@privacyscrubber/mcp-server 1.0.0

package/README.md

@@ -0,0 +1,66 @@
+# @privacyscrubber/mcp-server
+
+**Zero-Trust Data Sanitization (ZTDS) Model Context Protocol (MCP) Server.**
+Locally scrubs PII, secrets, credentials, and custom patterns from files and text contexts before sending them to LLMs.
+
+---
+
+## 🔒 Security & Privacy Guarantees
+
+*   **100% Offline / Local Execution:** All PII detection, regex matching, and tokenization happen entirely inside your local machine's RAM. No prompt context or file data is ever sent to any remote servers.
+*   **Volatile In-Memory Mapping:** The token replacement map (`sessionMap`) is kept in volatile RAM only. It is never persisted to disk, cookies, or database storage.
+*   **Support for Reverse-Scrubbing (Reveal):** Replaces tokens in LLM responses back with original values securely inside your local context.
+
+---
+
+## 🚀 Installation & Usage
+
+### 1. Instant Run with NPX
+You can run the MCP server directly using `npx`:
+```bash
+npx @privacyscrubber/mcp-server
+```
+
+---
+
+## ⚙️ Client Integrations
+
+### Claude Desktop
+Add the server configuration to your Claude Desktop config file:
+*   **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
+*   **Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
+
+```json
+{
+  "mcpServers": {
+    "privacyscrubber": {
+      "command": "npx",
+      "args": ["-y", "@privacyscrubber/mcp-server"],
+      "env": {
+        "PRIVACYSCRUBBER_KEY": "YOUR_OPTIONAL_PRO_OR_TEAMS_KEY"
+      }
+    }
+  }
+}
+```
+
+### Cursor / Windsurf
+1. Open settings (Settings -> Features -> MCP).
+2. Add new MCP server:
+    *   **Name:** `privacyscrubber`
+    *   **Type:** `command`
+    *   **Command:** `npx -y @privacyscrubber/mcp-server`
+3. If you have a PRO key, add `PRIVACYSCRUBBER_KEY` as an environment variable in your system shell or configure it locally.
+
+---
+
+## 🛠️ Provided Tools
+
+1.  `sanitize_text` — Sanitizes a raw string using the selected detection profile.
+2.  `reveal_text` — Detokenizes a response containing PII tokens back to the original text.
+3.  `sanitize_file` — Reads a local file, sanitizes its contents, and outputs the safe version (supports up to 10MB).
+
+---
+
+## 📄 License & Commercial Key
+Standard use includes the **Free Tier** (limits to the `General` PII profile). To unlock 22+ specialized industry profiles (DevOps, Medical, Legal, Finance) and custom regex rules, acquire a license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing).

package/index.js

@@ -0,0 +1,322 @@
+#!/usr/bin/env node
+
+/**
+ * PrivacyScrubber MCP Server
+ * Zero-Trust Data Sanitization (ZTDS) for AI IDEs (Cursor, Windsurf) and Claude Desktop.
+ * 
+ * Runs 100% locally. In-memory volatile token mapping. Zero server logs.
+ */
+
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from "@modelcontextprotocol/sdk/types.js";
+import { createRequire } from 'module';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import crypto from 'crypto';
+
+const require = createRequire(import.meta.url);
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Import the production core engine with 100% parity
+const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
+const PrivacyScrubberCore = require(scrubberCorePath);
+
+// Initialize core engine
+PrivacyScrubberCore.init();
+
+// Volatile in-memory token map
+const sessionMap = {};
+
+// Hardcoded public key for offline cryptographic verification
+const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw3f37srO402PU4++Baf8
+FG8LY4l/IA3NKLlBnYmNHRTjfI/O/w5PDZn1xPcUQevojA1J+A5moKcjXsJ5b21X
+hJoYSkE4vLpcVYOt1FhRwEHs1APDSyss0HixboLz2eW2XQf2NbwajWtNlyxvgczO
+KE6ClnLomtsaKywwqB4alzdYnnnFJttFPjwmgPSO7D9AgN9sYaVkXOaOFrIZ90Ng
+TRhSHUeL7ReltWlCHwz9xf5m2FrKtxr2VBlEoyPjsFzalHMey1EX+yXe81zM7IIi
+t1Z8agLzo7WIfNBAIWmRlerTplaFFZrQgdF5g/Y0n8IIMZOtadgoY8E855psDNZV
+7wIDAQAB
+-----END PUBLIC KEY-----`;
+
+function checkLicenseStatus() {
+  const key = (process.env.PRIVACYSCRUBBER_KEY || "").trim();
+  if (!key) return { isPro: false, type: null, error: "No license key provided." };
+
+  try {
+    const [payloadBase64, signatureBase64] = key.split('.');
+    if (!payloadBase64 || !signatureBase64) {
+      return { isPro: false, type: null, error: "Invalid license key structure." };
+    }
+
+    const verifier = crypto.createVerify('SHA256');
+    verifier.update(payloadBase64);
+    const isVerified = verifier.verify(PUBLIC_KEY, signatureBase64, 'base64');
+    
+    if (!isVerified) {
+      return { isPro: false, type: null, error: "Signature verification failed." };
+    }
+
+    const payload = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
+    
+    // Expiration check
+    if (payload.expires && payload.expires < Math.floor(Date.now() / 1000)) {
+      return { 
+        isPro: false, 
+        type: payload.type, 
+        error: `License expired on ${new Date(payload.expires * 1000).toLocaleDateString()}` 
+      };
+    }
+
+    return { isPro: true, type: payload.type, error: null };
+  } catch (e) {
+    return { isPro: false, type: null, error: "Error parsing license: " + e.message };
+  }
+}
+
+// Create the MCP server
+const server = new Server(
+  {
+    name: "privacyscrubber-mcp",
+    version: "1.0.0",
+  },
+  {
+    capabilities: {
+      tools: {},
+    },
+  }
+);
+
+// List available tools
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+  return {
+    tools: [
+      {
+        name: "sanitize_text",
+        description: "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            text: {
+              type: "string",
+              description: "The raw text, code, or logs to sanitize."
+            },
+            profile: {
+              type: "string",
+              description: "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+            }
+          },
+          required: ["text"]
+        }
+      },
+      {
+        name: "reveal_text",
+        description: "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            text: {
+              type: "string",
+              description: "The AI generated response containing placeholders to restore."
+            }
+          },
+          required: ["text"]
+        }
+      },
+      {
+        name: "sanitize_file",
+        description: "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            filePath: {
+              type: "string",
+              description: "Absolute path to the file to sanitize."
+            },
+            profile: {
+              type: "string",
+              description: "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+            }
+          },
+          required: ["filePath"]
+        }
+      }
+    ]
+  };
+});
+
+// Handle tool execution calls
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  const { name, arguments: args } = request.params;
+
+  try {
+    if (name === "sanitize_text") {
+      const { text, profile = "General" } = args;
+      const targetProfile = profile.trim();
+
+      // Check tier gating for advanced profiles
+      const isAdvanced = targetProfile.toLowerCase() !== "general";
+      const license = checkLicenseStatus();
+      if (isAdvanced && !license.isPro) {
+        const reason = license.error ? ` (${license.error})` : "";
+        return {
+          content: [
+            {
+              type: "text",
+              text: `⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nTo unlock 22+ advanced industry profiles, custom regex, and unlimited logs protection, set PRIVACYSCRUBBER_KEY to your PRO license key.\nGet a key at: https://privacyscrubber.com/pricing\n\n--- Sanitized Output (General Profile) ---\n`
+            },
+            {
+              type: "text",
+              text: performSanitization(text, "General")
+            }
+          ]
+        };
+      }
+
+      const sanitized = performSanitization(text, targetProfile);
+      return {
+        content: [
+          {
+            type: "text",
+            text: sanitized
+          }
+        ]
+      };
+    }
+
+    if (name === "reveal_text") {
+      const { text } = args;
+      const restored = PrivacyScrubberCore.unscrubText(text, sessionMap);
+      return {
+        content: [
+          {
+            type: "text",
+            text: restored.restoredText
+          }
+        ]
+      };
+    }
+
+    if (name === "sanitize_file") {
+      const { filePath, profile = "General" } = args;
+      
+      const resolvedPath = path.resolve(filePath);
+      if (!fs.existsSync(resolvedPath)) {
+        return {
+          isError: true,
+          content: [
+            {
+              type: "text",
+              text: `Error: File not found at '${filePath}'`
+            }
+          ]
+        };
+      }
+
+      const stats = fs.statSync(resolvedPath);
+      if (!stats.isFile()) {
+        return {
+          isError: true,
+          content: [
+            {
+              type: "text",
+              text: `Error: Path '${filePath}' is not a regular file.`
+            }
+          ]
+        };
+      }
+
+      // Limit file size to 10MB to prevent Out of Memory DoS
+      const MAX_SIZE = 10 * 1024 * 1024;
+      if (stats.size > MAX_SIZE) {
+        return {
+          isError: true,
+          content: [
+            {
+              type: "text",
+              text: `Error: File is too large (${(stats.size / 1024 / 1024).toFixed(2)}MB). Maximum allowed size is 10MB.`
+            }
+          ]
+        };
+      }
+
+      const content = fs.readFileSync(resolvedPath, "utf8");
+      const targetProfile = profile.trim();
+      const isAdvanced = targetProfile.toLowerCase() !== "general";
+      const license = checkLicenseStatus();
+
+      let prefix = "";
+      let finalProfile = targetProfile;
+
+      if (isAdvanced && !license.isPro) {
+        const reason = license.error ? ` (${license.error})` : "";
+        prefix = `⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nGet a PRO key at: https://privacyscrubber.com/pricing\n\n`;
+        finalProfile = "General";
+      }
+
+      const sanitized = performSanitization(content, finalProfile);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `${prefix}${sanitized}`
+          }
+        ]
+      };
+    }
+
+    return {
+      isError: true,
+      content: [
+        {
+          type: "text",
+          text: `Unknown tool: ${name}`
+        }
+      ]
+    };
+  } catch (error) {
+    return {
+      isError: true,
+      content: [
+        {
+          type: "text",
+          text: `Error executing tool: ${error.message}`
+        }
+      ]
+    };
+  }
+});
+
+// Run helper
+function performSanitization(text, profile) {
+  const result = PrivacyScrubberCore.scrubText(text, [], {}, profile, sessionMap);
+  
+  // Update our volatile map with new matches
+  if (result.tokenMap) {
+    Object.entries(result.tokenMap).forEach(([token, original]) => {
+      sessionMap[token] = original;
+    });
+  }
+
+  return result.scrubbedText;
+}
+
+// Start the server transport
+const transport = new StdioServerTransport();
+server.connect(transport).catch((error) => {
+  console.error("Failed to connect MCP server transport:", error);
+  process.exit(1);
+});
+
+// Mark script executable on launch
+try {
+  fs.chmodSync(__filename, '755');
+} catch (e) {
+  // Silent fail if filesystem is read-only
+}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@privacyscrubber/mcp-server",
+  "version": "1.0.0",
+  "description": "Zero-Trust Data Sanitization (ZTDS) MCP Server for AI IDEs and Claude Desktop. Locally scrubs PII, secrets, and credentials before sending context to LLMs.",
+  "main": "index.js",
+  "type": "module",
+  "bin": {
+    "mcp-server": "index.js",
+    "privacyscrubber-mcp": "index.js"
+  },
+  "scripts": {
+    "start": "node index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^0.6.0"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "privacy",
+    "security",
+    "pii-redactor",
+    "secrets-scanner",
+    "zero-trust",
+    "ztds",
+    "claude-desktop",
+    "cursor"
+  ],
+  "author": "Ilya Sibiryakov (Brand Me Web)",
+  "license": "MIT"
+}