Meet ProtoMap
ProtoMap is a context engine and model harness. It scans your source code and gives engineers and coding agents organization-wide context on every gRPC service and Protobuf message: callers, dependencies, call sites, and field-level dataflows.
Trusted by
Claude Code with Opus 5.5 at high effort, across 20 prompts on 9 gRPC repositories (5M LOC), with higher accuracy (100% vs. 98%). See the benchmarks
Products
A context engine and model harness for gRPC and Protobuf. Engineers query it in plain English; coding agents query it over MCP instead of grepping across repositories.
Deterministic, code-level evidence of where sensitive data flows: into logs, storage, APIs, and third-party and AI integrations.
By team
Engineering: gRPC and Protobuf context for your coding agents
API specs alone don't cover the services and fields consuming your APIs.
Without it, agents spend tokens grepping repositories and writing ad hoc scripts to parse code relationships, often on code that isn't checked out locally, and still miss callers.
ProtoMap’s MCP server gives your agent exact cross-repository context, so a prompt to update a service or API runs 7.7× faster and 6.4× cheaper.
Privacy: code-based GDPR data maps and RoPA evidence
Processing activities fall out of sync with the code: surveys don't scale and produce stale or guessed answers, GRC platforms ship blank templates, and privacy platforms infer flows after deployment, missing shadow AI and SDKs in code.
Stale evidence: documentation weeks or months behind the code, and reported processing activities that diverge from implementation with every release.
GDPR data mapping grounded in code-based evidence across logs, storage, APIs, third-party and AI SDKs, keeping your RoPA current at development speed so you prevent risks instead of reacting after the fact.
Data Security: stop PII, PHI, and secrets before they leak
DSPM gives you posture and DLP removes or redacts sensitive data, but both react once the data is already there. Neither prevents it.
When PII, PHI or auth tokens leak into logs, remediation is disruptive: often hundreds of hours scrubbing logs, auditing access and halting ingestion by third-party monitoring and SIEM tools.
Track 100+ sensitive data types across nested code paths and transformations, and prevent exposure to risky sinks like logs or LLM prompts before any data starts flowing.
Ask ProtoMap
Engineers ask in plain English in the web platform. Coding agents ask over MCP. Both get the same deterministic answer.
Visualize the blast radius up to five hops out, with callers in blue and callees in red, and drill down into every caller, callee and method.
Callers and callees of a method two hops out, plus every call site with the calling method and its file location.
product_id?The message that carries the field, where it is defined, and the services and repositories that send or receive it.
Every inbound service and the repository it lives in, plus the maintainers and dependents of each service.
RPCs with no callers or call sites in the scanned code, plus what to check before you remove each one.
ProtoMap By HoundDog.ai
Ask ProtoMap about your code and data
List all gRPC services
Which services call <RPC method>?
What is the blast radius of changing <field name>?
Opus 5.5 · High
ProtoMap By HoundDog.ai
Ask ProtoMap about your code and data
List all gRPC services
Which services call <RPC method>?
What is the blast radius of changing <field name>?
Opus 5.5 · High
ProtoMap By HoundDog.ai
Ask ProtoMap about your code and data
List all gRPC services
Which services call <RPC method>?
What is the blast radius of changing <field name>?
Opus 5.5 · High
ProtoMap By HoundDog.ai
Ask ProtoMap about your code and data
List all gRPC services
Which services call <RPC method>?
What is the blast radius of changing <field name>?
Opus 5.5 · High
ProtoMap By HoundDog.ai
Ask ProtoMap about your code and data
List all gRPC services
Which services call <RPC method>?
What is the blast radius of changing <field name>?
Opus 5.5 · High
Ask the Privacy Code Scanner
With the self-hosted or cloud platform, your organization’s data map becomes queryable in plain English.
An AppSec engineer asks which sensitive data and auth tokens are leaking into application logs.
Show me all sensitive data and auth tokens leaking in application logs
HoundDog.ai Acme Corp
New chat
Show me all sensitive data and auth tokens leaking in application logs
···
Ask HoundDog.ai about your data
Suggested for you
Which repositories handle medical data?Show me the most severe open risky dataflows right nowWhich third parties receive PII?Which AI services receive sensitive data in our code?What data elements are present in my code?
A privacy engineer asks which third-party integrations receive PII.
Which third parties receive PII?
HoundDog.ai Acme Corp
New chat
Which third parties receive PII?
···
Ask HoundDog.ai about your data
Suggested for you
Which repositories handle medical data?Show me the most severe open risky dataflows right nowWhich third parties receive PII?Which AI services receive sensitive data in our code?What data elements are present in my code?
An AI governance team asks which AI integrations exist and what sensitive data reaches them.
Which AI services receive sensitive data in our code?
HoundDog.ai Acme Corp
New chat
Which AI services receive sensitive data in our code?
···
Ask HoundDog.ai about your data
Suggested for you
Which repositories handle medical data?Show me the most severe open risky dataflows right nowWhich third parties receive PII?Which AI services receive sensitive data in our code?What data elements are present in my code?
main branch of the hounddogai/hounddog-test-python repository, in one file.Dataflows: one confirmed dataflow, and it is risky.
Read the Datamap docs Related: Privacy Code ScanningData Flow MappingRoPAAI Governance
Static analysis discovers. AI reasons. MCP delivers.
HoundDog.ai is built to make your AI more effective, not to replace it.
The scanners discover every gRPC service, Protobuf field and sensitive dataflow, so your AI tokens go to assessing the blast radius, planning changes, triaging risk and answering questions.
The same commit always produces the same context. Every engineer, privacy reviewer and agent gets the same answer about what a change will break and where sensitive data goes, instead of output that varies with the prompt.
The Rust scanner runs in CI on standard CPU infrastructure, across every repo and every commit, with negligible impact on build times.
The business case
Change planning & AI coding agents
reduction in tokens and time for change-planning tasks (enterprise customer, monorepo of millions of lines of code).
for a single prompt, 8m 13s down to 27s (Claude Code, Opus 5.5). See the benchmarks
context refreshes in CI on standard CPU infrastructure.
GDPR data mapping, RoPA & leak prevention
less manual data-mapping effort (Fortune 500 outcome).
saved by one customer in eng hours and masking tooling.
to remediate a flagged exposure, fix suggested in the PR.
ProtoMap's figures are from its benchmarks, for one prompt (Q09, finding every caller of a method to remove it): Claude Code with Opus 5.5 at high effort, on 9 gRPC repositories with 5 million lines of code, with and without ProtoMap. Results vary by model, repository, prompt and task.
Flagship deployment
Install the self-hosted version for free. It runs on your machine with Docker, and your source code stays in your environment.
Paste into your coding agent
Set up ProtoMap and show me what it can do. ProtoMap maps gRPC services and protobuf messages across repositories, and gives coding agents that graph over MCP. Docs: https://docs.protomap.ai/quickstart/
Tell me what you are about to do before each step that installs something.
1. Check that this computer has git, Docker with Compose 2.23.1 or newer, at least 4 GB of RAM, and 20 GB of disk space. If anything is missing, tell me and stop.
2. Install ProtoMap Server, in a folder outside this repository:
git clone https://github.com/hounddogai/protomap.git
cd protomap
./self-hosted/scripts/install.sh
The installer asks questions. Choose Trial, which runs PostgreSQL locally and logs the CLI in, and keep the default port.
3. Show me the address and the one-time setup key the installer prints. Ask me to open the address, enter the key, and create my organization and owner account. Wait until I say that's done.
4. Scan this repository, from a new shell so the CLI is on the PATH:
protomap scan .
If it has no gRPC services in a supported language, tell me, and offer to scan a public example instead:
git clone https://github.com/GoogleCloudPlatform/microservices-demo.git
protomap scan microservices-demo
5. From the scanned repository's folder, add ProtoMap to yourself as an MCP server:
Claude Code: claude mcp add protomap -- protomap mcp serve
Codex: codex mcp add protomap -- protomap mcp serve
Antigravity: add "protomap": { "command": "protomap", "args": ["mcp", "serve"] } under mcpServers in ~/.gemini/config/mcp_config.json
Others: https://docs.protomap.ai/coding-agents/
Tell me if I need to restart you for it to take effect.
6. Tell me what the scan found, then use ProtoMap's tools to answer one question about my services, such as which services call a method and where. Suggest two more questions I could ask.