Sensitive document work can be moved from a coding agent to a private MCP server, which returns a smaller redacted artifact instead of the original file.
2
Superlinked's inference infrastructure runs different document tools and models on controlled GPU workers, with batching, model swapping, and task-specific LoRAs.
3
The privacy boundary still needs testing because an agent that can read a raw file before calling the tool could bypass the intended preprocessing step.
Summary
Filip Makraduli builds an Obsidian and Claude Code workflow for processing sensitive files without sending every page and image to an external model. An MCP server exposes tools for OCR, document conversion, entity extraction, summarization, question answering, and redaction. The heavy work runs on a Superlinked cluster or on infrastructure the user controls, then returns a smaller Markdown artifact for the main agent. The infrastructure includes GPU worker pools, per-worker batching, model hot swapping, autoscaling, and support for task-specific LoRAs. A live demo starts with synthetic files in an inbox, redacts an NDA, and converts a scanned contract into Markdown before masking personal information. Makraduli also discusses future model routing based on task, cost, latency, and which models are already warm. The final questions expose a limit: instructions alone may not prevent an agent from accessing the original file, so teams need to evaluate the access boundary and may need their own harness.
The workflow starts with privacy and token costs in an Obsidian vault
Makraduli began with Markdown files in Obsidian, but agent tools such as Claude Code can expose files to external services. His goal was to keep sensitive material private and self-hosted while retaining a convenient workflow. Document processing adds cost because scans and images require OCR and can fill the model context with material that another system could process first. He also wanted to test open models and adapt them to narrow tasks through fine-tuning. The proposed workflow preprocesses sensitive files in a private cloud and sends the main agent a smaller result.
Smaller artifacts give the agent cheaper and more focused context
The design moves expensive document work away from the main coding agent. Makraduli gives the example of a ten-page PDF containing images and other details. Open OCR models can turn that document into a smaller artifact before the result reaches Claude Code or another agent harness. The returned content preserves useful context while reducing the amount of raw material sent through the agent's model. Redaction is part of the same process, so personal information can be removed before the main agent sees the output.
MCP connects the agent to a private inference service
Makraduli chose an MCP server instead of only a local plugin or API because the work needed a dedicated cluster behind the agent interface. The setup has a host and MCP client in Claude Code or another harness, an MCP server, and a Superlinked cluster with GPUs and worker pools. The server exposes tools, while the cluster runs the models. Communication uses JSON-RPC, and the implementation uses streaming HTTP responses. In this privacy-focused setup, the server exposes tools without adding the more complex client-side sampling or elicitation flow.
The document tools cover OCR, extraction, and redaction
The available tools include document-to-Markdown conversion with OCR models, entity extraction with named entity recognition models, captioning, tagging, structured generation, summarization, question answering, and redaction. Makraduli says users can add another tool to the open-source repository and have it use the same inference layer. The setup can run locally in a Docker container, use a managed cluster, or run on a user's own cluster. The intended result is a common interface for different document jobs rather than a separate integration for each task.
The demo converts and redacts a scanned NDA before the agent uses it
The live exercise starts with synthetic files in an inbox, including an NDA with sensitive details. Makraduli asks Claude Code to redact the NDA, then asks it to preprocess scans and redact them. A scanned contract is converted into a Markdown file through OCR, and personal information is masked in the resulting document. He shows a redacted output with extracted entities and label counts. The raw scan is processed on the private cluster, while the agent receives the processed result. A token counter in the setup is intended to show the savings, although he says it still needs updating.
Worker-level batching and model swapping shape the inference performance
The cluster connects a gateway to different worker pools, with a batcher for each worker. Makraduli says this performed better in their testing than putting all requests into one shared queue and having workers pull from it. Separate pools can run heavier models on suitable hardware while lighter workloads use less expensive instances, and unused capacity can scale down. Smaller models for named entity recognition, embeddings, or generation can be swapped on a GPU. This also lets a team test several task-specific LoRAs without dedicating a separate GPU to every model.
Task-specific models and end-to-end architecture can change the cost picture
Makraduli reports that the team's current benchmarks focus on embedding models. He says their best model for a task reached 99.8% of a frontier model's result on MTEB tasks, at roughly 10 times lower price. He attributes some of the production benefit to the whole system, including batching and worker layout, rather than only to faster model inference. He also describes German-language LoRAs for narrow legal use cases, which were relatively cheap to fine-tune and deploy. These examples support keeping several adapted models available for particular workloads.
Model routing is a future option based on task, cost, and warm GPUs
The current system uses tool calls, but Makraduli describes a future router that could choose the underlying model for each task. An OCR request might select a cheaper model, while another request could use a different model based on its requirements. Routing could consider whether a model is already loaded on a GPU, since reusing a warm model may be cheaper than loading a less expensive model that is currently absent. He also mentions model councils and reasoning tools as future directions, while warning that thinking tokens can consume a summarization model's output without producing a useful summary.
The privacy boundary must be tested before using the workflow with sensitive files
During questions, Makraduli says the intended flow gives Claude Code only the redacted document, while the original file is processed in the private environment. He also accepts that this behavior needs more testing. If the agent can access the raw file before calling the MCP tool, instructions may not fully enforce the boundary. He suggests stronger guardrails at the initial access point or building a custom harness with an open-source model. The cluster itself can be managed by Superlinked or deployed by the user with the repository's infrastructure configuration and Terraform.
"I wanted to find a way to kind of do this, but also having smaller artifacts means that you get better context, so you kind of limit context loss in a way."03:01
Who should watch
You are building agent workflows around confidential PDFs, scans, or personally identifiable information and need preprocessing before a larger model sees the content.
Your team wants to run OCR, extraction, embeddings, or redaction with open models on GPUs it controls.
You are evaluating MCP privacy claims and need to think through whether the agent can access an original file before a private tool processes it.
