ModelsAtlas
Explore
Atlas / MCP servers / postralai / Masquerade

MasqueradeBLOCK

mcp/postralai/masquerade
MCP server by postralai · anonymization · claude · mcp · Audited 2026-10-07
⚑ Report / re-scanSource ↗

The Privacy Firewall for LLMs

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
1 1r · 0w · 0d
Transport
—
License
MIT
Stars
77
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/user-attachments/assets/80b1d8ac-a012-41ce-8e92-64d567f2427f)

🤐 Problem: Tools like Claude or GPT are incredibly powerful, but they require raw input. If you're dealing with contracts, medical records, or internal documents, that's risky.

🛡️ Solution: Masquerade acts as a privacy firewall for your files. Just paste in the file path to a PDF, and Masquerade will:

  • Automatically detect sensitive data (names, emails, dates, entities)
  • Redact the sensitive data
  • Let you preview before sending to an LLM

Architecture

  1. User Input: The user asks Claude to redact a PDF by providing its file path.
  2. PDF Processing: MCP reads the PDF and converts it to text.
  3. Sensitive Data Detection: The text is sent to Tinfoil (an isolated AI platform using Llama 3.3 70B) to identify sensitive data.
  4. Redaction: MCP removes the sensitive data and creates a redacted PDF.
  5. Summary Return: MCP sends Claude a summary with:
  6. Masked versions of the sensitive data
  7. Redaction counts per page
  8. The path to the redacted file
  9. Quering PDF with Claude: The user can upload the redacted PDF to Claude if satisfied with the redactions.

Installation

[](https://github.com/user-attachments/assets/76dedb64-1ef5-4ab4-afe1-11f399b3653b)

  1. Install Claude desktop
  2. Get Tinfoil API key (create account and API key)
  3. Configure environment

Option 1: Automated

curl -O https://raw.githubusercontent.com/postralai/masquerade/main/setup.sh && bash setup.sh
  1. Restart Claude d
Read from source at commit 2de6658fccc1OBSERVED · 2026-10-07
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add masquerade --env TINFOIL_API_KEY=${TINFOIL_API_KEY} -- uvx masquerade
claude-desktop
{
  "mcpServers": {
    "masquerade": {
      "command": "uvx",
      "args": [
        "masquerade"
      ],
      "env": {
        "TINFOIL_API_KEY": "${TINFOIL_API_KEY}"
      }
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
redact_pdfreadpdf_path = None
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (2)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
setup.sh:25
sudo apt-get install -y python3.12 python3.12-venv python3.12-dev
Why it matters. asks for elevated privileges
INFOPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 2de6658fccc1full audit observations/trust-audit/mcp-server/postralai__masquerade.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-072de6658fccc1BLOCKD69first audit
06

Questions

What is the Masquerade MCP server?

The Privacy Firewall for LLMs

What tools does Masquerade expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Masquerade safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does Masquerade need?

It reads TINFOIL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (2de6658fccc1), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement