@privacyscrubber/mcp-server 1.6.7 → 1.6.9

package/.well-known/mcp/server-card.json

@@ -1,7 +1,7 @@
 {
   "serverInfo": {
     "name": "privacyscrubber/pii-masking-mcp",
-    "version": "1.0.4"
+    "version": "1.6.9"
   },
   "tools": [
     {
@@ -16,7 +16,7 @@
           },
           "profile": {
             "type": "string",
-            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles. Defaults to 'General'."
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
           }
         },
         "required": ["text"]
@@ -48,11 +48,29 @@
           },
           "profile": {
             "type": "string",
-            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles. Defaults to 'General'."
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
           }
         },
         "required": ["file_path"]
       }
+    },
+    {
+      "name": "create_default_config",
+      "description": "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
+    },
+    {
+      "name": "check_status",
+      "description": "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
     }
   ],
   "resources": [],

package/README.md

@@ -6,8 +6,8 @@
 [![Security: 100% Local](https://img.shields.io/badge/Security-100%25%20Local-emerald)](https://privacyscrubber.com)
 [![Parity: 100% Core Match](https://img.shields.io/badge/Parity-100%25%20Core%20Match-blueviolet)](https://privacyscrubber.com)
 
-**Zero-Trust Data Sanitization (ZTDS) Model Context Protocol (MCP) Server.**
-Locally scrubs PII, secrets, credentials, and custom regex rules from files and text contexts before they reach remote LLM providers.
+**CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop.**
+Locally scrubs PII, secrets, credentials, and custom regex rules from files and text contexts before they reach remote LLM providers to prevent API leaks and ensure HIPAA/SOC 2 compliance at the developer endpoint.
 
 ---
 
@@ -149,11 +149,23 @@ Looking for real-time protection directly inside your web browser?
 *   **Chrome Extension:** Get the [PrivacyScrubber Chrome Extension](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol) to sanitize prompts directly inside ChatGPT, Claude, and Gemini in real-time.
 *   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/).
 
----
-
 ## 📄 License & Commercial Upgrade
 
-Standard use is free under the **Free Tier** (limits to the `General` PII profile). To unlock 22+ specialized industry profiles (DevOps, Medical, Legal, Finance) and custom regex rules, acquire a commercial license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing).
+By default, the server runs under the **Free Tier** (restricted to 50,000 characters per request and the basic `General` PII profile). To unlock advanced engineering, medical, legal, and financial PII profiles, as well as team-wide custom rules, you can purchase a commercial license.
+
+### Feature Comparison
+
+| Feature | Free Tier | PRO Tier | TEAMS Tier |
+| :--- | :--- | :--- | :--- |
+| **Volatile Tokenization** | ✅ Yes | ✅ Yes | ✅ Yes |
+| **Standard PII Masking** | ✅ Yes | ✅ Yes | ✅ Yes |
+| **Max Character Length** | 50,000 chars | ♾️ Unlimited | ♾️ Unlimited |
+| **Industry Profiles** | General Only | 22+ Profiles | 22+ Profiles |
+| **Custom Regex Rules** | ❌ Locked | ♾️ Unlimited | ♾️ Unlimited |
+| **Team Rules Sync (GPO)** | ❌ No | ❌ No | ✅ Yes (Shared Link) |
+| **Licensing Cost** | $0 | **$110 Lifetime** | **$99/mo Flat Rate** |
+
+👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)**
 
 ---
 

package/index.js

@@ -24,6 +24,11 @@ const require = createRequire(import.meta.url);
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+// Version is sourced from mcp-server/package.json.
+// build.js syncs mcp-server/package.json from root package.json on every build.
+// Never hardcode the version — bump package.json at root instead.
+const MCP_VERSION = require('./package.json').version;
+
 // Import the production core engine with 100% parity
 const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
 const PrivacyScrubberCore = require(scrubberCorePath);
@@ -34,6 +39,25 @@ PrivacyScrubberCore.init();
 // Volatile in-memory token map
 const sessionMap = {};
 
+// ANSI terminal color helpers
+const colors = {
+  yellowBold: '\x1b[1;33m',
+  yellow: '\x1b[33m',
+  cyan: '\x1b[36m',
+  greenBold: '\x1b[1;32m',
+  redBold: '\x1b[1;31m',
+  reset: '\x1b[0m'
+};
+
+// Secrets detection patterns — defined once here, shared by detectSecrets() and performSanitization()
+const DEVOPS_SECRETS_DETECTOR = [
+  { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g },
+  { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
+  { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g },
+  { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g },
+  { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
+];
+
 // Hardcoded public key for offline cryptographic verification
 const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw3f37srO402PU4++Baf8
@@ -117,7 +141,7 @@ function shouldNudge(isPro) {
 const server = new Server(
   {
     name: "privacyscrubber/pii-masking-mcp",
-    version: "1.6.7",
+    version: MCP_VERSION,
   },
   {
     capabilities: {
@@ -180,6 +204,15 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["file_path"]
         }
       },
+      {
+        name: "create_default_config",
+        description: "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+        inputSchema: {
+          type: "object",
+          properties: {},
+          required: []
+        }
+      },
       {
         name: "check_status",
         description: "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
@@ -224,7 +257,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       if (isAdvanced && !license.isPro) {
         const reason = license.error ? ` (${license.error})` : "";
-        process.stderr.write(`⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nGet a PRO key at: https://privacyscrubber.com/pricing\n`);
+        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
         finalProfile = "General";
         extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
       }
@@ -234,6 +267,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         extraBlocks.push(buildUpsellBlock(`Input was truncated to 50,000 characters (Free Tier limit).`));
       }
 
+      if (!license.isPro) {
+        const detected = detectSecrets(processedText);
+        if (detected.length > 0) {
+          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+        }
+      }
+
       const sanitized = performSanitization(processedText, finalProfile);
 
       // Periodic soft nudge every N free-tier requests (no trigger event needed)
@@ -263,6 +304,17 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           content: [{ type: "text", text: `Error: Parameter 'text' must be a string, got '${typeof text}'.` }]
         };
       }
+
+      // Warn early if session has no tokens — reveal would be a no-op
+      if (Object.keys(sessionMap).length === 0) {
+        return {
+          content: [{
+            type: "text",
+            text: `⚠️  Session map is empty — no tokens to restore. Call 'sanitize_text' or 'sanitize_file' first to build the token map, then pass the AI's response here.`
+          }]
+        };
+      }
+
       const restored = PrivacyScrubberCore.unscrubText(text, sessionMap);
       return {
         content: [
@@ -346,7 +398,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           if (isAdvanced && !license.isPro) {
             const reason = license.error ? ` (${license.error})` : "";
-            process.stderr.write(`⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nGet a PRO key at: https://privacyscrubber.com/pricing\n`);
+            process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
             finalProfile = "General";
             extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
           }
@@ -354,6 +406,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
           if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
 
+          if (!license.isPro) {
+            const detected = detectSecrets(processedContent);
+            if (detected.length > 0) {
+              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+            }
+          }
+
           const sanitized = performSanitization(processedContent, finalProfile);
 
           if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
@@ -375,7 +435,133 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       const buffer = fs.readFileSync(resolvedPath);
-      
+
+      const isPdf = resolvedPath.toLowerCase().endsWith(".pdf");
+      const isExcel = resolvedPath.toLowerCase().endsWith(".xlsx") || resolvedPath.toLowerCase().endsWith(".xls");
+
+      if (isPdf || isExcel) {
+        const license = checkLicenseStatus();
+        if (!license.isPro) {
+          return {
+            isError: true,
+            content: [
+              {
+                type: "text",
+                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing`
+              }
+            ]
+          };
+        }
+
+        if (isPdf) {
+          try {
+            const pdf = require('pdf-parse');
+            const data = await pdf(buffer);
+            const content = data.text;
+            const targetProfile = profile.trim();
+            const isAdvanced = targetProfile.toLowerCase() !== "general";
+
+            let finalProfile = targetProfile;
+            const extraBlocks = [];
+
+            sessionRequestCount++;
+
+            if (isAdvanced && !license.isPro) {
+              const reason = license.error ? ` (${license.error})` : "";
+              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              finalProfile = "General";
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            }
+
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+
+            if (!license.isPro) {
+              const detected = detectSecrets(processedContent);
+              if (detected.length > 0) {
+                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              }
+            }
+
+            const sanitized = performSanitization(processedContent, finalProfile);
+
+            if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+              extraBlocks.push(buildUpsellBlock(null));
+            }
+
+            return {
+              content: [
+                { type: "text", text: sanitized },
+                ...extraBlocks
+              ]
+            };
+          } catch (pdfError) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Failed to parse PDF file: ${pdfError.message}` }]
+            };
+          }
+        }
+
+        if (isExcel) {
+          try {
+            const XLSX = require('xlsx');
+            const workbook = XLSX.read(buffer, { type: 'buffer' });
+            let content = '';
+            workbook.SheetNames.forEach(sheetName => {
+              const worksheet = workbook.Sheets[sheetName];
+              content += `--- Sheet: ${sheetName} ---\n`;
+              content += XLSX.utils.sheet_to_csv(worksheet) + '\n';
+            });
+
+            const targetProfile = profile.trim();
+            const isAdvanced = targetProfile.toLowerCase() !== "general";
+
+            let finalProfile = targetProfile;
+            const extraBlocks = [];
+
+            sessionRequestCount++;
+
+            if (isAdvanced && !license.isPro) {
+              const reason = license.error ? ` (${license.error})` : "";
+              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              finalProfile = "General";
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            }
+
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+
+            if (!license.isPro) {
+              const detected = detectSecrets(processedContent);
+              if (detected.length > 0) {
+                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              }
+            }
+
+            const sanitized = performSanitization(processedContent, finalProfile);
+
+            if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
+              extraBlocks.push(buildUpsellBlock(null));
+            }
+
+            return {
+              content: [
+                { type: "text", text: sanitized },
+                ...extraBlocks
+              ]
+            };
+          } catch (xlsxError) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Failed to parse Excel file: ${xlsxError.message}` }]
+            };
+          }
+        }
+      }
+
       // Check for null bytes in the first 8KB to detect binary files
       let isBinary = false;
       const checkLen = Math.min(buffer.length, 8000);
@@ -392,7 +578,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           content: [
             {
               type: "text",
-              text: `Error: Binary file format detected. The local MCP server only supports plain text files (e.g., source code, logs, CSV, markdown, JSON). To sanitize complex formats like PDF or DOCX, please use the web interface at: https://privacyscrubber.com/`
+              text: `Error: Binary file format detected. The local MCP server only supports plain text files (e.g., source code, logs, CSV, markdown, JSON) and premium document formats (PDF, DOCX, XLSX). To sanitize PDF or Excel files, please upgrade to PRO or use the web interface.`
             }
           ]
         };
@@ -410,7 +596,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       if (isAdvanced && !license.isPro) {
         const reason = license.error ? ` (${license.error})` : "";
-        process.stderr.write(`⚠️ [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}\nGet a PRO key at: https://privacyscrubber.com/pricing\n`);
+        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
         finalProfile = "General";
         extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
       }
@@ -418,6 +604,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro);
       if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
 
+      if (!license.isPro) {
+        const detected = detectSecrets(processedContent2);
+        if (detected.length > 0) {
+          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+        }
+      }
+
       const sanitized = performSanitization(processedContent2, finalProfile);
 
       if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
@@ -432,6 +626,47 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "create_default_config") {
+      const configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
+      if (fs.existsSync(configPath)) {
+        return {
+          content: [{
+            type: "text",
+            text: `ℹ️  Configuration file 'privacyscrubber.json' already exists in the active workspace root directory:\n   ${configPath}\nNo changes were made.`
+          }]
+        };
+      }
+
+      const defaultTemplate = {
+        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config",
+        "customRules": [
+          {
+            "pattern": "my-secret-pattern-\\d+",
+            "label": "CUSTOM_TAG",
+            "_comment": "pattern must be a valid Javascript regex string. label is the tag replacement (e.g. CUSTOM_TAG)"
+          }
+        ]
+      };
+
+      try {
+        fs.writeFileSync(configPath, JSON.stringify(defaultTemplate, null, 2) + '\n', 'utf8');
+        return {
+          content: [{
+            type: "text",
+            text: `✅ Configuration file 'privacyscrubber.json' successfully created in your workspace root:\n   ${configPath}\n\nRestart your MCP client (e.g. Cursor or Claude Desktop) to load the config rules.`
+          }]
+        };
+      } catch (err) {
+        return {
+          isError: true,
+          content: [{
+            type: "text",
+            text: `Error: Failed to write configuration file: ${err.message}`
+          }]
+        };
+      }
+    }
+
     if (name === "check_status") {
       const license = checkLicenseStatus();
       const tier = license.isPro ? 'PRO' : 'FREE';
@@ -439,12 +674,35 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const profileList = license.isPro
         ? 'All 23 profiles active (General, Dev, Medical, Legal, Finance, HR…)'
         : 'General only — PRO unlocks 22 industry profiles';
-      const rulesStatus = license.isPro ? '✅ Active (privacyscrubber.json)' : '🔒 Locked — requires PRO';
       const sizeLimit = license.isPro ? 'Unlimited' : '50,000 characters per request';
 
+      const configPath = resolveConfigPath();
+      let rulesStatus = '';
+      let configPathSnippet = 'Not found';
+
+      if (fs.existsSync(configPath)) {
+        const localPath = path.resolve(process.cwd(), 'privacyscrubber.json');
+        if (configPath === localPath) {
+          configPathSnippet = './privacyscrubber.json';
+        } else {
+          configPathSnippet = '~/privacyscrubber.json';
+        }
+
+        if (license.isPro) {
+          const rulesCount = loadCustomRules().length;
+          rulesStatus = `✅ Active (${rulesCount} rule${rulesCount !== 1 ? 's' : ''})`;
+        } else {
+          rulesStatus = '🔒 Ignored (requires PRO)';
+        }
+      } else {
+        rulesStatus = 'Not found';
+      }
+
+      const metricsSummary = getSessionMetricsSummary();
+
       const lines = [
         '╔══════════════════════════════════════════════════╗',
-        '║       PrivacyScrubber MCP Server v1.6.7          ║',
+        `║       PrivacyScrubber MCP Server v${MCP_VERSION.padEnd(10)}          ║`,
         '╠══════════════════════════════════════════════════╣',
         `║  ${tierIcon} Tier: ${tier.padEnd(43)}║`,
         `║  📊 Session requests: ${String(sessionRequestCount).padEnd(27)}║`,
@@ -452,6 +710,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         '╠══════════════════════════════════════════════════╣',
         `║  🏷️  Profiles: ${profileList.substring(0,35).padEnd(35)}║`,
         `║  📋 Custom rules: ${rulesStatus.padEnd(31)}║`,
+        `║  ⚙️  Config file: ${configPathSnippet.padEnd(31)}║`,
+        `║  📈 Metrics: ${metricsSummary.substring(0,36).padEnd(36)}║`,
         '╠══════════════════════════════════════════════════╣',
       ];
 
@@ -495,17 +755,50 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
   }
 });
 
-function loadCustomRules() {
-  const license = checkLicenseStatus();
-  
+function resolveConfigPath() {
   let configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
-
   if (!fs.existsSync(configPath)) {
     const homeDir = process.env.HOME || process.env.USERPROFILE || '';
     if (homeDir) {
       configPath = path.resolve(homeDir, 'privacyscrubber.json');
     }
   }
+  return configPath;
+}
+
+function getSessionMetricsSummary() {
+  const counts = {};
+  Object.keys(sessionMap).forEach(token => {
+    const match = token.match(/^\[([A-Z_]+)_\d+\]$/);
+    if (match) {
+      const type = match[1];
+      counts[type] = (counts[type] || 0) + 1;
+    }
+  });
+  
+  if (Object.keys(counts).length === 0) {
+    return '0 entities masked';
+  }
+  
+  const parts = [];
+  if (counts.NAME) parts.push(`${counts.NAME} Name${counts.NAME > 1 ? 's' : ''}`);
+  if (counts.EMAIL) parts.push(`${counts.EMAIL} Email${counts.EMAIL > 1 ? 's' : ''}`);
+  if (counts.PHONE) parts.push(`${counts.PHONE} Phone${counts.PHONE > 1 ? 's' : ''}`);
+  if (counts.ID) parts.push(`${counts.ID} ID${counts.ID > 1 ? 's' : ''}`);
+  if (counts.CUSTOM) parts.push(`${counts.CUSTOM} Custom${counts.CUSTOM > 1 ? 's' : ''}`);
+  
+  Object.entries(counts).forEach(([type, count]) => {
+    if (!['NAME', 'EMAIL', 'PHONE', 'ID', 'CUSTOM'].includes(type)) {
+      parts.push(`${count} ${type}${count > 1 ? 's' : ''}`);
+    }
+  });
+  
+  return parts.join(', ');
+}
+
+function loadCustomRules() {
+  const license = checkLicenseStatus();
+  const configPath = resolveConfigPath();
 
   if (fs.existsSync(configPath)) {
     try {
@@ -520,7 +813,7 @@ function loadCustomRules() {
             category: (r.label || r.category || "CUSTOM").toUpperCase()
           })).filter(r => r.pattern);
         } else {
-          process.stderr.write("⚠️ [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier. Set PRIVACYSCRUBBER_KEY to your PRO license key.\n");
+          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.${colors.reset}\n`);
         }
       }
     } catch (e) {
@@ -530,11 +823,44 @@ function loadCustomRules() {
   return [];
 }
 
-// Run helper
+// Secrets scanner — uses the module-level DEVOPS_SECRETS_DETECTOR constant
+function detectSecrets(text) {
+  const detected = [];
+  DEVOPS_SECRETS_DETECTOR.forEach(detector => {
+    // Reset lastIndex before every test — global regex retains state across calls
+    detector.regex.lastIndex = 0;
+    if (detector.regex.test(text)) {
+      detected.push(detector.name);
+    }
+  });
+  return detected;
+}
+
 function performSanitization(text, profile) {
   const customRules = loadCustomRules();
   const result = PrivacyScrubberCore.scrubText(text, customRules, {}, profile, sessionMap);
   
+  const license = checkLicenseStatus();
+  if (!license.isPro && result.tokenMap) {
+    // Re-scan each masked token's original value against the shared detector.
+    // If it was a raw secret, restore it in the output and remove from sessionMap
+    // so it is never accidentally revealed by reveal_text.
+    Object.entries(result.tokenMap).forEach(([token, original]) => {
+      let isSecret = false;
+      for (const detector of DEVOPS_SECRETS_DETECTOR) {
+        detector.regex.lastIndex = 0;
+        if (detector.regex.test(original)) {
+          isSecret = true;
+          break;
+        }
+      }
+      if (isSecret) {
+        result.scrubbedText = result.scrubbedText.replace(token, original);
+        delete result.tokenMap[token];
+      }
+    });
+  }
+
   // Update our volatile map with new matches
   if (result.tokenMap) {
     Object.entries(result.tokenMap).forEach(([token, original]) => {
@@ -548,7 +874,7 @@ function performSanitization(text, profile) {
 function truncateIfFree(text, isPro) {
   const MAX_FREE_CHARS = 50000;
   if (!isPro && text.length > MAX_FREE_CHARS) {
-    process.stderr.write(`⚠️ [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit). Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.\n`);
+    process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
     return { processedText: text.substring(0, MAX_FREE_CHARS), wasTruncated: true };
   }
   return { processedText: text, wasTruncated: false };
@@ -556,7 +882,10 @@ function truncateIfFree(text, isPro) {
 
 // Start the server transport
 const transport = new StdioServerTransport();
-server.connect(transport).catch((error) => {
+server.connect(transport).then(() => {
+  process.stderr.write(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server started successfully.${colors.reset}\n`);
+  process.stderr.write(`${colors.cyan}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
+}).catch((error) => {
   console.error("Failed to connect MCP server transport:", error);
   process.exit(1);
 });