The target is simple to state: a GitHub Copilot agent can query a real database and get useful results back, but the customer emails, card numbers, and tokens in those results are redacted before the agent ever sees them. The raw values never leave the database boundary.
That is what data masking for an AI coding agent should achieve. It is not about trusting the agent to behave. It is about making sure the sensitive bytes do not reach a context where they can be logged, echoed, or pasted into a downstream system.
To set expectations, hoop.dev does not inspect what GitHub Copilot generates or filter the model's prompt. Data masking happens on the database connection the agent uses, at the protocol layer, on the data flowing back from the query.
The end-state for masked agent queries
- The agent runs a normal query and gets a normal-looking result.
- Fields classified as PII, PHI, or secrets come back redacted.
- The redaction happens before results reach the agent, not after.
- No copy of the raw data lands in a side store.
Where masking has to sit
If masking is something the agent applies to its own output, it is not masking, it is a suggestion. The redaction has to run on the connection, outside the agent, so the agent only ever receives the masked stream. That placement is the requirement.
hoop.dev is an open-source Layer 7 gateway. The agent connects to a database through it. On connections that support masking, hoop.dev streams returned content to a configured DLP provider such as Presidio or Google DLP, which classifies sensitive fields, and the gateway redacts them inline before the response reaches the agent. The classification is content-aware, not a fixed list of column names, so it catches an email address sitting in a free-text notes field, not just the column literally called email.
Why this matters more for an agent than a person
A human engineer who pulls a customer record into a query result reads it and moves on. The data lives in their terminal scrollback for a while and that is the end of it. An agent is different. Whatever lands in its context can be summarized, embedded, written into a file, passed to another tool, or echoed into a downstream system as part of its normal operation. The surface area for sensitive data to leak is far larger, and it grows with every tool the agent can call. Masking at the connection shrinks that surface to zero for the fields you redact, because the raw values were never in the agent's hands to begin with.
That is why masking belongs to the same control surface as access scope and recording, not off to the side. The question is not only what the agent may query, but what the query is allowed to hand back.
Steps to enable data masking
- Register the database connection on hoop.dev with a least-privilege role.
- Attach a DLP provider. Configure Presidio or Google DLP as the classifier for that connection.
- Define what to redact: email, card numbers, names, tokens, whatever the data demands.
- Point the agent at the gateway rather than the database directly.
- Verify. Run a query that would normally return PII and confirm it comes back masked.
-- the agent runs this through the gateway
SELECT id, email, last_login FROM users LIMIT 5;
-- result the agent receives:
-- 42 | [REDACTED_EMAIL] | 2026-06-10
-- raw email never leaves the database boundary
Pitfalls
- Assuming masking is on everywhere. Support is per connection. Some connectors mask natively, some need configuration, some do not support it. Check the docs for the connection you are using.
- Masking only the obvious column. Free-text fields hide PII too. Let the DLP classifier inspect content, not just column names.
- Logging before masking. Make sure no log captures the raw result upstream of the redaction step.
FAQ
Does data masking change what GitHub Copilot can generate?
No. hoop.dev does not touch the model. It redacts sensitive fields in the data returned over the database connection the agent uses.
Is masking available on every connection?
No. It depends on the connector. Database connections commonly support masking through a DLP provider; some protocols like SSH and RDP do not. Confirm per connection.
Stand up masked agent access from the open-source project on GitHub. The getting started guide covers configuring a connection, and hoop.dev learn explains inline masking in depth.
