Two Channels, Two Attack Surfaces
Developers use AI in two places. Each place has a different data flow. Each needs a different security control.
IDE-integrated AI — Cursor, GitHub Copilot, VS Code extensions, and Claude Desktop can read your project. Code files, config files, and env vars are all in scope. The AI model gets what the developer pastes or what the client pulls from project context.
Browser-based AI — Claude.ai, ChatGPT, and Gemini run in the browser. Developers paste code, stack traces, and error messages through browser text fields. The text goes straight to the AI provider. No filter sits in between.
Both channels expose sensitive data to AI providers. Both need controls. But the right control for each channel is different. A team that covers only one channel has protected only half the developer workflow.
The IDE Layer: MCP Server
For Claude Desktop and Cursor users, the Model Context Protocol (MCP) is the right security layer.
MCP sits between AI clients and AI model APIs. The MCP Server reads all data in that interface before it reaches the model.
This position enables three things:
Key and secret removal — API keys, database strings, auth tokens, and internal URLs are found and replaced with safe tokens before sending. The model gets [API_KEY_1] instead of the real key value.
Custom code patterns — Teams can add custom match rules for internal product codes, customer IDs, and service names. Standard PII tools do not know these patterns. Custom rules run in the MCP Server before any data leaves.
No disruption to dev work — The developer uses Cursor or Claude Desktop just as before. The MCP Server runs between client and API. The developer sees no change. They get the same AI help.
GitHub Octoverse 2024 recorded 39 million secrets leaked on GitHub — a 25% year-over-year rise. The same habit that drives those leaks also drives IDE AI leaks. Credentials end up in committed code. They also end up in pasted context. MCP Server interception covers the AI channel of that same pattern.
See also: MCP Server PII Security in 2026
The Browser Layer: Chrome Extension
For browser-based AI — Claude.ai, ChatGPT, Gemini — a Chrome Extension is the right control.
The extension runs as a content script on each AI platform. It reads text before the developer submits it. It finds sensitive content — names, secrets, and code patterns you set — and masks them before the text reaches the AI provider.
The two layers cover different channels:
MCP Server covers — all AI use through Claude Desktop or Cursor. Code review, debug sessions, and project context queries all go through this layer.
Chrome Extension covers — all browser-based AI use. Claude.ai, ChatGPT, Gemini, Perplexity, and any other AI interface in the browser. This includes developers who use browser AI for docs work or questions they prefer to keep out of the IDE.
See also: Blocking vs Anonymization for Browser DLP
What Combined Coverage Looks Like
A dev team running both layers gets full coverage. Here is how it works in practice.
A developer uses Cursor with Claude to debug a live issue. The MCP Server strips secrets from the stack trace before Claude sees it. No keys are sent.
The same developer then opens Claude.ai in the browser for an architecture question. They include an internal service URL. The Chrome Extension removes the URL before it is sent. No internal URL reaches Claude.
A colleague uses ChatGPT for docs help. They paste code that has an API key. The Chrome Extension catches the key before it goes to OpenAI. No key is exposed.
Neither channel exposes secrets or sensitive code to AI providers. Both developers use AI for real work. The security team has technical controls on both channels — not just policy rules.
CVE-2024-59944 shows one case of the wider pattern. Developer AI tools without interception layers are a leak channel. The two-layer model is the direct response to that risk.
See also: AI Coding Assistant PII Leakage in Production
Why One Layer Is Not Enough
Some teams block browser AI and rely on IDE tools only. Others allow browser AI but do not cover the IDE. Both approaches leave a gap.
A developer who uses Cursor at work may also open ChatGPT in a browser tab to check a quick question. An IDE-only control does not catch that. A browser-only control does not catch the IDE session. Both channels are active in a real developer day.
The two-layer model covers both. It does not rely on developers to avoid one channel or the other. It runs silently in both places.
anonym.legal provides both layers: an MCP Server for IDE-integrated AI and a Chrome Extension for browser-based AI. Both run on the same detection engine — 285+ entity types, 48 languages, reversible encryption.