AgentCloak Data Cloak Skill

AI agent skill for InCountry AgentCloak: runtime PII cloaking/uncloaking via MCP server and environment configuration via Portal API.

Two modes of operation

Mode 1 — On-demand cloaking

Ask the agent to cloak or uncloak a value right now. No code is written or modified. The agent issues a direct call to the MCP server and returns the result.

Cloak the name "Alice Johnson"

Uncloak  with id 

Mode 2 — Code integration

Ask the agent to add PII protection to an existing application. The agent reads the source file, adds a cloak call to the MCP server, and updates the output to display cloaked values instead of originals.

Add PII protection to acme-crm.ts using the AgentCloak MCP server.
Cloak the full names of all customers before printing them.

The application has no knowledge of AgentCloak before the agent touches it.

How it fits into your product

sequenceDiagram
    actor Client
    participant App as Your App
    participant MCP as AgentCloakMCP Server

    rect rgba(80, 140, 220, 0.08)
      Note over Client,MCP: CLOAK — anonymize PII before sending to client
      Client->>App: GET /api/customers
      App->>App: Load records from DB
      note over App: Alice JohnsonBob Smith · Carol White
      App->>MCP: tools/call  cloak"Alice Johnson\nBob Smith\nCarol White"
      note over MCP: Replaces each namewith synthetic value
      MCP-->>App: result: "Kenji Tanaka\nMaria Garcia\nLuca Ferrari"id: abc-123
      App->>Client: Anonymized customer list
      note over Client: Kenji TanakaMaria Garcia · Luca Ferrari
    end

    rect rgba(80, 200, 120, 0.08)
      Note over Client,MCP: UNCLOAK — restore original PII for authorized access
      Client->>App: GET /api/customers/42  [authorized]
      App->>App: Load record from DB
      note over App: stored name: "Kenji Tanaka"stored id: abc-123
      App->>MCP: tools/call  uncloak"Kenji Tanaka"  ·  id: abc-123
      note over MCP: Looks up original valueby cloak session id
      MCP-->>App: result: "Alice Johnson"
      App->>Client: Original customer record
      note over Client: Alice Johnson
    end

The agent adds one function and one call to your existing code — no SDK, no new dependencies, just a fetch to the MCP server.

---

Install the skill

Recommended — Vercel skills CLI (interactive, detects 55+ agents):

npm install -g skills        # install CLI once
npx skills add agentcloak/skill

Prompts you to select which agents to install for. Always includes OpenCode, Cursor, Cline, Codex, Claude Code, GitHub Copilot, and others automatically.

For scripts and CI/CD (non-interactive, no prompts):

# Project-level — installs to .agents/skills/ and .claude/skills/
npx github:agentcloak/skill

# Global — installs for all projects system-wide
npx github:agentcloak/skill -g

# List available skills
npx github:agentcloak/skill --list

After install, the skill is available to any agent that reads from the installed directory.

---

Environment variables

Set before opening your agent:

export INC_MCP_URL="https://us-mt-01.api.incountry.io/mcp"
export INC_MCP_API_KEY=":"

---

Architecture

The skill covers three interaction layers:

Layer 2 — MCP Server (runtime cloaking)

All requests are HTTP POST, JSON-RPC 2.0.

Cloak:

curl -s -X POST "$INC_MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "x-inc-agentcloak-api-key: $INC_MCP_API_KEY" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "id": 1,
    "params": {
      "name": "cloak",
      "arguments": { "message": "John Smith, age 34" }
    }
  }'

Uncloak (requires id from cloak response):

curl -s -X POST "$INC_MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "x-inc-agentcloak-api-key: $INC_MCP_API_KEY" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "id": 2,
    "params": {
      "name": "uncloak",
      "arguments": { "message": "", "id": "" }
    }
  }'

Layer 1 — Portal API (environment configuration)

The agent edits the exported JSON with jq and re-imports the full payload. See agentcloak_export_import.yml for the complete operation spec.

---

Cloakable fields

The MCP server recognizes 8 PII field types:

For other field types (email, phone, address, etc.) use Border configurations with redaction strategies.

---

Example prompts

On-demand:

Cloak the name "Maria Garcia" using the MCP server

What PII cloaking options are available?

Code integration:

Add PII protection to server.ts. Before returning customer records from
GET /api/customers, cloak all fullName fields.

Add a "Protect PII" button to the page. When clicked, cloak all customer
names and update the table.

Environment configuration:

Show border config in environment c6b9a629-...

In environment c6b9a629-..., change email redaction strategy to emailPersistent

Add masking for field $.address in environment c6b9a629-...

---

Supported agents

Installs skills for all agents that follow the Vercel skills spec:

• Claude Code — .claude/skills/
• OpenCode / Cursor / Cline / GitHub Copilot — .agents/skills/
• Windsurf — .windsurf/skills/
• Roo Code — .roo/skills/
• Continue — .continue/skills/