Secure web research, without a path into the company
A confidential Canadian technology company (60+ employees) kept web search off inside Claude. We designed a gateway that can read the public web and cannot reach company systems.
The challenge.
Web search stayed off because a public page can hide instructions, and a connected model can carry them into company systems. A dedicated platform was quoted near $40,000 USD a year.
The approach.
Whatever reads the internet cannot touch sensitive systems. Claude sends the question to a Cloudflare MCP portal, which checks sign-in, allows one search tool, and logs the call. A Worker sees only that plain query and a stored Perplexity key. Perplexity searches the public web. Guardrails look for prompt injection. A summarizer with no company connectors returns a summary, key facts, and sources.
Against a dedicated platform and a direct search switch, the gateway fit the risk. An illustrative 75,000 searches a year sat, on early vendor figures, in the low thousands of dollars a year before labour and maintenance — not a contract, and not a measured saving. The same work covered the threats (injection, data leaving the company, tool misuse, poisoned output, wide permissions, thin logging), a vendor review, and a six-phase proof of concept.
How it moves.
Scroll to follow it through. Drag to turn the model, and select any part to read what it does. The drawing is the design, not a product screenshot.
Select a step or part to read what it does.
A question travels from an employee through an MCP portal, a Worker and a search API to the public web. Pages come back as untrusted packets. A guardrail stops hostile ones; clean ones enter a sealed summarizer with no connectors, which returns a summary, key facts and sources. The company's systems have no connection to anything on the web side.
01
One plain question goes out.
Claude sends only the question. The portal checks sign-in, allows one search tool and logs the call. The Worker holds the search key and nothing else.
02
What comes back is untrusted.
Public pages can hide instructions. They are treated as hostile until they are inspected, and they never travel with company access.
03
Injection stops at the guardrail.
Suspected prompt injection is stopped at the boundary. Clean content continues. Data-loss checks can be added at the same point.
04
A sealed model writes the summary.
The summarizer sees only the question and the pages. It has no company connectors and no tools. It returns a summary, key facts and sources.
05
The employee gets the clean result.
Claude receives the sanitized answer, never the raw page. Nothing that touched the web is wired to Outlook, SharePoint or files.
Illustrative flow. This system is not deployed.
Where it stands.
Inspect at the boundaries, keep the internet-facing piece away from company systems, and spend in proportion to the risk.
Project status: architecture and vendor evaluation. Not deployed. Cost figures are early estimates, not a quote and not a measured result.
A useful next step.
Let’s talk.
Bring the workflow that’s stuck. We’ll help you find a first step — even if that step is not a model.
Based in Toronto. Meetings in the GTA or by video.