@privacyscrubber/mcp-server 1.6.8 → 1.7.0

package/.well-known/mcp/server-card.json

@@ -1,7 +1,7 @@
 {
   "serverInfo": {
     "name": "privacyscrubber/pii-masking-mcp",
-    "version": "1.6.7"
+    "version": "1.6.9"
   },
   "tools": [
     {
@@ -16,7 +16,7 @@
           },
           "profile": {
             "type": "string",
-            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles. Defaults to 'General'."
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
           }
         },
         "required": ["text"]
@@ -48,11 +48,29 @@
           },
           "profile": {
             "type": "string",
-            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles. Defaults to 'General'."
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
           }
         },
         "required": ["file_path"]
       }
+    },
+    {
+      "name": "create_default_config",
+      "description": "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
+    },
+    {
+      "name": "check_status",
+      "description": "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
     }
   ],
   "resources": [],

package/index.js

@@ -44,6 +44,7 @@ const colors = {
   yellowBold: '\x1b[1;33m',
   yellow: '\x1b[33m',
   cyan: '\x1b[36m',
+  greenBold: '\x1b[1;32m',
   redBold: '\x1b[1;31m',
   reset: '\x1b[0m'
 };
@@ -315,11 +316,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       const restored = PrivacyScrubberCore.unscrubText(text, sessionMap);
+      let restoredText = restored.restoredText;
+      // Deduplicate common double-prefixed schemas resulting from LLM prefix reconstruction
+      restoredText = restoredText.replace(/\b(mysql|postgresql|postgres|redis|mongodb|https?|ftp|ssh|git|aws):\/\/\1:\/\//gi, '$1://');
+
       return {
         content: [
           {
             type: "text",
-            text: restored.restoredText
+            text: restoredText
           }
         ]
       };
@@ -644,6 +649,19 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             "label": "CUSTOM_TAG",
             "_comment": "pattern must be a valid Javascript regex string. label is the tag replacement (e.g. CUSTOM_TAG)"
           }
+        ],
+        "exclusions": [
+          "localhost",
+          "127.0.0.1",
+          "0.0.0.0",
+          "process.env",
+          "PORT",
+          "node_modules",
+          "PrivacyScrubber",
+          "console.log",
+          "console.error",
+          "utf-8",
+          "utf8"
         ]
       };
 
@@ -694,7 +712,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           rulesStatus = '🔒 Ignored (requires PRO)';
         }
       } else {
-        rulesStatus = 'Not found';
+        rulesStatus = 'None';
+        configPathSnippet = 'Run create_default_config';
       }
 
       const metricsSummary = getSessionMetricsSummary();
@@ -837,7 +856,8 @@ function detectSecrets(text) {
 
 function performSanitization(text, profile) {
   const customRules = loadCustomRules();
-  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, profile, sessionMap);
+  const normalizedProfile = (profile || "general").trim().toLowerCase();
+  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap);
   
   const license = checkLicenseStatus();
   if (!license.isPro && result.tokenMap) {
@@ -881,7 +901,10 @@ function truncateIfFree(text, isPro) {
 
 // Start the server transport
 const transport = new StdioServerTransport();
-server.connect(transport).catch((error) => {
+server.connect(transport).then(() => {
+  process.stderr.write(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server started successfully.${colors.reset}\n`);
+  process.stderr.write(`${colors.cyan}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
+}).catch((error) => {
   console.error("Failed to connect MCP server transport:", error);
   process.exit(1);
 });

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "privacyscrubber/pii-masking-mcp",
-  "version": "1.6.8",
+  "version": "1.6.9",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "author": {
     "name": "PrivacyScrubber",
@@ -21,53 +21,15 @@
   "tools": [
     {
       "name": "sanitize_text",
-      "description": "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
-      "inputSchema": {
-        "type": "object",
-        "properties": {
-          "text": {
-            "type": "string",
-            "description": "The raw text, code, or logs to sanitize."
-          },
-          "profile": {
-            "type": "string",
-            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
-          }
-        },
-        "required": ["text"]
-      }
+      "description": "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM."
     },
     {
       "name": "reveal_text",
-      "description": "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map.",
-      "inputSchema": {
-        "type": "object",
-        "properties": {
-          "text": {
-            "type": "string",
-            "description": "The AI generated response containing placeholders to restore."
-          }
-        },
-        "required": ["text"]
-      }
+      "description": "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map."
     },
     {
       "name": "sanitize_file",
-      "description": "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
-      "inputSchema": {
-        "type": "object",
-        "properties": {
-          "file_path": {
-            "type": "string",
-            "description": "Absolute path to the file to sanitize."
-          },
-          "profile": {
-            "type": "string",
-            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
-          }
-        },
-        "required": ["file_path"]
-      }
+      "description": "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory."
     }
   ],
   "user_config": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "1.6.8",
+  "version": "1.7.0",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",
@@ -10,6 +10,7 @@
   },
   "files": [
     "index.js",
+    "pii-masking-run.js",
     "scrubber-core.cjs",
     "smithery.yaml",
     "server.json",
@@ -19,7 +20,8 @@
   ],
   "bin": {
     "mcp-server": "index.js",
-    "privacyscrubber-mcp": "index.js"
+    "privacyscrubber-mcp": "index.js",
+    "pii-masking-run": "pii-masking-run.js"
   },
   "scripts": {
     "start": "node index.js"

package/pii-masking-run.js

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+
+/**
+ * PrivacyScrubber command runner wrapper: pii-masking-run
+ * 
+ * Runs any local shell command, intercepts its output (stdout/stderr) line-by-line, 
+ * sanitizes any PII/Secrets locally, and writes the clean stream to the terminal.
+ * 
+ * Usage: pii-masking-run [options] -- <command> [args...]
+ */
+
+import { spawn } from 'child_process';
+import { createRequire } from 'module';
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import readline from 'readline';
+import { fileURLToPath } from 'url';
+
+const require = createRequire(import.meta.url);
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Early check for --version or --help to avoid loading heavy dependencies
+const args = process.argv.slice(2);
+const cmdIndex = args.indexOf("--");
+
+if (args.includes("--version") || args.includes("-v")) {
+  const pkgPath = path.resolve(__dirname, './package.json');
+  let version = '1.7.0';
+  try { version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version; } catch (_) {}
+  console.log(`pii-masking-run v${version} (PrivacyScrubber MCP)`);
+  process.exit(0);
+}
+
+if (cmdIndex === -1 || args.includes("-h") || args.includes("--help")) {
+  console.log("PrivacyScrubber CLI Command Runner: pii-masking-run");
+  console.log("\nUsage:");
+  console.log("  npx pii-masking-run [options] -- <command> [args...]");
+  console.log("\nOptions:");
+  console.log("  --profile <name>  Specify detection profile (e.g. General, Medical, Legal, Dev, HR)");
+  console.log("  --key <licKey>    PrivacyScrubber PRO License Key");
+  console.log("  -v, --version     Print version");
+  console.log("  -h, --help        Show this help screen");
+  console.log("\nExamples:");
+  console.log("  npx pii-masking-run -- cat database-dump.sql");
+  console.log("  npx pii-masking-run --profile dev -- npm test");
+  process.exit(0);
+}
+
+// Import the production core engine
+const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
+const PrivacyScrubberCore = require(scrubberCorePath);
+
+PrivacyScrubberCore.init();
+
+// ANSI terminal colors
+const colors = {
+  yellowBold: '\x1b[1;33m',
+  cyan: '\x1b[36m',
+  reset: '\x1b[0m'
+};
+
+const DEVOPS_SECRETS_DETECTOR = [
+  { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g },
+  { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
+  { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g },
+  { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g },
+  { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
+];
+
+const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy1jZ9X4rO5C9U0qK57V1
+hJoYSkE4vLpcVYOt1FhRwEHs1APDSyss0HixboLz2eW2XQf2NbwajWtNlyxvgczO
+KE6ClnLomtsaKywwqB4alzdYnnnFJttFPjwmgPSO7D9AgN9sYaVkXOaOFrIZ90Ng
+TRhSHUeL7ReltWlCHwz9xf5m2FrKtxr2VBlEoyPjsFzalHMey1EX+yXe81zM7IIi
+t1Z8agLzo7WIfNBAIWmRlerTplaFFZrQgdF5g/Y0n8IIMZOtadgoY8E855psDNZV
+7wIDAQAB
+-----END PUBLIC KEY-----`;
+
+function checkLicenseStatus() {
+  const key = (process.env.PRIVACYSCRUBBER_KEY || "").trim();
+  if (!key) return { isPro: false, error: "No license key provided." };
+
+  try {
+    const [payloadBase64, signatureBase64] = key.split('.');
+    const verifier = crypto.createVerify('SHA256');
+    verifier.update(payloadBase64);
+    const isVerified = verifier.verify(PUBLIC_KEY, signatureBase64, 'base64');
+    
+    if (!isVerified) return { isPro: false, error: "Signature verification failed." };
+
+    const payload = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
+    if (payload.expires && payload.expires < Math.floor(Date.now() / 1000)) {
+      return { 
+        isPro: false, 
+        error: `License expired on ${new Date(payload.expires * 1000).toLocaleDateString()}` 
+      };
+    }
+    return { isPro: true, error: null };
+  } catch (e) {
+    return { isPro: false, error: "Error parsing license: " + e.message };
+  }
+}
+
+function resolveConfigPath() {
+  let configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
+  if (!fs.existsSync(configPath)) {
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+    if (homeDir) {
+      configPath = path.resolve(homeDir, 'privacyscrubber.json');
+    }
+  }
+  return configPath;
+}
+
+function loadCustomRules() {
+  const license = checkLicenseStatus();
+  const configPath = resolveConfigPath();
+
+  if (fs.existsSync(configPath)) {
+    try {
+      const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      const rules = config.customRules || [];
+      if (rules.length > 0) {
+        if (license.isPro) {
+          return rules.map(r => ({
+            pattern: r.pattern || r.regex || "",
+            label: (r.label || r.category || "CUSTOM").toUpperCase(),
+            regex: r.pattern || r.regex || "",
+            category: (r.label || r.category || "CUSTOM").toUpperCase()
+          })).filter(r => r.pattern);
+        } else {
+          process.stderr.write(`⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.\n👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.\n`);
+        }
+      }
+    } catch (e) {
+      process.stderr.write(`Error parsing privacyscrubber.json: ${e.message}\n`);
+    }
+  }
+  return [];
+}
+
+// Local runtime variables
+let profile = "General";
+let key = process.env.PRIVACYSCRUBBER_KEY || "";
+
+const optionsArgs = args.slice(0, cmdIndex);
+const commandArgs = args.slice(cmdIndex + 1);
+
+if (commandArgs.length === 0) {
+  console.error("Error: No command specified after '--'.");
+  process.exit(1);
+}
+
+// Parse custom command-line options
+for (let i = 0; i < optionsArgs.length; i++) {
+  if (optionsArgs[i] === "--profile" && optionsArgs[i + 1]) {
+    profile = optionsArgs[i + 1];
+    i++;
+  } else if (optionsArgs[i] === "--key" && optionsArgs[i + 1]) {
+    key = optionsArgs[i + 1];
+    i++;
+  }
+}
+
+if (key) {
+  process.env.PRIVACYSCRUBBER_KEY = key;
+}
+
+const customRules = loadCustomRules();
+const localSessionMap = {};
+
+function performSanitization(text) {
+  const normalizedProfile = (profile || "general").trim().toLowerCase();
+  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, localSessionMap);
+  const license = checkLicenseStatus();
+  
+  if (!license.isPro && result.tokenMap) {
+    // Free tier: check for secrets and warn
+    let hasSecrets = false;
+    Object.entries(result.tokenMap).forEach(([token, original]) => {
+      let isSecret = false;
+      for (const detector of DEVOPS_SECRETS_DETECTOR) {
+        detector.regex.lastIndex = 0;
+        if (detector.regex.test(original)) {
+          isSecret = true;
+          break;
+        }
+      }
+      if (isSecret) {
+        hasSecrets = true;
+        result.scrubbedText = result.scrubbedText.replace(token, original);
+      }
+    });
+
+    if (hasSecrets) {
+      process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Secrets/Keys detected in output. Redaction skipped (Requires PRO tier).${colors.reset}\n`);
+    }
+  }
+
+  return result.scrubbedText;
+}
+
+// Spawn child process capturing output
+const child = spawn(commandArgs[0], commandArgs.slice(1), {
+  stdio: ['inherit', 'pipe', 'pipe'],
+  shell: true
+});
+
+const rlStdout = readline.createInterface({
+  input: child.stdout,
+  terminal: false
+});
+
+rlStdout.on('line', (line) => {
+  const sanitized = performSanitization(line);
+  process.stdout.write(sanitized + '\n');
+});
+
+const rlStderr = readline.createInterface({
+  input: child.stderr,
+  terminal: false
+});
+
+rlStderr.on('line', (line) => {
+  const sanitized = performSanitization(line);
+  process.stderr.write(sanitized + '\n');
+});
+
+child.on('close', (code) => {
+  process.exit(code || 0);
+});
+
+child.on('error', (err) => {
+  console.error(`Error spawning command: ${err.message}`);
+  process.exit(1);
+});