install && npm run build
node dist/src/cli.js serve --mode redact --log audit.jsonl        # http://127.0.0.1:8787  (npm link → `ai-audit`)
node dist/src/cli.js verify --log audit.jsonl
```
Clients: `ANTHROPIC_BASE_URL=http://127.0.0.1:8787 claude` · `OPENAI_BASE_URL=http://127.0.0.1:8787/v1 codex` (works the same for the OpenAI/Anthropic SDKs and curl). Optional headers: `x-audit-system-id`, `x-audit-use-case`.

| mode | finding → |
|---|---|
| `redact` (default) | replaced with `[REDACTED:rule]`; images blacked out; PDFs rebuilt as page images with findings blacked out (logged as `decision.rasterized`), `--no-page-redaction` or config `"pageRedaction": false` → 409 instead ([ADR 0013](docs/adr/0013-rasterize-pdfs-by-default.md)) |
| `no-go` | 409, upstream never called, response lists rule IDs only |
| `advisory` | original forwarded, finding logged |

Uninspectable attachment (corrupt, unsupported, remote URL, file id) → 422. A rebuilt PDF or image is inspected again; if a finding survives or a box cannot be mapped → 409. A rasterized PDF reaches the model as page images only (no text layer, more tokens, OCR-quality answers). Detects: Gitleaks key shapes (AWS, GitHub `ghp_`/`github_pat_`/`ghu_`/`ghs_`/`gho_`/`ghr_`, OpenAI, Anthropic, GCP, Stripe, Slack, Azure AD client secrets, JWT incl. wrapped, private keys), OpenRouter and xAI keys, e-mail, phone, PESEL, IBAN (checksum and country length); also catches keys followed by punctuation, secrets split across text parts, OCR text, PDF text and metadata. Contextual rules cover AWS secret-access keys (also as an unlabeled `KEY_ID : SECRET` pair or percent-encoded in a URL) and session tokens, presigned S3/GCS U