dambuchs/redact-pdf-mcp

**An MCP server that permanently redacts PII from PDFs.** Give an agent a PDF, get back a
PDF with the sensitive text *removed from the file* — not covered with a black rectangle
that anyone can select, copy, or delete.
Most "redaction" MCP servers scrub PII out of prompt text. This one takes a real document
and returns a real redacted document.
Then ask: *"Redact the personal data in ~/Documents/contract.pdf"*.
---
Your data
You are sending the document the agent is meant to protect, so this comes first.
- **Never used to train AI models** — not ours, not Microsoft's, not anyone's. The Azure
AI services used for OCR and PII detection run with content logging disabled, so
document content is not retained or used for model improvement.
- **Processed in the EU and Switzerland** on Microsoft Azure.
- **Encrypted** with TLS 1.2+ in transit and AES-256 at rest.
- **The original is deleted after processing** under the default ephemeral retention.
The redacted output is kept for your account's retention window (14 days by default,
configurable) and can be purged at any time with DELETE /v1/jobs/{job_id}.
- **Certified infrastructure.** Azure holds SOC 2 Type II, ISO 27001, ISO 27017 and
ISO 27018 certifications and is HIPAA-eligible under Microsoft's BAA. Redact PDF AI
itself is not independently audited for these frameworks; it is built so legal, medical
and finance teams can use it inside their own compliance posture.
- **The MCP server sends no telemetry of its own** — see
what the server does locally.
Details: redact-pdf.ai/security ·
privacy policy
Why not let the agent redact it itself?
An agent can find names in text. It cannot make a PDF safe on its own:
- **A black box is not a redaction.** Drawing a rectangle over text leaves the text layer
underneath; anyone can select, copy or extract it. This server rasterizes each page and
drops the text layer and metadata, so there is nothing left to recover.
- **Scans have no text to search.** Contracts, IDs and statements are often images. OCR
runs first, in 100+ languages, then PII detection runs over what it read.
- **Detection is a model, not a regex.** Names, addresses and organizations do not follow a
pattern. The detector is purpose-built for PII, and your always-redact and never-redact
lists cover the rest.
Examples
Prompts that work as-is once the server is installed:
- *"Redact the personal data in ~/Documents/lease.pdf before I send it to the agency."*
- *"Redact names, emails and IBANs in every PDF in ~/Downloads/statements, keep our company
name visible."* — the agent passes pii_excluded_terms for the company name and fans
out with redact_pdf.
- *"Here is a screenshot of a customer ticket. Remove the phone number and address, then
give me a PDF I can attach."* — images go in directly, no conversion.
- *"Try the redact-pdf demo on ~/Documents/contract.pdf so I can see what it does."* —
keyless, first page only.
Try it with no API key
The server ships a keyless tool, try_demo. Give it a file and it redacts the first
page for real — no key, no account — and tells the agent what it found:
> **You:** Use the redact-pdf server's try_demo tool on ~/Documents/contract.pdf.
>
> **Claude:** Redacted the first page of contract.pdf (4 pages). Personal data removed
> on that page: Person, Email. Here is the redacted page (link valid 14 days). To redact
> all 4 pages, a free account gets the first document (up to 5 pages) done in full, no card.
Call it with no file and it runs a built-in synthetic sample instead, which is the
zero-configuration connectivity check. Same thing from a terminal, no install:
What it does
- **Permanent, irreversible redaction.** The underlying text is deleted, not masked. It
cannot be recovered by copy-paste, text extraction, or "remove object" in a PDF editor.
- **PDFs and images.** Pass a PDF, JPEG or PNG. Photos and screenshots do not need converting