@privacyscrubber/mcp-server 1.6.9 → 1.7.1

package/README.md

@@ -1,6 +1,7 @@
 # @privacyscrubber/mcp-server
 
 [![NPM Version](https://img.shields.io/npm/v/@privacyscrubber/mcp-server?color=blue)](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
+[![NPM Downloads](https://img.shields.io/npm/dm/@privacyscrubber/mcp-server?color=3b82f6)](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![smithery badge](https://smithery.ai/badge/privacyscrubber/pii-masking-mcp)](https://smithery.ai/servers/privacyscrubber/pii-masking-mcp)
 [![Security: 100% Local](https://img.shields.io/badge/Security-100%25%20Local-emerald)](https://privacyscrubber.com)

package/index.js

@@ -12,6 +12,10 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
+  ListPromptsRequestSchema,
+  GetPromptRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ReadResourceRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
 import { createRequire } from 'module';
 import fs from 'fs';
@@ -49,6 +53,18 @@ const colors = {
   reset: '\x1b[0m'
 };
 
+// Helper to log to both standard terminal (with colors) and MCP logging protocol
+function mcpLog(msg) {
+  const clean = msg.replace(/\x1b\[[0-9;]*m/g, '').trim();
+  const level = clean.includes('⚠️') || clean.includes('Error') ? "warning" : "info";
+  try {
+    server.sendLoggingMessage({ level, data: clean });
+  } catch(e) {
+    // Ignore if server isn't fully connected yet
+  }
+  process.stderr.write(msg);
+}
+
 // Secrets detection patterns — defined once here, shared by detectSecrets() and performSanitization()
 const DEVOPS_SECRETS_DETECTOR = [
   { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g },
@@ -60,13 +76,13 @@ const DEVOPS_SECRETS_DETECTOR = [
 
 // Hardcoded public key for offline cryptographic verification
 const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw3f37srO402PU4++Baf8
-FG8LY4l/IA3NKLlBnYmNHRTjfI/O/w5PDZn1xPcUQevojA1J+A5moKcjXsJ5b21X
-hJoYSkE4vLpcVYOt1FhRwEHs1APDSyss0HixboLz2eW2XQf2NbwajWtNlyxvgczO
-KE6ClnLomtsaKywwqB4alzdYnnnFJttFPjwmgPSO7D9AgN9sYaVkXOaOFrIZ90Ng
-TRhSHUeL7ReltWlCHwz9xf5m2FrKtxr2VBlEoyPjsFzalHMey1EX+yXe81zM7IIi
-t1Z8agLzo7WIfNBAIWmRlerTplaFFZrQgdF5g/Y0n8IIMZOtadgoY8E855psDNZV
-7wIDAQAB
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqN700s8jMq9Rf09prTPB
+ekrFTXi+mnzSgMzwy+rMrJ4kyZQRDTxSFO1d9r5JQIhHfK5ToPiiS/Z/AS+Ga5bb
+BCy50SORDRn1HzrvFjNP+kogYyOeFk2lWw0Lt4/mX3M98zRE2D1HBDQJF8Y5Y/6l
+735iwlF6T1oO0mEbb1FM5tKvO44OkTih7krc3w56R07S1WuYIhGLR6IfDbNU/drL
+nbhUR4HqBRepIsn9mcSODw/FP5t3QlFLfDvZo/1SIUSBa9NowhPtPk0Hq3hndSvR
+pXkyvjeA7HLyXU8hhvausn85QRdEYTMXP9BehDjhli4VELSAY3ARGzemcUgggejg
+CwIDAQAB
 -----END PUBLIC KEY-----`;
 
 function checkLicenseStatus() {
@@ -146,6 +162,9 @@ const server = new Server(
   {
     capabilities: {
       tools: {},
+      prompts: {},
+      logging: {},
+      resources: {},
     },
   }
 );
@@ -156,7 +175,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
     tools: [
       {
         name: "sanitize_text",
-        description: "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
+        description: "STEP 1: Call this first. You MUST NOT process raw user data before calling this. Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
         inputSchema: {
           type: "object",
           properties: {
@@ -174,7 +193,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "reveal_text",
-        description: "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map.",
+        description: "STEP 3: Call this last. You MUST pass your final generated response through this tool to restore tokens (e.g., [EMAIL_1]) back with the original private data from the local volatile RAM-only session map before showing it to the user.",
         inputSchema: {
           type: "object",
           properties: {
@@ -204,6 +223,59 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["file_path"]
         }
       },
+      {
+        name: "audit_directory_for_pii",
+        description: "Scans a local directory for leaks of secrets, keys, and PII. Returns a summary report. Use this tool for Security Auditing.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            directory_path: {
+              type: "string",
+              description: "Absolute path to the directory to audit."
+            },
+            profile: {
+              type: "string",
+              description: "The detection profile to use. Defaults to 'General'."
+            },
+            extensions: {
+              type: "array",
+              items: { type: "string" },
+              description: "List of file extensions to scan (e.g. ['.env', '.log', '.js']). If empty, scans all text files."
+            },
+            ignore_node_modules: {
+              type: "boolean",
+              description: "Whether to ignore 'node_modules' directories. Defaults to true."
+            }
+          },
+          required: ["directory_path"]
+        }
+      },
+      {
+        name: "redact_file",
+        description: "Action/Redact: In-place redaction of a local file. Replaces PII and secrets with tokens and saves the file. By default, creates a .bak backup. Use dry_run=true to test without modifying.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            file_path: {
+              type: "string",
+              description: "Absolute path to the file to redact."
+            },
+            profile: {
+              type: "string",
+              description: "The detection profile to use. Defaults to 'General'."
+            },
+            dry_run: {
+              type: "boolean",
+              description: "If true, does not modify the file, only returns the metrics and a preview."
+            },
+            no_backup: {
+              type: "boolean",
+              description: "If true, does not create a .bak file. Use with extreme caution!"
+            }
+          },
+          required: ["file_path"]
+        }
+      },
       {
         name: "create_default_config",
         description: "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
@@ -226,6 +298,116 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
   };
 });
 
+// List available prompts
+server.setRequestHandler(ListPromptsRequestSchema, async () => {
+  return {
+    prompts: [
+      {
+        name: "secure_ai_workflow",
+        description: "Zero-Trust Data Sanitization workflow instruction. Use this to automatically scrub PII before processing data.",
+      },
+      {
+        name: "safe_redaction_workflow",
+        description: "Instructions for using the redact_file tool safely with QA checks.",
+      }
+    ]
+  };
+});
+
+// Handle prompt execution
+server.setRequestHandler(GetPromptRequestSchema, async (request) => {
+  if (request.params.name === "safe_redaction_workflow") {
+    return {
+      description: "Instructions for safely redacting files in-place.",
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: "When you need to redact or scrub a file on disk permanently, follow this quality-assured workflow:\n1. Run `redact_file` with `dry_run: true` to preview the changes and check how many PII tokens will be replaced.\n2. Verify the metrics. If the numbers look correct and no unintended data is being scrubbed, run `redact_file` with `dry_run: false` to apply the redaction.\n3. Ensure you have backups. `redact_file` creates a `.bak` backup by default. NEVER set `no_backup: true` unless the user explicitly asks to destroy the original data without a backup."
+          }
+        }
+      ]
+    };
+  }
+
+  if (request.params.name !== "secure_ai_workflow") {
+    throw new Error(`Unknown prompt: ${request.params.name}`);
+  }
+  return {
+    description: "Instructions for securely processing data with PrivacyScrubber.",
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: "You are a secure, privacy-first AI agent. Whenever you are asked to process, analyze, or rewrite text or files that may contain PII (Personally Identifiable Information), secrets, or credentials, you MUST follow this Zero-Trust workflow:\n\n1. STEP 1: Call the `sanitize_text` or `sanitize_file` tool first to scrub the input. DO NOT process the raw user data.\n2. STEP 2: Perform your analysis or task on the sanitized output provided by the tool.\n3. STEP 3: Before returning your final answer to the user, you MUST call the `reveal_text` tool, passing your final answer. This will restore the original private data (e.g., replacing [EMAIL_1] with the real email).\n4. STEP 4: Return the result of the `reveal_text` tool to the user."
+        }
+      }
+    ]
+  };
+});
+
+// List Resource Templates
+server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => {
+  return {
+    resourceTemplates: [
+      {
+        uriTemplate: "mcp://privacyscrubber/profiles/{name}",
+        name: "PII Detection Profile Details",
+        description: "Returns the description and target entities of a specific PrivacyScrubber profile (e.g., 'Medical', 'Finance', 'General'). Use this to understand what a profile does."
+      }
+    ]
+  };
+});
+
+// Read Resource
+server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+  const uri = request.params.uri;
+  const match = uri.match(/^mcp:\/\/privacyscrubber\/profiles\/(.+)$/);
+  if (match) {
+    const profileName = match[1];
+    const descriptions = {
+      "general": "Scrubs basic PII: Names, Emails, Phone Numbers, Credit Cards, SSN, IPv4/IPv6, and standard API Keys.",
+      "dev": "Engineering profile. Scrubs AWS keys, JWTs, GCP keys, Stripe keys, database connection strings, and internal IP addresses.",
+      "engineering": "Engineering profile. Scrubs AWS keys, JWTs, GCP keys, Stripe keys, database connection strings, internal IPs, Docker paths, and K8s internal endpoints.",
+      "tech": "Technology profile. Scrubs cloud instance IDs, node/cluster IDs, environment tags, kubeconfig, and terraform states.",
+      "medical": "HIPAA compliance profile. Scrubs ICD-10 codes, medical record numbers (MRN), DEA numbers, NPI, patient names, and health conditions.",
+      "finance": "PCI/Finance profile. Scrubs IBAN, SWIFT codes, credit cards, routing numbers, and financial transaction IDs.",
+      "wealthmgmt": "Wealth Management profile. Scrubs ABA/Routing numbers, trust names, portfolio values, net worth, RMDs, and account numbers.",
+      "insurance": "Insurance profile. Scrubs claim numbers, policy numbers, settlement amounts, NAIC, adjustor IDs, and insured names.",
+      "accounting": "Accounting profile. Scrubs EIN, FEIN, Tax IDs, AGI, tax forms (1040, W-2, 1099), refund amounts, and PTINs.",
+      "legal": "Legal profile. Scrubs case numbers, matter numbers, attorney-client privilege markers, and litigation IDs.",
+      "hr": "Human Resources profile. Scrubs employee IDs (EEID), resumes, DOBs, tenant IDs, and home addresses.",
+      "security": "Security profile. Scrubs secrets, AWS keys, JWTs, Stripe keys, incident IDs, and breach reports.",
+      "marketing": "Marketing profile. Scrubs lead IDs, prospect IDs, GCLID/FBCLID, LTV/CAC amounts, cohort IDs, and segment IDs.",
+      "bizops": "BizOps profile. Scrubs deals, KPIs, vendor IDs, EBITDA/Revenue figures, NDAs, and M&A identifiers.",
+      "sales": "Sales profile. Scrubs opportunity IDs, DocuSign hashes, ARR/MRR/Quota amounts, and SFDC/HubSpot IDs.",
+      "support": "Support profile. Scrubs Zendesk/Jira ticket numbers, RMA/Return IDs, and loyalty/rewards numbers.",
+      "realestate": "Real Estate profile. Scrubs MLS numbers, LIS IDs, parcel numbers, rent/escrow amounts, and gate/lobby codes.",
+      "compliance": "Compliance profile. Scrubs GDPR/HIPAA/SOC2 audit IDs, DPA policy numbers, and SAR/DSAR request IDs.",
+      "ccpa": "CCPA profile. Scrubs driver licenses, precise geolocation (Lat/Long), CCPA/CPRA opt-out markers, and account numbers.",
+      "agents": "AI Agents profile. Scrubs agent IDs, vector IDs, task IDs, system prompts, and OpenAI API keys.",
+      "academic": "Academic profile. Scrubs student/alumni IDs, course numbers, FERPA/IRB IDs, and academic grades.",
+      "creative": "Creative profile. Scrubs project IDs, script drafts, spoiler/embargo tags, and ghostwriter names.",
+      "personal": "Personal profile. Scrubs birthdays, passwords, PINs, and emergency contacts/family phone numbers.",
+      "pharma": "Pharma/Clinical profile. Scrubs patient IDs, study protocols, IND/NDA numbers, IRB IDs, batch/lot serials, and dosages."
+    };
+    const desc = descriptions[profileName.toLowerCase()] || `The '${profileName}' profile is a PRO-tier detection ruleset tuned for specific industry compliance. It detects and sanitizes domain-specific identifiers.`;
+    
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: "text/markdown",
+          text: `# Profile: ${profileName}\n\n**Description:** ${desc}\n\n*Note: To use this profile, pass \`"profile": "${profileName}"\` to the \`sanitize_text\` or \`sanitize_file\` tools. Advanced profiles require a PRO license.*`
+        }
+      ]
+    };
+  }
+  throw new Error(`Resource not found: ${uri}`);
+});
+
 // Handle tool execution calls
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args } = request.params;
@@ -256,10 +438,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       sessionRequestCount++;
 
       if (isAdvanced && !license.isPro) {
-        const reason = license.error ? ` (${license.error})` : "";
-        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-        finalProfile = "General";
-        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+        if (text.length > 5000) {
+          const reason = license.error ? ` (${license.error})` : "";
+          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' on Free tier is limited to 5,000 chars. Falling back to 'General'.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          finalProfile = "General";
+          extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' on Free tier is limited to 5,000 chars. Upgrade to PRO for unlimited scanning.`));
+        } else {
+          mcpLog(`${colors.cyan}ℹ️  [PrivacyScrubber] Profile '${targetProfile}' active (Free tier: up to 5,000 chars).${colors.reset}\n`);
+        }
       }
 
       const { processedText, wasTruncated } = truncateIfFree(text, license.isPro);
@@ -270,7 +456,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       if (!license.isPro) {
         const detected = detectSecrets(processedText);
         if (detected.length > 0) {
-          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
           extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
         }
       }
@@ -316,11 +502,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       const restored = PrivacyScrubberCore.unscrubText(text, sessionMap);
+      let restoredText = restored.restoredText;
+      // Deduplicate common double-prefixed schemas resulting from LLM prefix reconstruction
+      restoredText = restoredText.replace(/\b(mysql|postgresql|postgres|redis|mongodb|https?|ftp|ssh|git|aws):\/\/\1:\/\//gi, '$1://');
+
       return {
         content: [
           {
             type: "text",
-            text: restored.restoredText
+            text: restoredText
           }
         ]
       };
@@ -398,7 +588,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           if (isAdvanced && !license.isPro) {
             const reason = license.error ? ` (${license.error})` : "";
-            process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+            mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
             finalProfile = "General";
             extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
           }
@@ -409,7 +599,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           if (!license.isPro) {
             const detected = detectSecrets(processedContent);
             if (detected.length > 0) {
-              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
               extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
             }
           }
@@ -468,7 +658,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
             if (isAdvanced && !license.isPro) {
               const reason = license.error ? ` (${license.error})` : "";
-              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
               finalProfile = "General";
               extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
             }
@@ -479,7 +669,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+                mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
                 extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
               }
             }
@@ -525,7 +715,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
             if (isAdvanced && !license.isPro) {
               const reason = license.error ? ` (${license.error})` : "";
-              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
               finalProfile = "General";
               extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
             }
@@ -536,7 +726,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+                mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
                 extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
               }
             }
@@ -596,7 +786,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       if (isAdvanced && !license.isPro) {
         const reason = license.error ? ` (${license.error})` : "";
-        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
         finalProfile = "General";
         extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
       }
@@ -607,7 +797,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       if (!license.isPro) {
         const detected = detectSecrets(processedContent2);
         if (detected.length > 0) {
-          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
+          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
           extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
         }
       }
@@ -626,6 +816,84 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "redact_file") {
+      const { file_path, profile, dry_run, no_backup } = args;
+      if (!file_path || !fs.existsSync(file_path)) {
+        return { isError: true, content: [{ type: "text", text: `Error: File not found at path: ${file_path}` }] };
+      }
+
+      try {
+        const stat = await fs.promises.stat(file_path);
+        if (stat.size > 50 * 1024 * 1024) {
+          return { isError: true, content: [{ type: "text", text: `Error: File is too large (>50MB).` }] };
+        }
+
+        const buffer = fs.readFileSync(file_path);
+        if (buffer.indexOf(0) !== -1) {
+          return { isError: true, content: [{ type: "text", text: `Error: Cannot redact binary file.` }] };
+        }
+        const content = buffer.toString('utf8');
+
+        const customRules = loadCustomRules();
+        const normalizedProfile = (profile || "general").trim().toLowerCase();
+        const license = checkLicenseStatus();
+        const localSessionMap = {};
+        
+        const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+        
+        let isSecretLeak = false;
+        if (!license.isPro && result.tokenMap) {
+          Object.entries(result.tokenMap).forEach(([token, original]) => {
+            for (const detector of DEVOPS_SECRETS_DETECTOR) {
+              detector.regex.lastIndex = 0;
+              if (detector.regex.test(original)) {
+                isSecretLeak = true;
+                break;
+              }
+            }
+          });
+        }
+
+        const counts = {};
+        Object.keys(localSessionMap).forEach(token => {
+          const match = token.match(/^\[([A-Z_]+)_\d+\]$/);
+          if (match) {
+            counts[match[1]] = (counts[match[1]] || 0) + 1;
+          }
+        });
+        const summary = Object.entries(counts).map(([type, count]) => `${count} ${type}`).join(', ') || 'None';
+        
+        if (dry_run) {
+          return {
+            content: [{ 
+              type: "text", 
+              text: `DRY RUN: ⚠️ Would redact ${Object.keys(localSessionMap).length} tokens (${summary}).\n${isSecretLeak ? "⚠️ RAW SECRET DETECTED (Requires PRO to actually redact)\n" : ""}Run again with dry_run: false to apply changes.` 
+            }]
+          };
+        }
+
+        if (isSecretLeak) {
+          return { isError: true, content: [{ type: "text", text: `Error: API Key or Secret detected. Sanitization of raw secrets requires PRO Profile. Upgrade at https://privacyscrubber.com/pricing` }] };
+        }
+
+        if (!no_backup) {
+          fs.writeFileSync(`${file_path}.bak`, content, 'utf8');
+        }
+
+        fs.writeFileSync(file_path, result.scrubbedText, 'utf8');
+
+        return {
+          content: [{ 
+            type: "text", 
+            text: `✅ File successfully redacted.\nReplaced ${Object.keys(localSessionMap).length} tokens (${summary}).\n${!no_backup ? `Backup saved to ${file_path}.bak` : "No backup created (no_backup=true)."}` 
+          }]
+        };
+
+      } catch (err) {
+        return { isError: true, content: [{ type: "text", text: `Error redacting file: ${err.message}` }] };
+      }
+    }
+
     if (name === "create_default_config") {
       const configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
       if (fs.existsSync(configPath)) {
@@ -645,6 +913,19 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             "label": "CUSTOM_TAG",
             "_comment": "pattern must be a valid Javascript regex string. label is the tag replacement (e.g. CUSTOM_TAG)"
           }
+        ],
+        "exclusions": [
+          "localhost",
+          "127.0.0.1",
+          "0.0.0.0",
+          "process.env",
+          "PORT",
+          "node_modules",
+          "PrivacyScrubber",
+          "console.log",
+          "console.error",
+          "utf-8",
+          "utf8"
         ]
       };
 
@@ -695,7 +976,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           rulesStatus = '🔒 Ignored (requires PRO)';
         }
       } else {
-        rulesStatus = 'Not found';
+        rulesStatus = 'None';
+        configPathSnippet = 'Run create_default_config';
       }
 
       const metricsSummary = getSessionMetricsSummary();
@@ -743,6 +1025,92 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "audit_directory_for_pii") {
+      const { directory_path, profile, extensions, ignore_node_modules } = args;
+      if (!directory_path || !fs.existsSync(directory_path)) {
+        return { isError: true, content: [{ type: "text", text: `Error: Directory not found at path: ${directory_path}` }] };
+      }
+
+      const filesToScan = [];
+      const ignoreDirs = ignore_node_modules !== false ? ['.git', 'node_modules', '.next', 'dist', 'build', '.cache'] : ['.git'];
+      
+      async function walkDir(dir) {
+        const entries = await fs.promises.readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+          const fullPath = path.join(dir, entry.name);
+          if (entry.isDirectory()) {
+            if (!ignoreDirs.includes(entry.name)) await walkDir(fullPath);
+          } else if (entry.isFile()) {
+            if (extensions && extensions.length > 0) {
+              const ext = path.extname(entry.name);
+              if (!extensions.includes(ext)) continue;
+            }
+            filesToScan.push(fullPath);
+          }
+        }
+      }
+
+      await walkDir(directory_path);
+
+      let reportLines = [`## Security Audit Report: ${directory_path}`];
+      let filesWithIssues = 0;
+      const customRules = loadCustomRules();
+      const normalizedProfile = (profile || "general").trim().toLowerCase();
+      const license = checkLicenseStatus();
+
+      for (const file of filesToScan) {
+        try {
+          const stat = await fs.promises.stat(file);
+          if (stat.size > 10 * 1024 * 1024) continue; // skip >10MB
+
+          const buffer = fs.readFileSync(file);
+          // basic binary check
+          if (buffer.indexOf(0) !== -1) continue; 
+          const content = buffer.toString('utf8');
+
+          const localSessionMap = {};
+          const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+          
+          let isSecretLeak = false;
+          if (!license.isPro && result.tokenMap) {
+            Object.entries(result.tokenMap).forEach(([token, original]) => {
+              for (const detector of DEVOPS_SECRETS_DETECTOR) {
+                detector.regex.lastIndex = 0;
+                if (detector.regex.test(original)) {
+                  isSecretLeak = true;
+                  break;
+                }
+              }
+            });
+          }
+
+          if (Object.keys(localSessionMap).length > 0 || isSecretLeak) {
+            filesWithIssues++;
+            const counts = {};
+            Object.keys(localSessionMap).forEach(token => {
+              const match = token.match(/^\[([A-Z_]+)_\d+\]$/);
+              if (match) {
+                counts[match[1]] = (counts[match[1]] || 0) + 1;
+              }
+            });
+            const summary = Object.entries(counts).map(([type, count]) => `${count} ${type}`).join(', ');
+            let leakMsg = isSecretLeak ? " (⚠️ RAW SECRET DETECTED — REQUIRES PRO)" : "";
+            reportLines.push(`- \`${path.relative(directory_path, file)}\`: ⚠️ Found ${summary}${leakMsg}`);
+          }
+        } catch (err) {
+          // ignore file read errors
+        }
+      }
+
+      if (filesWithIssues === 0) {
+        reportLines.push("✅ Clean. No PII or secrets detected in the scanned files.");
+      }
+
+      return {
+        content: [{ type: "text", text: reportLines.join('\n') }]
+      };
+    }
+
     return {
       isError: true,
       content: [{ type: "text", text: `Unknown tool: ${name}` }]
@@ -813,11 +1181,11 @@ function loadCustomRules() {
             category: (r.label || r.category || "CUSTOM").toUpperCase()
           })).filter(r => r.pattern);
         } else {
-          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.${colors.reset}\n`);
+          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.${colors.reset}\n`);
         }
       }
     } catch (e) {
-      process.stderr.write(`Error parsing privacyscrubber.json: ${e.message}\n`);
+      mcpLog(`Error parsing privacyscrubber.json: ${e.message}\n`);
     }
   }
   return [];
@@ -838,9 +1206,9 @@ function detectSecrets(text) {
 
 function performSanitization(text, profile) {
   const customRules = loadCustomRules();
-  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, profile, sessionMap);
-  
+  const normalizedProfile = (profile || "general").trim().toLowerCase();
   const license = checkLicenseStatus();
+  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap, license.isPro);
   if (!license.isPro && result.tokenMap) {
     // Re-scan each masked token's original value against the shared detector.
     // If it was a raw secret, restore it in the output and remove from sessionMap
@@ -872,9 +1240,9 @@ function performSanitization(text, profile) {
 }
 
 function truncateIfFree(text, isPro) {
-  const MAX_FREE_CHARS = 50000;
+  const MAX_FREE_CHARS = 5000;
   if (!isPro && text.length > MAX_FREE_CHARS) {
-    process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
+    mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
     return { processedText: text.substring(0, MAX_FREE_CHARS), wasTruncated: true };
   }
   return { processedText: text, wasTruncated: false };
@@ -883,8 +1251,8 @@ function truncateIfFree(text, isPro) {
 // Start the server transport
 const transport = new StdioServerTransport();
 server.connect(transport).then(() => {
-  process.stderr.write(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server started successfully.${colors.reset}\n`);
-  process.stderr.write(`${colors.cyan}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
+  mcpLog(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server started successfully.${colors.reset}\n`);
+  mcpLog(`${colors.cyan}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
 }).catch((error) => {
   console.error("Failed to connect MCP server transport:", error);
   process.exit(1);

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "privacyscrubber/pii-masking-mcp",
-  "version": "1.6.9",
+  "version": "1.7.1",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "author": {
     "name": "PrivacyScrubber",