{/* Left: Threat Feed */}
{/* Center: Charts */}
[truncated — 513 more characters]
```
### setup.sh
```shell
#!/bin/bash
# ShadowGuard - Quick Setup Script
# Run this on your laptop (macOS or Linux)
set -e
echo "🛡️ ShadowGuard Test Setup"
echo "========================="
echo ""
# Detect OS
OS=$(uname -s)
echo "Detected OS: $OS"
# Step 1: Install mitmproxy
echo ""
echo "📦 Step 1: Installing mitmproxy..."
if command -v mitmdump &> /dev/null; then
echo " ✅ mitmproxy already installed: $(mitmdump --version | head -1)"
else
if [ "$OS" == "Darwin" ]; then
echo " Installing via brew..."
brew install mitmproxy
else
echo " Installing via pip..."
pip install mitmproxy
fi
echo " ✅ mitmproxy installed"
fi
# Step 2: Install Python dependencies for the addon
echo ""
echo "📦 Step 2: Installing Python dependencies..."
pip install requests 2>/dev/null || pip install requests --break-system-packages 2>/dev/null
echo " ✅ Dependencies installed"
# Step 3: Generate mitmproxy CA cert (first run creates it)
echo ""
echo "🔐 Step 3: Generating mitmproxy CA certificate..."
# Start and immediately stop mitmdump to generate certs
timeout 2 mitmdump --listen-port 18080 2>/dev/null || true
CERT_DIR="$HOME/.mitmproxy"
if [ -f "$CERT_DIR/mitmproxy-ca-cert.pem" ]; then
echo " ✅ CA cert generated at: $CERT_DIR/mitmproxy-ca-cert.pem"
else
echo " ⚠️ Cert not found. It'll be generated on first run."
fi
# Step 4: Install CA cert into system trust store
echo ""
echo "🔐 Step 4: Installing CA certificate..."
if [ "$OS" == "Darwin" ]; then
echo " On macOS, we'll open Keychain Access."
echo " You need to:"
echo " 1. Double-click the cert to add it"
echo " 2. Find 'mitmproxy' in Keychain"
echo " 3. Double-click it → Trust → 'Always Trust'"
echo ""
read -p " Press Enter to open the cert in Keychain Access..."
open "$CERT_DIR/mitmproxy-ca-cert.pem" 2>/dev/null || echo " Open manually: $CERT_DIR/mitmproxy-ca-cert.pem"
echo ""
echo " ⚠️ IMPORTANT: After adding, set it to 'Always Trust'!"
echo " (Double-click the cert in Keychain → Trust → Always Trust)"
read -p " Press Enter once you've trusted the cert..."
elif [ "$OS" == "Linux" ]; then
echo " Installing cert system-wide (needs sudo)..."
sudo cp "$CERT_DIR/mitmproxy-ca-cert.pem" /usr/local/share/ca-certificates/mitmproxy.crt
sudo update-ca-certificates
echo " ✅ CA cert installed system-wide"
fi
# Step 5: Summary
echo ""
echo "========================================="
echo "✅ Setup complete!"
echo ""
echo "To start intercepting:"
echo " 1. Start the proxy:"
echo " mitmdump -s shadowguard_addon.py --listen-port 8080"
echo ""
echo " 2. Test with browser (open a new Chrome window):"
echo " On macOS:"
echo " open -na 'Google Chrome' --args --proxy-server='http://localhost:8080'"
echo " On Linux:"
echo " google-chrome --proxy-server='http://localhost:8080'"
echo ""
echo " 3. Test with terminal:"
echo " export HTTPS_PROXY=http://localhost:8080"
echo " export SSL_CERT_FILE=$CERT_DIR/mitmproxy-ca-cert.pem"
echo " curl https://api.openai.com/v1/models"
echo ""
echo " 4. Or run the test script:"
echo " python3 test_interception.py"
echo "========================================="
```
### shadowguard_addon.py
```python
"""
ShadowGuard - mitmproxy Addon
Intercepts HTTPS traffic to AI services and detects PHI.
Usage:
mitmdump -s shadowguard_addon.py --listen-port 8080
"""
import mitmproxy.http
from mitmproxy import ctx
import json
import re
import time
import urllib.request
import threading
from datetime import datetime
# Import the PHI redactor
from phi_redactor import PHIRedactor
# ============================================================
# CONFIGURATION
# ============================================================
# PHI engine: "regex" (default) or "ollama" (requires local Ollama with llama3.2:3b)
PHI_ENGINE = "regex"
# Known AI service domains → friendly names
AI_DOMAINS = {
# OpenAI
"api.openai.com": "OpenAI API",
"chat.openai.com": "ChatGPT",
"chatgpt.com": "ChatGPT",
"cdn.oaistatic.com": "OpenAI Static",
# Anthropic
"api.anthropic.com": "Anthropic API",
"claude.ai": "Claude",
# Google
"generativelanguage.googleapis.com": "Gemini API",
"gemini.google.com": "Gemini",
"bard.google.com": "Bard",
# Others
"chat.deepseek.com": "DeepSeek",
"api.cohere.ai": "Cohere",
"api.perplexity.ai": "Perplexity",
"api-inference.huggingface.co": "HuggingFace",
"api.mistral.ai": "Mistral",
"api.together.xyz": "Together AI",
"api.groq.com": "Groq",
"copilot.microsoft.com": "MS Copilot",
}
# Domains to ignore (static assets, telemetry, etc.)
IGNORE_PATHS = {
"/v1/models", # Just listing models, not sending data
"/favicon.ico",
"/_next/",
"/assets/",
}
# PHI detection patterns
PHI_PATTERNS = {
"SSN": r"\b\d{3}-\d{2}-\d{4}\b",
"MRN": r"\bMRN[\s:#]*\d{5,}\b",
"Phone": r"\b\d{3}[-.)]\s*\d{3}[-.)]\s*\d{4}\b",
"DOB": r"\b(?:DOB|date\s*of\s*birth)[\s:]*\d{1,2}[/-]\d{1,2}[/-]\d{2,4}\b",
"Patient_Name": r"\b(?:patient|pt|name)[\s:]+[A-Z][a-z]+\s+[A-Z][a-z]+\b",
"Diagnosis_Code": r"\b[A-Z]\d{2}\.?\d{0,4}\b", # ICD-10 codes like E11.9
"Email": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
"Address": r"\b\d{1,5}\s+[A-Z][a-z]+\s+(?:St|Ave|Blvd|Dr|Rd|Ln|Way)\b",
}
# Medical keywords that boost risk score
MEDICAL_KEYWORDS = [
"patient",
"diagnosis",
"prescribed",
"medication",
"discharge",
"admission",
"lab results",
"radiology",
"MRI",
"CT scan",
"blood pressure",
"heart rate",
"allergies",
"surgery",
"prognosis",
"treatment plan",
"medical record",
"clinical notes",
"HIPAA",
"PHI",
"EHR",
"ICD",
"CPT",
"vital signs",
]
# ============================================================
# RISK SCORING
# ============================================================
def detect_phi(text: str) -> dict:
"""Scan text for PHI patterns. Returns dict of pattern_name → matches."""
findings = {}
for name, pattern in PHI_PATTERNS.items():
matches = re.findall(pattern, text, re.IGNORECASE)
if matches:
findings[name] = matches
return findings
def count_medical_keywords(text: str) -> int:
"""Count how many medical keywords appear in the text."""
text_lower = text.lower()
return sum(1 for kw in MEDICAL_KEYWORDS if kw.lower() in text_lower)
def score_risk(body: str, service: str, method: str) -> dict:
"""
Score the risk of a request on a 0-100 scale.
Returns a dict with score, breakdown, and PHI findings.
"""
score = 0
reasons = []
# Base score: any request to unauthorized AI service
score += 15
reasons.append(f"Unauthorized AI service: {service} (+15)")
# PHI detection (biggest signal)
phi = detect_phi(body)
if phi:
phi_boost = min(len(phi) * 15, 45) # up to +45
score += phi_boost
for ptype, matches in phi.items():
reasons.append(f"PHI detected [{ptype}]: {len(matches)} match(es) (+15)")
# Medical keyword density
med_count = count_medical_keywords(body)
if med_count >= 3:
med_boost = min(med_count * 3, 15)
score += med_boost
reasons.append(f"Medical keywords: {med_count} found (+{med_boost})")
# Payload size (large = likely pasting documents)
body_len = len(body)
if body_len > 10000:
score += 15
reasons.append(f"Very large payload: {body_len} chars (+15)")
elif body_len > 3000:
score += 8
reasons.append(f"Large payload: {body_len} chars (+8)")
# POST/PUT = sending data (vs GET = just browsing)
if method in ("POST", "PUT", "PATCH"):
score += 5
reasons.append(f"Data submission method: {method} (+5)")
# Time-based risk (off-hours)
hour = time.localtime().tm_hour
if hour < 6 or hour > 22:
score += 5
reasons.append(f"Off-hours access: {hour}:00 (+5)")
return {
"score": min(score, 100),
"reasons": reasons,
"phi_findings": {k: len(v) for k, v in phi.items()},
"phi_detected": len(phi) > 0,
"medical_keyword_count": med_count,
"payload_size": body_len,
}
# ============================================================
# PRETTY PRINTING
# ============================================================
def risk_color(score: int) -> str:
if score >= 70:
return "\033[91m" # red
elif score >= 40:
return "\033[93m" # yellow
else:
return "\033[92m" # green
RESET = "\033[0m"
BOLD = "\033[1m"
DIM = "\033[2m"
def print_event(flow, service, risk, body):
"""Pretty-print a detected event to the terminal."""
color = risk_color(risk["score"])
ts = datetime.now().strftime("%H:%M:%S")
print(f"\n{'=' * 70}")
print(f"{BOLD}🛡️ SHADOWGUARD INTERCEPT{RESET}")
print(f"{'=' * 70}")
print(f" ⏰ Time: {ts}")
print(f" 🌐 Service: {service}")
print(f" 📡 Method: {flow.request.method} {flow.request.path}")
print(f" 📦 Size: {len(body)} chars")
print(f" {color}{BOLD}⚠️ Risk Score: {risk['score'
[truncated — 9416 more characters]
```
[22 more indexed source files omitted to keep this export small. The full file list is in the Codebase structure section above.]