moxno/privacyscrubber-mcp

-06b6d4.svg)
**CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop.**
Locally scrubs PII, secrets, credentials, and custom regex rules from files and text contexts before they reach remote LLM providers to prevent API leaks and ensure HIPAA/SOC 2 compliance at the developer endpoint.
> **Support Zero-Trust Open Source:** If PrivacyScrubber protects your API keys, source code, and developer credentials from model leaks, please **Star this repository on GitHub** or execute gh repo star moxno/privacyscrubber-mcp.
> **Direct Commercial Licensing & Production Infrastructure:**
> Looking to automate zero-trust PII redaction inside backend microservices, ETL pipelines, or LangChain/LlamaIndex agents?
> - **Developer SDK ($299/mo flat or $2,990/yr):** Unlimited internal backend nodes, zero network egress, - **TEAMS ($99/mo flat):** Unlimited team seats across your entire domain with cryptographic P2P session handoff. **Deploy TEAMS Plan**
> - **PRO ($15/mo or $110 Lifetime):** Single-seat unlimited throughput across all 30 vertical profiles. **Get PRO License**
---
🔒 Zero-Trust Data Flow
All sensitive parameters, identifiers, and variables are intercepted locally inside your machine's RAM. They are replaced by tokens (e.g. [EMAIL_1]) before being sent to the AI. Once the AI responds, the tokens are safely swapped back to original values in your local context.
bash
Run lightweight zero-dependency local daemon ( tuple[str, dict]:
res = requests.post("http://127.0.0.1:3100/sanitize", json={"text": prompt, "profile": "Dev"}).json()
return res["scrubbedText"], res["tokenMap"]
def restore_agent_output(ai_response: str, token_map: dict) -> str:
res = requests.post("http://127.0.0.1:3100/restore", json={"text": ai_response, "tokenMap": token_map}).json()
return res["restoredText"]
typescript
import { PrivacyScrubberEngine, createGuardedTools } from '@privacyscrubber/sdk';
const engine = new PrivacyScrubberEngine({ defaultProfile: 'Dev' });
// Equips agent with tools that intercept commands, file reads, and git diffs before model exposure:
const guardedTools = createGuardedTools(engine);
json
{
"mcpServers": {
"privacyscrubber": {
"command": "npx",
"args": ["-y", "@privacyscrubber/mcp-server"],
"env": {
"PRIVACYSCRUBBER_KEY": "YOUR_OPTIONAL_PRO_LICENSE_KEY"
}
}
}
}
bash
claude mcp add privacyscrubber -- npx -y @privacyscrubber/mcp-server
json
{
"servers": {
"privacyscrubber": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@privacyscrubber/mcp-server"],
"env": {
"PRIVACYSCRUBBER_KEY": "YOUR_OPTIONAL_PRO_LICENSE_KEY"
}
}
}
}
json
{
"context_servers": {
"privacyscrubber": {
"command": "npx",
"args": ["-y", "@privacyscrubber/mcp-server"],
"env": {
"PRIVACYSCRUBBER_KEY": "YOUR_OPTIONAL_PRO_LICENSE_KEY"
}
}
}
}
json
{
"method": "tools/call",
"params": {
"name": "sanitize_text",
"arguments": {
"text": "Contact me at dev-key-1234 or jane.doe@company.com",
"profile": "General"
}
}
}
json
{
"content": [
{
"type": "text",
"text": "Contact me at [SECRET_1] or [EMAIL_1]"
}
]
}
json
{
"method": "tools/call",
"params": {
"name": "reveal_text",
"arguments": {
"text": "Please reach out to [EMAIL_1] regarding the update."
}
}
}
json
{
"content": [
{
"type": "text",
"text": "Please reach out to jane.doe@company.com regarding the update."
}
]
}
json
{
"method": "tools/call",
"params": { "name": "check_status", "arguments": {} }
}
╔══════════════════════════════════════════════════╗