moxno-privacyscrubberBLOCK
Zero-Trust PII & secrets redaction MCP server for Cursor & Claude. Lightweight, zero-dependency Presidio alternative for Node.js / TypeScript.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@privacyscrubber/mcp-server) [](https://www.npmjs.com/package/@privacyscrubber/mcp-server) [](https://www.npmjs.com/package/@privacyscrubber/sdk) [](https://www.npmjs.com/package/@privacyscrubber/sdk) [](https://www.npmjs.com/package/@privacyscrubber/sdk) [](https://opensource.org/licenses/MIT) [](https://zenodo.org/records/22058770) [](https://osf.io/5byjf/) [](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7335581) [](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/) [](https://ztds.ai/registry/#privacyscrubber-mcp) [](https://smithery.ai/servers/privacyscrubber/pii-masking-mcp) [](https://cursor.directory/plugins/privacyscrubber-mcp) [](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp) [
20 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
agentic_guard_instructions | read | Zero-Trust Agentic Guard instructions for autonomous AI agents (Cursor, Windsurf, Claude Code). |
audit_context | read | STEP 0 (Pre-Flight): Non-destructive security inspection of raw prompts or document chunks before sending to LLMs. Evaluates PII, secrets, risk severity (CLEAN, LOW, MODERATE, CRITICAL), and triggered regulatory frameworks (GDPR, HIPAA, SOC 2, PCI DSS) with zero text mutation. |
audit_directory_for_pii | read | Scans a local directory for leaks of secrets, keys, and PII. Returns a summary report. Use this tool for Security Auditing. |
check_status | read | Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help. |
create_agent_rules | write | Zero-Trust Agentic Guard: Scaffolds CISO-grade AI Agent Rules in workspace (.cursorrules, .windsurfrules, CLAUDE.md, .github/copilot-instructions.md, .clinerules). Guides autonomous agents to route all file reads, git diffs, and shell commands through PrivacyScrubber Guard tools. |
create_default_config | write | Creates a default |
export_audit_log | read | Zero-Trust Enterprise Compliance: Exports an immutable, tamper-evident audit log in SIEM standard formats (CEF / ArcSight, RFC 5424 Syslog, JSONL, or JSON) with zero plaintext PII leakage. Can write directly to a local log file or stream. |
generate_compliance_report | read | Generates an official Zero-Trust Compliance Audit Certificate (GDPR, HIPAA, EU AI Act, SOC 2) for the current MCP session. Returns cryptographic session hash, masked entities breakdown, and compliance certification. |
guard_apply_patch | write | Zero-Trust Agentic Guard: Reverses token placeholders ([API_KEY_1], [SECRET_1]) in AI-generated code or text, restores authentic values from local volatile RAM, and writes real content directly to target file on disk. Remote LLM never learns actual secrets. |
guard_exec | write | Zero-Trust Agentic Guard: Safely executes a shell/terminal command locally in isolated process, sanitizes stdout and stderr in volatile RAM, tokenizes any API keys, credentials, database URIs, or PII before sending output to LLM. Maps original values in memory for safe local restoration. |
guard_git_diff | read | Zero-Trust Agentic Guard: Inspects unstaged or staged git diffs locally, sanitizes any newly added or modified credentials, tokens, or PII in RAM, and returns safe diff for AI commit generation or code review. |
guard_rag_chunk | read | Zero-Trust Agentic Guard: Sanitizes an array of document chunks or knowledge base records before sending to embedding models or vector databases (Chroma, Pinecone, Qdrant). Keeps authentic data in local RAM with zero network leakage. |
guard_rag_restore | read | Zero-Trust Agentic Guard: Re-hydrates retrieved vector search results or chunks by restoring token placeholders with authentic data from the volatile RAM session before presenting to the user. |
guard_read_file | read | Zero-Trust Agentic Guard: Reads a sensitive local file (.env, config, credentials, source code, database dumps), sanitizes all credentials and PII in volatile RAM, and returns safe tokenized content for AI agent context. |
guard_session_info | read | Zero-Trust Agentic Guard: Returns diagnostic metrics on active in-memory sessions, token counts, and memory footprint with zero plaintext leakage. |
guard_session_reset | destructive | Zero-Trust Agentic Guard: Explicitly purges the in-memory token map for a specific session_id or all sessions upon agent task completion. |
guard_unmask_args | read | Zero-Trust Agentic Guard: Detokenizes parameters, JSON objects, or arguments in local RAM before dispatching to local tools or APIs without sending cleartext secrets back to the LLM. |
mark_false_positive | read | Marks a previously detected token as a false positive. The original plaintext value will be excluded from all future sanitize_text calls in this session. Returns the restored original value and updated ignore list size. |
redact_file | read | Action/Redact: In-place redaction of a local file. Replaces PII and secrets with tokens and saves the file. By default, creates a .bak backup. Use dry_run=true to test without modifying. |
reveal_text | read | STEP 3: Call this last. You MUST pass your final generated response through this tool to restore tokens (e.g., [EMAIL_1]) back with the original private data from the local volatile RAM-only session map before showing it to the user. |
safe_redaction_workflow | read | Instructions for using the redact_file tool safely with QA checks. |
sanitize_file | read | Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory. |
scrub_file | read | Alias for |
scrub_text | read | Alias for |
secure_ai_workflow | read | Zero-Trust Data Sanitization workflow instruction. Use this to automatically scrub PII before processing data. |
Trust audit
BLOCKgrade D · trust 68/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- none-observed
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (15)
text: 'const db = "postgres://admin:[email protected]:5432/prod";',
input: "Production connection mysql://db_admin:P@[email protected]:3306/prod_db and secret sk-proj-49a2fb31c9a10293",
const validKey = "eyJ0eXBlIjoicHJvIiwiZXhwaXJlcyI6MjA5OTA2MjE3NCwiaXNzdWVkQXQiOjE3ODM3MDIxNzQsIm5vbmNlIjoiMmI4MTllN2ZmM2ZmOTFmYiJ9.ZmhaKDGf9vG0nTH0nyOy3EInsuUmzjBOk9IOyiqzt6Y5s3UG+2yRExuKBoeXWymbpJt3N
const expiredKey = "eyJ0eXBlIjoidHJpYWwiLCJleHBpcmVzIjoxNzgzMjcwMTgzLCJpc3N1ZWRBdCI6MTc4MzcwMjE4Mywibm9uY2UiOiIzYzRkYzEwNmRkOGJiZjczIn0=.Wc1cPwvRpEQxG3BarmedBYm9sUsGdwznboh8Gx3a7qQZm2I+Dha8lk1CtzmaaBt
const validKey = "eyJ0eXBlIjoicHJvIiwiZXhwaXJlcyI6MjA5OTA2MjE3NCwiaXNzdWVkQXQiOjE3ODM3MDIxNzQsIm5vbmNlIjoiMmI4MTllN2ZmM2ZmOTFmYiJ9.ZmhaKDGf9vG0nTH0nyOy3EInsuUmzjBOk9IOyiqzt6Y5s3UG+2yRExuKBoeXWymbpJt3N
"Deploying database with user admin and pwd postgresql://user:[email protected]:5432/prod"
guard_session_reset
res = requests.post("http://127.0.0.1:3100/sanitize", json={"text": prompt, "profile": "Dev"}).json()res = requests.post("http://127.0.0.1:3100/restore", json={"text": ai_response, "tokenMap": token_map}).json()@modelcontextprotocol/sdk, mammoth, pdf-parse, xlsx
ps-pii-engine.cjs
ps-pii-engine.js
* `command` (string, required): The shell command to execute (e.g. `cat .env`, `docker logs web`, `git diff`).
cat .env | npx ps-guard --profile dev
# macOS / Linux — add to ~/.zshrc or ~/.bashrc
Gates applied: no_behavioural_pass.
d288f8be9f44full audit observations/trust-audit/mcp-server/moxno__privacyscrubber-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | d288f8be9f44 | BLOCK | D | 68 | first audit |
Questions
What is the moxno-privacyscrubber MCP server?
Zero-Trust PII & secrets redaction MCP server for Cursor & Claude. Lightweight, zero-dependency Presidio alternative for Node.js / TypeScript.
What tools does moxno-privacyscrubber expose?
25 in total: 20 read-only, 4 that write, and 1 that can delete or overwrite (guard_session_reset). Every one is listed on this page with its risk.
Is moxno-privacyscrubber safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (68/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does moxno-privacyscrubber need?
It reads PRIVACYSCRUBBER_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does moxno-privacyscrubber run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @privacyscrubber/mcp-server at 2.3.7.
How current is this page?
The grade is for one exact copy of the source (d288f8be9f44), read on 2026-10-11. The repository is watched and re-audited when it changes.