@privacyscrubber/mcp-server 1.0.5 → 1.6.8

package/index.js

@@ -24,6 +24,11 @@ const require = createRequire(import.meta.url);
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+// Version is sourced from mcp-server/package.json.
+// build.js syncs mcp-server/package.json from root package.json on every build.
+// Never hardcode the version — bump package.json at root instead.
+const MCP_VERSION = require('./package.json').version;
+
 // Import the production core engine with 100% parity
 const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
 const PrivacyScrubberCore = require(scrubberCorePath);
@@ -34,6 +39,24 @@ PrivacyScrubberCore.init();
 // Volatile in-memory token map
 const sessionMap = {};
 
+// ANSI terminal color helpers
+const colors = {
+  yellowBold: '\x1b[1;33m',
+  yellow: '\x1b[33m',
+  cyan: '\x1b[36m',
+  redBold: '\x1b[1;31m',
+  reset: '\x1b[0m'
+};
+
+// Secrets detection patterns — defined once here, shared by detectSecrets() and performSanitization()
+const DEVOPS_SECRETS_DETECTOR = [
+  { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g },
+  { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
+  { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g },
+  { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g },
+  { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
+];
+
 // Hardcoded public key for offline cryptographic verification
 const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw3f37srO402PU4++Baf8
@@ -80,11 +103,44 @@ function checkLicenseStatus() {
   }
 }
 
+// ── Session request counter (volatile in-memory) ─────────────────────────────
+let sessionRequestCount = 0;
+const UPSELL_EVERY_N = 10; // show upsell nudge every N free-tier requests
+
+// Build a clean upsell content block visible to the agent / user
+function buildUpsellBlock(reason) {
+  const count = sessionRequestCount;
+  let lines = [
+    '─────────────────────────────────────────────',
+    '⚡ PrivacyScrubber PRO — Upgrade your AI setup',
+    '─────────────────────────────────────────────',
+  ];
+  if (reason) lines.push(`ℹ️  ${reason}`);
+  lines.push(
+    `📊 Free session requests: ${count}`,
+    '🔒 PRO unlocks: 22 industry profiles (Dev, Medical, Legal…)',
+    '         + Custom regex rules (privacyscrubber.json)',
+    '         + Unlimited input size',
+    '',
+    '💳 PRO Lifetime: $110  →  https://privacyscrubber.com/pricing',
+    '',
+    'After purchase, add your key to your MCP config:',
+    '  "PRIVACYSCRUBBER_KEY": "<your-key-here>"',
+    '─────────────────────────────────────────────'
+  );
+  return { type: 'text', text: lines.join('\n') };
+}
+
+// Decide if we should attach a soft periodic nudge (every N requests, free tier)
+function shouldNudge(isPro) {
+  return !isPro && sessionRequestCount > 0 && sessionRequestCount % UPSELL_EVERY_N === 0;
+}
+
 // Create the MCP server
 const server = new Server(
   {
     name: "privacyscrubber/pii-masking-mcp",
-    version: "1.0.4",
+    version: MCP_VERSION,
   },
   {
     capabilities: {
@@ -146,6 +202,24 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           },
           required: ["file_path"]
         }
+      },
+      {
+        name: "create_default_config",
+        description: "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+        inputSchema: {
+          type: "object",
+          properties: {},
+          required: []
+        }
+      },
+      {
+        name: "check_status",
+        description: "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
+        inputSchema: {
+          type: "object",
+          properties: {},
+          required: []
+        }
       }
     ]
   };
@@ -157,41 +231,89 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
   try {
     if (name === "sanitize_text") {
-      const { text, profile = "General" } = args;
-      const targetProfile = profile.trim();
+      const { text, profile = "General" } = args || {};
+      if (text === undefined || text === null) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'text'. Provide the string to sanitize." }]
+        };
+      }
+      if (typeof text !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Parameter 'text' must be a string, got '${typeof text}'. Stringify objects before passing.` }]
+        };
+      }
+      const targetProfile = (profile || "General").trim();
 
       // Check tier gating for advanced profiles
       const isAdvanced = targetProfile.toLowerCase() !== "general";
       const license = checkLicenseStatus();
+      let finalProfile = targetProfile;
+      const extraBlocks = [];
+
+      sessionRequestCount++;
+
       if (isAdvanced && !license.isPro) {
         const reason = license.error ? ` (${license.error})` : "";
-        return {
-          content: [
-            {
-              type: "text",
-              text: `⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nTo unlock 22+ advanced industry profiles, custom regex, and unlimited logs protection, set PRIVACYSCRUBBER_KEY to your PRO license key.\nGet a key at: https://privacyscrubber.com/pricing\nBrowser Extension: https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol\n\n--- Sanitized Output (General Profile) ---\n`
-            },
-            {
-              type: "text",
-              text: performSanitization(text, "General")
-            }
-          ]
-        };
+        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+        finalProfile = "General";
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+      }
+
+      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro);
+      if (wasTruncated) {
+        extraBlocks.push(buildUpsellBlock(`Input was truncated to 50,000 characters (Free Tier limit).`));
+      }
+
+      if (!license.isPro) {
+        const detected = detectSecrets(processedText);
+        if (detected.length > 0) {
+          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+        }
+      }
+
+      const sanitized = performSanitization(processedText, finalProfile);
+
+      // Periodic soft nudge every N free-tier requests (no trigger event needed)
+      if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+        extraBlocks.push(buildUpsellBlock(null));
       }
 
-      const sanitized = performSanitization(text, targetProfile);
       return {
         content: [
-          {
-            type: "text",
-            text: sanitized
-          }
+          { type: "text", text: sanitized },
+          ...extraBlocks
         ]
       };
     }
 
     if (name === "reveal_text") {
-      const { text } = args;
+      const { text } = args || {};
+      if (text === undefined || text === null) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'text'. Provide the AI response containing placeholders to restore." }]
+        };
+      }
+      if (typeof text !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Parameter 'text' must be a string, got '${typeof text}'.` }]
+        };
+      }
+
+      // Warn early if session has no tokens — reveal would be a no-op
+      if (Object.keys(sessionMap).length === 0) {
+        return {
+          content: [{
+            type: "text",
+            text: `⚠️  Session map is empty — no tokens to restore. Call 'sanitize_text' or 'sanitize_file' first to build the token map, then pass the AI's response here.`
+          }]
+        };
+      }
+
       const restored = PrivacyScrubberCore.unscrubText(text, sessionMap);
       return {
         content: [
@@ -268,39 +390,177 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           const isAdvanced = targetProfile.toLowerCase() !== "general";
           const license = checkLicenseStatus();
 
-          let prefix = "";
           let finalProfile = targetProfile;
+          const extraBlocks = [];
+
+          sessionRequestCount++;
 
           if (isAdvanced && !license.isPro) {
             const reason = license.error ? ` (${license.error})` : "";
-            prefix = `⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nGet a PRO key at: https://privacyscrubber.com/pricing\nBrowser Extension: https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol\n\n`;
+            process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
             finalProfile = "General";
+            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+          }
+
+          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
+          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+
+          if (!license.isPro) {
+            const detected = detectSecrets(processedContent);
+            if (detected.length > 0) {
+              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+            }
+          }
+
+          const sanitized = performSanitization(processedContent, finalProfile);
+
+          if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+            extraBlocks.push(buildUpsellBlock(null));
           }
 
-          const sanitized = performSanitization(content, finalProfile);
           return {
             content: [
-              {
-                type: "text",
-                text: `${prefix}${sanitized}`
-              }
+              { type: "text", text: sanitized },
+              ...extraBlocks
             ]
           };
         } catch (docxError) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: Failed to parse DOCX file: ${docxError.message}` }]
+          };
+        }
+      }
+
+      const buffer = fs.readFileSync(resolvedPath);
+
+      const isPdf = resolvedPath.toLowerCase().endsWith(".pdf");
+      const isExcel = resolvedPath.toLowerCase().endsWith(".xlsx") || resolvedPath.toLowerCase().endsWith(".xls");
+
+      if (isPdf || isExcel) {
+        const license = checkLicenseStatus();
+        if (!license.isPro) {
           return {
             isError: true,
             content: [
               {
                 type: "text",
-                text: `Error: Failed to parse DOCX file: ${docxError.message}`
+                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing`
               }
             ]
           };
         }
+
+        if (isPdf) {
+          try {
+            const pdf = require('pdf-parse');
+            const data = await pdf(buffer);
+            const content = data.text;
+            const targetProfile = profile.trim();
+            const isAdvanced = targetProfile.toLowerCase() !== "general";
+
+            let finalProfile = targetProfile;
+            const extraBlocks = [];
+
+            sessionRequestCount++;
+
+            if (isAdvanced && !license.isPro) {
+              const reason = license.error ? ` (${license.error})` : "";
+              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              finalProfile = "General";
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            }
+
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+
+            if (!license.isPro) {
+              const detected = detectSecrets(processedContent);
+              if (detected.length > 0) {
+                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              }
+            }
+
+            const sanitized = performSanitization(processedContent, finalProfile);
+
+            if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+              extraBlocks.push(buildUpsellBlock(null));
+            }
+
+            return {
+              content: [
+                { type: "text", text: sanitized },
+                ...extraBlocks
+              ]
+            };
+          } catch (pdfError) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Failed to parse PDF file: ${pdfError.message}` }]
+            };
+          }
+        }
+
+        if (isExcel) {
+          try {
+            const XLSX = require('xlsx');
+            const workbook = XLSX.read(buffer, { type: 'buffer' });
+            let content = '';
+            workbook.SheetNames.forEach(sheetName => {
+              const worksheet = workbook.Sheets[sheetName];
+              content += `--- Sheet: ${sheetName} ---\n`;
+              content += XLSX.utils.sheet_to_csv(worksheet) + '\n';
+            });
+
+            const targetProfile = profile.trim();
+            const isAdvanced = targetProfile.toLowerCase() !== "general";
+
+            let finalProfile = targetProfile;
+            const extraBlocks = [];
+
+            sessionRequestCount++;
+
+            if (isAdvanced && !license.isPro) {
+              const reason = license.error ? ` (${license.error})` : "";
+              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              finalProfile = "General";
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            }
+
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+
+            if (!license.isPro) {
+              const detected = detectSecrets(processedContent);
+              if (detected.length > 0) {
+                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              }
+            }
+
+            const sanitized = performSanitization(processedContent, finalProfile);
+
+            if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+              extraBlocks.push(buildUpsellBlock(null));
+            }
+
+            return {
+              content: [
+                { type: "text", text: sanitized },
+                ...extraBlocks
+              ]
+            };
+          } catch (xlsxError) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Failed to parse Excel file: ${xlsxError.message}` }]
+            };
+          }
+        }
       }
 
-      const buffer = fs.readFileSync(resolvedPath);
-      
       // Check for null bytes in the first 8KB to detect binary files
       let isBinary = false;
       const checkLen = Math.min(buffer.length, 8000);
@@ -317,7 +577,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           content: [
             {
               type: "text",
-              text: `Error: Binary file format detected. The local MCP server only supports plain text files (e.g., source code, logs, CSV, markdown, JSON). To sanitize complex formats like PDF or DOCX, please use the web interface at: https://privacyscrubber.com/`
+              text: `Error: Binary file format detected. The local MCP server only supports plain text files (e.g., source code, logs, CSV, markdown, JSON) and premium document formats (PDF, DOCX, XLSX). To sanitize PDF or Excel files, please upgrade to PRO or use the web interface.`
             }
           ]
         };
@@ -328,52 +588,278 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const isAdvanced = targetProfile.toLowerCase() !== "general";
       const license = checkLicenseStatus();
 
-      let prefix = "";
       let finalProfile = targetProfile;
+      const extraBlocks = [];
+
+      sessionRequestCount++;
 
       if (isAdvanced && !license.isPro) {
         const reason = license.error ? ` (${license.error})` : "";
-        prefix = `⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nGet a PRO key at: https://privacyscrubber.com/pricing\nBrowser Extension: https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol\n\n`;
+        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
         finalProfile = "General";
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+      }
+
+      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro);
+      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+
+      if (!license.isPro) {
+        const detected = detectSecrets(processedContent2);
+        if (detected.length > 0) {
+          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+        }
+      }
+
+      const sanitized = performSanitization(processedContent2, finalProfile);
+
+      if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+        extraBlocks.push(buildUpsellBlock(null));
       }
 
-      const sanitized = performSanitization(content, finalProfile);
       return {
         content: [
-          {
+          { type: "text", text: sanitized },
+          ...extraBlocks
+        ]
+      };
+    }
+
+    if (name === "create_default_config") {
+      const configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
+      if (fs.existsSync(configPath)) {
+        return {
+          content: [{
             type: "text",
-            text: `${prefix}${sanitized}`
+            text: `ℹ️  Configuration file 'privacyscrubber.json' already exists in the active workspace root directory:\n   ${configPath}\nNo changes were made.`
+          }]
+        };
+      }
+
+      const defaultTemplate = {
+        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config",
+        "customRules": [
+          {
+            "pattern": "my-secret-pattern-\\d+",
+            "label": "CUSTOM_TAG",
+            "_comment": "pattern must be a valid Javascript regex string. label is the tag replacement (e.g. CUSTOM_TAG)"
           }
         ]
       };
+
+      try {
+        fs.writeFileSync(configPath, JSON.stringify(defaultTemplate, null, 2) + '\n', 'utf8');
+        return {
+          content: [{
+            type: "text",
+            text: `✅ Configuration file 'privacyscrubber.json' successfully created in your workspace root:\n   ${configPath}\n\nRestart your MCP client (e.g. Cursor or Claude Desktop) to load the config rules.`
+          }]
+        };
+      } catch (err) {
+        return {
+          isError: true,
+          content: [{
+            type: "text",
+            text: `Error: Failed to write configuration file: ${err.message}`
+          }]
+        };
+      }
+    }
+
+    if (name === "check_status") {
+      const license = checkLicenseStatus();
+      const tier = license.isPro ? 'PRO' : 'FREE';
+      const tierIcon = license.isPro ? '✅' : '🔓';
+      const profileList = license.isPro
+        ? 'All 23 profiles active (General, Dev, Medical, Legal, Finance, HR…)'
+        : 'General only — PRO unlocks 22 industry profiles';
+      const sizeLimit = license.isPro ? 'Unlimited' : '50,000 characters per request';
+
+      const configPath = resolveConfigPath();
+      let rulesStatus = '';
+      let configPathSnippet = 'Not found';
+
+      if (fs.existsSync(configPath)) {
+        const localPath = path.resolve(process.cwd(), 'privacyscrubber.json');
+        if (configPath === localPath) {
+          configPathSnippet = './privacyscrubber.json';
+        } else {
+          configPathSnippet = '~/privacyscrubber.json';
+        }
+
+        if (license.isPro) {
+          const rulesCount = loadCustomRules().length;
+          rulesStatus = `✅ Active (${rulesCount} rule${rulesCount !== 1 ? 's' : ''})`;
+        } else {
+          rulesStatus = '🔒 Ignored (requires PRO)';
+        }
+      } else {
+        rulesStatus = 'Not found';
+      }
+
+      const metricsSummary = getSessionMetricsSummary();
+
+      const lines = [
+        '╔══════════════════════════════════════════════════╗',
+        `║       PrivacyScrubber MCP Server v${MCP_VERSION.padEnd(10)}          ║`,
+        '╠══════════════════════════════════════════════════╣',
+        `║  ${tierIcon} Tier: ${tier.padEnd(43)}║`,
+        `║  📊 Session requests: ${String(sessionRequestCount).padEnd(27)}║`,
+        `║  📁 Input size limit: ${sizeLimit.padEnd(27)}║`,
+        '╠══════════════════════════════════════════════════╣',
+        `║  🏷️  Profiles: ${profileList.substring(0,35).padEnd(35)}║`,
+        `║  📋 Custom rules: ${rulesStatus.padEnd(31)}║`,
+        `║  ⚙️  Config file: ${configPathSnippet.padEnd(31)}║`,
+        `║  📈 Metrics: ${metricsSummary.substring(0,36).padEnd(36)}║`,
+        '╠══════════════════════════════════════════════════╣',
+      ];
+
+      if (license.isPro) {
+        lines.push(
+          '║  ✅ PRO is active. All features unlocked.         ║',
+          '║     To regenerate your key or manage billing:     ║',
+          '║     https://privacyscrubber.com/pricing           ║'
+        );
+      } else {
+        lines.push(
+          '║  💳 Upgrade to PRO — $110 Lifetime                ║',
+          '║     https://privacyscrubber.com/pricing           ║',
+          '╠══════════════════════════════════════════════════╣',
+          '║  After purchase, add your key to MCP config:     ║',
+          '║                                                  ║',
+          '║  Claude Desktop / Cursor / Windsurf:             ║',
+          '║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║',
+          '║                                                  ║',
+          '║  Full setup guide:                               ║',
+          '║  https://privacyscrubber.com/features/mcp/       ║'
+        );
+      }
+
+      lines.push('╚══════════════════════════════════════════════════╝');
+
+      return {
+        content: [{ type: "text", text: lines.join('\n') }]
+      };
     }
 
     return {
       isError: true,
-      content: [
-        {
-          type: "text",
-          text: `Unknown tool: ${name}`
-        }
-      ]
+      content: [{ type: "text", text: `Unknown tool: ${name}` }]
     };
   } catch (error) {
     return {
       isError: true,
-      content: [
-        {
-          type: "text",
-          text: `Error executing tool: ${error.message}`
-        }
-      ]
+      content: [{ type: "text", text: `Error executing tool: ${error.message}` }]
     };
   }
 });
 
-// Run helper
+function resolveConfigPath() {
+  let configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
+  if (!fs.existsSync(configPath)) {
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+    if (homeDir) {
+      configPath = path.resolve(homeDir, 'privacyscrubber.json');
+    }
+  }
+  return configPath;
+}
+
+function getSessionMetricsSummary() {
+  const counts = {};
+  Object.keys(sessionMap).forEach(token => {
+    const match = token.match(/^\[([A-Z_]+)_\d+\]$/);
+    if (match) {
+      const type = match[1];
+      counts[type] = (counts[type] || 0) + 1;
+    }
+  });
+  
+  if (Object.keys(counts).length === 0) {
+    return '0 entities masked';
+  }
+  
+  const parts = [];
+  if (counts.NAME) parts.push(`${counts.NAME} Name${counts.NAME > 1 ? 's' : ''}`);
+  if (counts.EMAIL) parts.push(`${counts.EMAIL} Email${counts.EMAIL > 1 ? 's' : ''}`);
+  if (counts.PHONE) parts.push(`${counts.PHONE} Phone${counts.PHONE > 1 ? 's' : ''}`);
+  if (counts.ID) parts.push(`${counts.ID} ID${counts.ID > 1 ? 's' : ''}`);
+  if (counts.CUSTOM) parts.push(`${counts.CUSTOM} Custom${counts.CUSTOM > 1 ? 's' : ''}`);
+  
+  Object.entries(counts).forEach(([type, count]) => {
+    if (!['NAME', 'EMAIL', 'PHONE', 'ID', 'CUSTOM'].includes(type)) {
+      parts.push(`${count} ${type}${count > 1 ? 's' : ''}`);
+    }
+  });
+  
+  return parts.join(', ');
+}
+
+function loadCustomRules() {
+  const license = checkLicenseStatus();
+  const configPath = resolveConfigPath();
+
+  if (fs.existsSync(configPath)) {
+    try {
+      const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      const rules = config.customRules || [];
+      if (rules.length > 0) {
+        if (license.isPro) {
+          return rules.map(r => ({
+            pattern: r.pattern || r.regex || "",
+            label: (r.label || r.category || "CUSTOM").toUpperCase(),
+            regex: r.pattern || r.regex || "",
+            category: (r.label || r.category || "CUSTOM").toUpperCase()
+          })).filter(r => r.pattern);
+        } else {
+          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.${colors.reset}\n`);
+        }
+      }
+    } catch (e) {
+      process.stderr.write(`Error parsing privacyscrubber.json: ${e.message}\n`);
+    }
+  }
+  return [];
+}
+
+// Secrets scanner — uses the module-level DEVOPS_SECRETS_DETECTOR constant
+function detectSecrets(text) {
+  const detected = [];
+  DEVOPS_SECRETS_DETECTOR.forEach(detector => {
+    // Reset lastIndex before every test — global regex retains state across calls
+    detector.regex.lastIndex = 0;
+    if (detector.regex.test(text)) {
+      detected.push(detector.name);
+    }
+  });
+  return detected;
+}
+
 function performSanitization(text, profile) {
-  const result = PrivacyScrubberCore.scrubText(text, [], {}, profile, sessionMap);
+  const customRules = loadCustomRules();
+  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, profile, sessionMap);
   
+  const license = checkLicenseStatus();
+  if (!license.isPro && result.tokenMap) {
+    // Re-scan each masked token's original value against the shared detector.
+    // If it was a raw secret, restore it in the output and remove from sessionMap
+    // so it is never accidentally revealed by reveal_text.
+    Object.entries(result.tokenMap).forEach(([token, original]) => {
+      let isSecret = false;
+      for (const detector of DEVOPS_SECRETS_DETECTOR) {
+        detector.regex.lastIndex = 0;
+        if (detector.regex.test(original)) {
+          isSecret = true;
+          break;
+        }
+      }
+      if (isSecret) {
+        result.scrubbedText = result.scrubbedText.replace(token, original);
+        delete result.tokenMap[token];
+      }
+    });
+  }
+
   // Update our volatile map with new matches
   if (result.tokenMap) {
     Object.entries(result.tokenMap).forEach(([token, original]) => {
@@ -384,6 +870,15 @@ function performSanitization(text, profile) {
   return result.scrubbedText;
 }
 
+function truncateIfFree(text, isPro) {
+  const MAX_FREE_CHARS = 50000;
+  if (!isPro && text.length > MAX_FREE_CHARS) {
+    process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
+    return { processedText: text.substring(0, MAX_FREE_CHARS), wasTruncated: true };
+  }
+  return { processedText: text, wasTruncated: false };
+}
+
 // Start the server transport
 const transport = new StdioServerTransport();
 server.connect(transport).catch((error) => {