@privacyscrubber/mcp-server 1.0.2 → 1.0.4

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.moxno/privacyscrubber-mcp",
+  "name": "privacyscrubber/pii-masking-mcp",
   "description": "Zero-Trust PII & secrets sanitizer. Locally scrubs data in-memory before sending context to LLMs.",
   "repository": {
     "url": "https://github.com/moxno/privacyscrubber-mcp",
     "source": "github"
   },
-  "version": "1.0.2",
+  "version": "1.0.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@privacyscrubber/mcp-server",
-      "version": "1.0.2",
+      "version": "1.0.4",
       "transport": {
         "type": "stdio"
       },

package/smithery.yaml

@@ -13,7 +13,7 @@ startCommand:
       command: 'node',
       args: ['./index.js'],
       env: {
-        PRIVACYSCRUBBER_KEY: config.PRIVACYSCRUBBER_KEY || ''
+        PRIVACYSCRUBBER_KEY: (config && config.PRIVACYSCRUBBER_KEY) || ''
       }
     })
 exampleConfig:

package/CONTRIBUTING.md

@@ -1,52 +0,0 @@
-# Contributing to PrivacyScrubber MCP Server
-
-We welcome contributions to the PrivacyScrubber Model Context Protocol (MCP) server integration, client configurations, and testing suites.
-
----
-
-## 🛠️ Development Setup
-
-To set up a local development environment:
-
-1.  **Clone the Repository:**
-    ```bash
-    git clone https://github.com/moxno/privacyscrubber-mcp.git
-    cd privacyscrubber-mcp
-    ```
-
-2.  **Install Dependencies:**
-    ```bash
-    npm install
-    ```
-
-3.  **Run the Server Locally:**
-    You can spin up the server transport using:
-    ```bash
-    node index.js
-    ```
-    *Note: The server uses StdIO transport, so it will sit waiting for JSON-RPC input on standard streams.*
-
----
-
-## 🧪 Testing Your Changes
-
-Before submitting a Pull Request, ensure that all integration and cryptographic verification tests pass cleanly.
-
-### 1. Cryptographic Signature Assertions
-Verify that local license key validations and RSA signatures parse correctly:
-```bash
-node test-mcp.js
-```
-
-### 2. End-to-End JSON-RPC Subprocess Suite
-Run the full simulation test which spawns the server, registers protocol versions, lists capabilities, processes files (TXT and DOCX), and asserts binary file rejections:
-```bash
-node test-mcp-deep.js
-```
-
----
-
-## 🔒 Regex Rules & PII Detection Core
-The core detection engine and regex rules are bundled inside `scrubber-core.cjs` which maintains parity with the PrivacyScrubber Chrome Extension and web application. 
-
-If you notice a false positive or an uncaught entity type (e.g. name matching edge cases), please report it directly through the main project issues or email us at `support@privacyscrubber.com` so we can sync the ruleset across all platforms.

package/SECURITY.md

@@ -1,30 +0,0 @@
-# Security Policy (SECURITY.md)
-
-PrivacyScrubber is built with a zero-server, client-side first architecture. We take data privacy and vulnerability management extremely seriously.
-
----
-
-## 🔒 Security Posture & Guarantees
-
-The PrivacyScrubber MCP server operates under a strict **Zero-Trust Data Sanitization (ZTDS)** design:
-1.  **100% Offline / Local Redaction:** All PII extraction, pattern matching, and tokenization logic run locally inside your system's Node.js runtime process memory (volatile RAM).
-2.  **No Telemetry & No Remote Logs:** The server contains zero network request code for telemetry, prompts transmission, or log collection.
-3.  **Strict Gating Audits:** Cryptographic key checks (for PRO/TEAMS licenses) are validated locally on-device using a signed RSA public key signature verification. No license verification calls are made to any remote databases.
-
-### Verification (Airplane Mode Test)
-You can verify the zero-network posture at any time:
-1.  Disconnect your machine's internet access (Wi-Fi/Ethernet).
-2.  Launch the MCP server locally using Cursor, Windsurf, or Claude Desktop.
-3.  Execute file sanitization and detokenization. All tools remain 100% operational offline.
-
----
-
-## 🐛 Reporting a Vulnerability
-
-If you discover a potential security vulnerability (e.g. regex engine backtracking denial of service, memory leaks, or local file access overflows), please do not report it in the public GitHub Issues tracker. 
-
-Instead, report it privately through our coordinated disclosure channel:
-- **Email:** `security@privacyscrubber.com`
-- **Response SLA:** Our team reviews all reports within **24 hours** and will provide a status update and remediation timeline.
-
-Thank you for helping keep the developer ecosystem secure!

package/llms.txt

@@ -1,37 +0,0 @@
-# PrivacyScrubber MCP Server
-
-> Zero-Trust Data Sanitization (ZTDS) Model Context Protocol (MCP) Server. Locally scrubs PII, secrets, credentials, and custom patterns from text and files before they reach remote LLM APIs.
-
-## Main URL
-- Repository: https://github.com/moxno/privacyscrubber-mcp
-- Web sandbox: https://privacyscrubber.com/
-- Chrome extension: https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol
-
-## Provided Tools
-
-The server runs locally in StdIO transport and exposes three tools:
-
-### sanitize_text
-Scrubs PII (names, emails, phones, locations), API keys, and passwords from input text.
-- Inputs:
-  - `text` (string, required): Raw text block or log segment to sanitize.
-  - `profile` (string, optional): Gated industry detection profile (e.g. 'General', 'Dev', 'Medical', 'Legal', 'Compliance'). Defaults to 'General'.
-- Output: Masked template string containing placeholders (e.g. `[EMAIL_1]`).
-
-### reveal_text
-Detokenizes AI responses by restoring original PII values locally in-memory.
-- Inputs:
-  - `text` (string, required): Response from the LLM containing tokens like `[EMAIL_1]`.
-- Output: Detokenized restored string.
-
-### sanitize_file
-Reads a local file, checks format compatibility, extracts raw text, and redacts PII.
-- Supported Formats: Source code files, CSV, JSON, markdown, text logs, and Microsoft Word (`.docx`) documents.
-- Binary formats (like PDF, ZIP) are automatically rejected with a redirection notice to prevent corrupting inputs.
-- Inputs:
-  - `filePath` (string, required): Absolute local file path.
-  - `profile` (string, optional): Industry detection profile.
-- Output: Sanitized file text template.
-
-## Environment Variables
-- `PRIVACYSCRUBBER_KEY` (string, optional): License key to unlock advanced industry detection profiles. If not set, the server runs on the Free tier and defaults all sanitizations to the 'General' profile.

package/test-mcp-deep.js

@@ -1,209 +0,0 @@
-import { spawn } from 'child_process';
-import fs from 'fs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-const indexScript = path.resolve(__dirname, 'index.js');
-
-// Helper to send JSON-RPC and wait for response
-async function runMcpSession() {
-  console.log("Starting MCP Server process...");
-  
-  // Set license key to valid PRO key for advanced test
-  const validKey = "eyJ0eXBlIjoicHJvIiwiZXhwaXJlcyI6MjA5OTA2MjE3NCwiaXNzdWVkQXQiOjE3ODM3MDIxNzQsIm5vbmNlIjoiMmI4MTllN2ZmM2ZmOTFmYiJ9.ZmhaKDGf9vG0nTH0nyOy3EInsuUmzjBOk9IOyiqzt6Y5s3UG+2yRExuKBoeXWymbpJt3NIJNM9sVxxl+lcop5wqbi2LNtPY4MuwBRA7pO4nn3Bes5R0lxLbEYVE8Iiw3zbfK4uVYQ53BJ7El6JCeFKPJ5WbKUsPLsjb1Lr2iQzW3ODOMaM5jKdgAGcNpuWQ373D7SW7I03Jec9kvP5hL7j3u4DV8ZzuQFzy2Nh+uMH54suydg2sNIpxrRQyxpGv7rZjTO1KT+xzzqnjqX4Pein0e6GrC5E4JUEggADtXPFMKW5SEiWzeeirB5RUPMO/F927S5fFuOYHAfuar2FqErA==";
-  
-  const mcpProcess = spawn('node', [indexScript], {
-    env: {
-      ...process.env,
-      PRIVACYSCRUBBER_KEY: validKey
-    }
-  });
-
-  let buffer = '';
-  const pendingRequests = new Map();
-  let nextId = 1;
-
-  mcpProcess.stdout.on('data', (data) => {
-    buffer += data.toString();
-    // Parse JSON-RPC delimited by newlines
-    let newlineIndex;
-    while ((newlineIndex = buffer.indexOf('\n')) !== -1) {
-      const line = buffer.substring(0, newlineIndex).trim();
-      buffer = buffer.substring(newlineIndex + 1);
-      if (line) {
-        try {
-          const response = JSON.parse(line);
-          if (response.id && pendingRequests.has(response.id)) {
-            const resolve = pendingRequests.get(response.id);
-            pendingRequests.delete(response.id);
-            resolve(response);
-          }
-        } catch (e) {
-          console.error("Failed to parse incoming line as JSON:", line, e);
-        }
-      }
-    }
-  });
-
-  mcpProcess.stderr.on('data', (data) => {
-    console.error(`[Server Stderr]: ${data.toString().trim()}`);
-  });
-
-  const sendRequest = (method, params) => {
-    return new Promise((resolve) => {
-      const id = nextId++;
-      pendingRequests.set(id, resolve);
-      const requestObj = {
-        jsonrpc: '2.0',
-        id,
-        method,
-        params
-      };
-      mcpProcess.stdin.write(JSON.stringify(requestObj) + '\n');
-    });
-  };
-
-  try {
-    // 1. Initialize
-    console.log("--> Sending 'initialize' request...");
-    const initResponse = await sendRequest('initialize', {
-      protocolVersion: '2024-11-05',
-      capabilities: {},
-      clientInfo: { name: 'test-client', version: '1.0.0' }
-    });
-    console.log("<-- Initialize response received:", JSON.stringify(initResponse).substring(0, 150) + "...");
-
-    // 2. List tools
-    console.log("--> Sending 'tools/list' request...");
-    const toolsResponse = await sendRequest('tools/list', {});
-    const tools = toolsResponse.result?.tools || [];
-    console.log(`<-- Tools list received. Total tools: ${tools.length}`);
-    tools.forEach(t => console.log(`  - Tool: ${t.name} (${t.description.substring(0, 60)}...)`));
-
-    if (tools.length !== 3) {
-      throw new Error(`Expected 3 tools, got ${tools.length}`);
-    }
-
-    // 3. Test sanitize_text (General profile)
-    console.log("--> Calling 'sanitize_text' with General profile...");
-    const rawText = "Contact John Doe at john.doe@example.com or phone 555-0199.";
-    const sanitizeResponse = await sendRequest('tools/call', {
-      name: 'sanitize_text',
-      arguments: {
-        text: rawText,
-        profile: 'General'
-      }
-    });
-    const sanitizedText = sanitizeResponse.result?.content?.[0]?.text;
-    console.log("<-- Sanitized Output:", sanitizedText);
-    
-    if (sanitizedText.includes("john.doe@example.com") || sanitizedText.includes("555-0199")) {
-      throw new Error("Sanitization failed to redact email or phone number.");
-    }
-    console.log("✅ Sanitize text success.");
-
-    // 4. Test reveal_text (detokenization)
-    console.log("--> Calling 'reveal_text' to restore tokens...");
-    const revealResponse = await sendRequest('tools/call', {
-      name: 'reveal_text',
-      arguments: {
-        text: `Please email ${sanitizedText.match(/\[EMAIL_\d+\]/)?.[0] || '[EMAIL_1]'} back.`
-      }
-    });
-    const revealedText = revealResponse.result?.content?.[0]?.text;
-    console.log("<-- Revealed Output:", revealedText);
-    if (!revealedText.includes("john.doe@example.com")) {
-      throw new Error("Reveal failed to restore the original email.");
-    }
-    console.log("✅ Reveal text success.");
-
-    // 5. Test sanitize_file (text file)
-    const tempFile = path.resolve(__dirname, 'temp-test-file.txt');
-    fs.writeFileSync(tempFile, "API Key: secret-key-value-12345\nUser: jane.smith@company.com", "utf8");
-    console.log(`--> Calling 'sanitize_file' on text file: ${tempFile}`);
-    
-    const fileResponse = await sendRequest('tools/call', {
-      name: 'sanitize_file',
-      arguments: {
-        filePath: tempFile,
-        profile: 'Dev'
-      }
-    });
-    fs.unlinkSync(tempFile);
-    
-    const fileSanitized = fileResponse.result?.content?.[0]?.text;
-    console.log("<-- Sanitized File Output:", fileSanitized);
-    if (fileSanitized.includes("secret-key-value-12345") || fileSanitized.includes("jane.smith@company.com")) {
-      throw new Error("File sanitization failed to redact credentials.");
-    }
-    console.log("✅ Sanitize file success.");
-
-    // 6. Test sanitize_file (binary file rejection)
-    const tempBinFile = path.resolve(__dirname, 'temp-binary-file.bin');
-    const binBuffer = Buffer.alloc(100);
-    binBuffer.write("GIF89a", 0);
-    binBuffer[10] = 0; // Null byte
-    fs.writeFileSync(tempBinFile, binBuffer);
-    console.log(`--> Calling 'sanitize_file' on binary file: ${tempBinFile}`);
-
-    const binFileResponse = await sendRequest('tools/call', {
-      name: 'sanitize_file',
-      arguments: {
-        filePath: tempBinFile,
-        profile: 'General'
-      }
-    });
-    fs.unlinkSync(tempBinFile);
-
-    const isBinError = binFileResponse.result?.isError || binFileResponse.error;
-    const binErrorText = binFileResponse.result?.content?.[0]?.text || binFileResponse.error?.message;
-    console.log("<-- Binary File Response Error status:", isBinError, "| message:", binErrorText);
-
-    if (!isBinError || !binErrorText?.includes("Binary file format detected")) {
-      throw new Error("Binary file check failed to reject binary file with clean message.");
-    }
-    console.log("✅ Sanitize file binary rejection success.");
-
-    // 7. Test sanitize_file (DOCX file parsing support)
-    const docxSource = path.resolve(__dirname, '../PrivacyScrubber/outreach-campaigns/guest-posts/Techbullion_GuestPost.docx');
-    const docxDest = path.resolve(__dirname, 'fixture-test.docx');
-    
-    if (fs.existsSync(docxSource)) {
-      fs.copyFileSync(docxSource, docxDest);
-      console.log(`--> Calling 'sanitize_file' on DOCX document: ${docxDest}`);
-
-      const docxResponse = await sendRequest('tools/call', {
-        name: 'sanitize_file',
-        arguments: {
-          filePath: docxDest,
-          profile: 'General'
-        }
-      });
-      fs.unlinkSync(docxDest);
-
-      const docxText = docxResponse.result?.content?.[0]?.text;
-      console.log("<-- DOCX Sanitized text preview (first 150 chars):", docxText?.substring(0, 150) + "...");
-      
-      if (!docxText || docxResponse.result?.isError || docxText.includes("Error") || docxText.length < 50) {
-        throw new Error("DOCX document parsing failed or returned invalid text content.");
-      }
-      console.log("✅ Sanitize DOCX document success.");
-    } else {
-      console.log("⚠️ Skipped DOCX test case: fixture file not found in main project path.");
-    }
-
-    console.log("\n🎉 All deep integration tests passed successfully!");
-    mcpProcess.kill();
-    process.exit(0);
-
-  } catch (error) {
-    console.error("❌ Test failed:", error.message);
-    mcpProcess.kill();
-    process.exit(1);
-  }
-}
-
-runMcpSession();

package/test-mcp.js

@@ -1,114 +0,0 @@
-/**
- * Complete Cryptographic Verification Test Suite for @privacyscrubber/mcp-server
- */
-
-import { createRequire } from 'module';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const require = createRequire(import.meta.url);
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
-const mcpServerIndex = path.resolve(__dirname, 'index.js');
-
-console.log("Loading modules for verification test...");
-try {
-  const PrivacyScrubberCore = require(scrubberCorePath);
-  PrivacyScrubberCore.init();
-
-  // Load index.js to test its internal validate functions
-  // We can simulate its checkLicenseStatus by mocking environment variables
-  const indexModule = await import('./index.js?update=' + Date.now());
-
-  // Test Case 1: No license key
-  console.log("\n[Test 1] Testing with no license key (Free tier)...");
-  process.env.PRIVACYSCRUBBER_KEY = "";
-  const t1 = global.checkLicenseStatus ? global.checkLicenseStatus() : mockCheckLicenseStatus();
-  console.log("Status:", t1);
-  if (t1.isPro) {
-    console.error("❌ Test 1 failed: keyless state should not be PRO.");
-    process.exit(1);
-  }
-  console.log("✅ Test 1 passed.");
-
-  // Test Case 2: Expired trial key
-  console.log("\n[Test 2] Testing with expired signed trial key...");
-  // Expired key generated by generate-license.js
-  const expiredKey = "eyJ0eXBlIjoidHJpYWwiLCJleHBpcmVzIjoxNzgzMjcwMTgzLCJpc3N1ZWRBdCI6MTc4MzcwMjE4Mywibm9uY2UiOiIzYzRkYzEwNmRkOGJiZjczIn0=.Wc1cPwvRpEQxG3BarmedBYm9sUsGdwznboh8Gx3a7qQZm2I+Dha8lk1CtzmaaBt5O8pQszGuTCHapASFwZX2Ku8uZxkGipPI+tbNI39KK7cM6wA+Txc0Ufec/lnDE/27WelBswStSIMgR5LPVScfamMO5BK6jvJ9RgOrEdJeqJPcpab0mwy4jzZwSATyZ1JOS61i8ZlJ+n99zppBrrMZQQo/FJ5t70RpqZiZoMuyNbeDJB9UWGDEAELiJLBkaGeYgBo65zp7fRcTuyjmoZjINnOhCcXmKsmeB1vkHdjPg8jXaGVWFN7bJryeV7j/OkpNqO2q74x3hXDvNwlGtg4PUg==";
-  process.env.PRIVACYSCRUBBER_KEY = expiredKey;
-  const t2 = mockCheckLicenseStatus();
-  console.log("Status:", t2);
-  if (t2.isPro || !t2.error.includes("expired")) {
-    console.error("❌ Test 2 failed: expired key should be blocked with expiration reason.");
-    process.exit(1);
-  }
-  console.log("✅ Test 2 passed.");
-
-  // Test Case 3: Valid signed PRO key
-  console.log("\n[Test 3] Testing with valid signed PRO key...");
-  // Valid key generated in this session
-  const validKey = "eyJ0eXBlIjoicHJvIiwiZXhwaXJlcyI6MjA5OTA2MjE3NCwiaXNzdWVkQXQiOjE3ODM3MDIxNzQsIm5vbmNlIjoiMmI4MTllN2ZmM2ZmOTFmYiJ9.ZmhaKDGf9vG0nTH0nyOy3EInsuUmzjBOk9IOyiqzt6Y5s3UG+2yRExuKBoeXWymbpJt3NIJNM9sVxxl+lcop5wqbi2LNtPY4MuwBRA7pO4nn3Bes5R0lxLbEYVE8Iiw3zbfK4uVYQ53BJ7El6JCeFKPJ5WbKUsPLsjb1Lr2iQzW3ODOMaM5jKdgAGcNpuWQ373D7SW7I03Jec9kvP5hL7j3u4DV8ZzuQFzy2Nh+uMH54suydg2sNIpxrRQyxpGv7rZjTO1KT+xzzqnjqX4Pein0e6GrC5E4JUEggADtXPFMKW5SEiWzeeirB5RUPMO/F927S5fFuOYHAfuar2FqErA==";
-  process.env.PRIVACYSCRUBBER_KEY = validKey;
-  const t3 = mockCheckLicenseStatus();
-  console.log("Status:", t3);
-  if (!t3.isPro) {
-    console.error("❌ Test 3 failed: valid key was not accepted.");
-    process.exit(1);
-  }
-  console.log("✅ Test 3 passed.");
-
-  console.log("\n🎉 All local cryptographic validation tests passed!");
-  process.exit(0);
-
-} catch (error) {
-  console.error("❌ Test run crashed:", error);
-  process.exit(1);
-}
-
-// Mock checker mapping index.js logic locally for direct assertion
-function mockCheckLicenseStatus() {
-  const crypto = require('crypto');
-  const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw3f37srO402PU4++Baf8
-FG8LY4l/IA3NKLlBnYmNHRTjfI/O/w5PDZn1xPcUQevojA1J+A5moKcjXsJ5b21X
-hJoYSkE4vLpcVYOt1FhRwEHs1APDSyss0HixboLz2eW2XQf2NbwajWtNlyxvgczO
-KE6ClnLomtsaKywwqB4alzdYnnnFJttFPjwmgPSO7D9AgN9sYaVkXOaOFrIZ90Ng
-TRhSHUeL7ReltWlCHwz9xf5m2FrKtxr2VBlEoyPjsFzalHMey1EX+yXe81zM7IIi
-t1Z8agLzo7WIfNBAIWmRlerTplaFFZrQgdF5g/Y0n8IIMZOtadgoY8E855psDNZV
-7wIDAQAB
------END PUBLIC KEY-----`;
-
-  const key = (process.env.PRIVACYSCRUBBER_KEY || "").trim();
-  if (!key) return { isPro: false, type: null, error: "No license key provided." };
-
-  try {
-    const [payloadBase64, signatureBase64] = key.split('.');
-    if (!payloadBase64 || !signatureBase64) {
-      return { isPro: false, type: null, error: "Invalid license key structure." };
-    }
-
-    const verifier = crypto.createVerify('SHA256');
-    verifier.update(payloadBase64);
-    const isVerified = verifier.verify(PUBLIC_KEY, signatureBase64, 'base64');
-    
-    if (!isVerified) {
-      return { isPro: false, type: null, error: "Signature verification failed." };
-    }
-
-    const payload = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
-    
-    if (payload.expires && payload.expires < Math.floor(Date.now() / 1000)) {
-      return { 
-        isPro: false, 
-        type: payload.type, 
-        error: `License expired on ${new Date(payload.expires * 1000).toLocaleDateString()}` 
-      };
-    }
-
-    return { isPro: true, type: payload.type, error: null };
-  } catch (e) {
-    return { isPro: false, type: null, error: "Error parsing license: " + e.message };
-  }
-}