@privacyscrubber/mcp-server 1.7.0 → 1.7.2

package/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// LicenseManager will be required below
 
 /**
  * PrivacyScrubber MCP Server
@@ -12,6 +13,10 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
+  ListPromptsRequestSchema,
+  GetPromptRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ReadResourceRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
 import { createRequire } from 'module';
 import fs from 'fs';
@@ -32,6 +37,7 @@ const MCP_VERSION = require('./package.json').version;
 // Import the production core engine with 100% parity
 const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
 const PrivacyScrubberCore = require(scrubberCorePath);
+const LicenseManager = require('./ps-license-manager.js');
 
 // Initialize core engine
 PrivacyScrubberCore.init();
@@ -49,6 +55,18 @@ const colors = {
   reset: '\x1b[0m'
 };
 
+// Helper to log to both standard terminal (with colors) and MCP logging protocol
+function mcpLog(msg) {
+  const clean = msg.replace(/\x1b\[[0-9;]*m/g, '').trim();
+  const level = clean.includes('⚠️') || clean.includes('Error') ? "warning" : "info";
+  try {
+    server.sendLoggingMessage({ level, data: clean });
+  } catch(e) {
+    // Ignore if server isn't fully connected yet
+  }
+  process.stderr.write(msg);
+}
+
 // Secrets detection patterns — defined once here, shared by detectSecrets() and performSanitization()
 const DEVOPS_SECRETS_DETECTOR = [
   { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g },
@@ -58,83 +76,31 @@ const DEVOPS_SECRETS_DETECTOR = [
   { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
 ];
 
-// Hardcoded public key for offline cryptographic verification
-const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw3f37srO402PU4++Baf8
-FG8LY4l/IA3NKLlBnYmNHRTjfI/O/w5PDZn1xPcUQevojA1J+A5moKcjXsJ5b21X
-hJoYSkE4vLpcVYOt1FhRwEHs1APDSyss0HixboLz2eW2XQf2NbwajWtNlyxvgczO
-KE6ClnLomtsaKywwqB4alzdYnnnFJttFPjwmgPSO7D9AgN9sYaVkXOaOFrIZ90Ng
-TRhSHUeL7ReltWlCHwz9xf5m2FrKtxr2VBlEoyPjsFzalHMey1EX+yXe81zM7IIi
-t1Z8agLzo7WIfNBAIWmRlerTplaFFZrQgdF5g/Y0n8IIMZOtadgoY8E855psDNZV
-7wIDAQAB
------END PUBLIC KEY-----`;
-
 function checkLicenseStatus() {
   const key = (process.env.PRIVACYSCRUBBER_KEY || "").trim();
   if (!key) return { isPro: false, type: null, error: "No license key provided." };
 
-  try {
-    const [payloadBase64, signatureBase64] = key.split('.');
-    if (!payloadBase64 || !signatureBase64) {
-      return { isPro: false, type: null, error: "Invalid license key structure." };
-    }
-
-    const verifier = crypto.createVerify('SHA256');
-    verifier.update(payloadBase64);
-    const isVerified = verifier.verify(PUBLIC_KEY, signatureBase64, 'base64');
-    
-    if (!isVerified) {
-      return { isPro: false, type: null, error: "Signature verification failed." };
-    }
-
-    const payload = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
-    
-    // Expiration check
-    if (payload.expires && payload.expires < Math.floor(Date.now() / 1000)) {
-      return { 
-        isPro: false, 
-        type: payload.type, 
-        error: `License expired on ${new Date(payload.expires * 1000).toLocaleDateString()}` 
-      };
-    }
-
-    return { isPro: true, type: payload.type, error: null };
-  } catch (e) {
-    return { isPro: false, type: null, error: "Error parsing license: " + e.message };
+  const result = LicenseManager.validate(key);
+  
+  if (!result.valid) {
+    return { isPro: false, type: null, error: result.reason || "Invalid license format or signature." };
   }
+
+  return { isPro: true, type: result.tier, error: null };
 }
 
 // ── Session request counter (volatile in-memory) ─────────────────────────────
 let sessionRequestCount = 0;
 const UPSELL_EVERY_N = 10; // show upsell nudge every N free-tier requests
 
-// Build a clean upsell content block visible to the agent / user
+// Build a clean upsell content block (Disabled to prevent agent-visible marketing content)
 function buildUpsellBlock(reason) {
-  const count = sessionRequestCount;
-  let lines = [
-    '─────────────────────────────────────────────',
-    '⚡ PrivacyScrubber PRO — Upgrade your AI setup',
-    '─────────────────────────────────────────────',
-  ];
-  if (reason) lines.push(`ℹ️  ${reason}`);
-  lines.push(
-    `📊 Free session requests: ${count}`,
-    '🔒 PRO unlocks: 22 industry profiles (Dev, Medical, Legal…)',
-    '         + Custom regex rules (privacyscrubber.json)',
-    '         + Unlimited input size',
-    '',
-    '💳 PRO Lifetime: $110  →  https://privacyscrubber.com/pricing',
-    '',
-    'After purchase, add your key to your MCP config:',
-    '  "PRIVACYSCRUBBER_KEY": "<your-key-here>"',
-    '─────────────────────────────────────────────'
-  );
-  return { type: 'text', text: lines.join('\n') };
+  return null;
 }
 
-// Decide if we should attach a soft periodic nudge (every N requests, free tier)
+// Decide if we should attach a soft periodic nudge (Disabled to maintain clean MCP output)
 function shouldNudge(isPro) {
-  return !isPro && sessionRequestCount > 0 && sessionRequestCount % UPSELL_EVERY_N === 0;
+  return false;
 }
 
 // Create the MCP server
@@ -146,6 +112,9 @@ const server = new Server(
   {
     capabilities: {
       tools: {},
+      prompts: {},
+      logging: {},
+      resources: {},
     },
   }
 );
@@ -156,7 +125,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
     tools: [
       {
         name: "sanitize_text",
-        description: "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
+        description: "STEP 1: Call this first. You MUST NOT process raw user data before calling this. Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
         inputSchema: {
           type: "object",
           properties: {
@@ -174,7 +143,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "reveal_text",
-        description: "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map.",
+        description: "STEP 3: Call this last. You MUST pass your final generated response through this tool to restore tokens (e.g., [EMAIL_1]) back with the original private data from the local volatile RAM-only session map before showing it to the user.",
         inputSchema: {
           type: "object",
           properties: {
@@ -204,6 +173,59 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["file_path"]
         }
       },
+      {
+        name: "audit_directory_for_pii",
+        description: "Scans a local directory for leaks of secrets, keys, and PII. Returns a summary report. Use this tool for Security Auditing.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            directory_path: {
+              type: "string",
+              description: "Absolute path to the directory to audit."
+            },
+            profile: {
+              type: "string",
+              description: "The detection profile to use. Defaults to 'General'."
+            },
+            extensions: {
+              type: "array",
+              items: { type: "string" },
+              description: "List of file extensions to scan (e.g. ['.env', '.log', '.js']). If empty, scans all text files."
+            },
+            ignore_node_modules: {
+              type: "boolean",
+              description: "Whether to ignore 'node_modules' directories. Defaults to true."
+            }
+          },
+          required: ["directory_path"]
+        }
+      },
+      {
+        name: "redact_file",
+        description: "Action/Redact: In-place redaction of a local file. Replaces PII and secrets with tokens and saves the file. By default, creates a .bak backup. Use dry_run=true to test without modifying.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            file_path: {
+              type: "string",
+              description: "Absolute path to the file to redact."
+            },
+            profile: {
+              type: "string",
+              description: "The detection profile to use. Defaults to 'General'."
+            },
+            dry_run: {
+              type: "boolean",
+              description: "If true, does not modify the file, only returns the metrics and a preview."
+            },
+            no_backup: {
+              type: "boolean",
+              description: "If true, does not create a .bak file. Use with extreme caution!"
+            }
+          },
+          required: ["file_path"]
+        }
+      },
       {
         name: "create_default_config",
         description: "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
@@ -226,6 +248,116 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
   };
 });
 
+// List available prompts
+server.setRequestHandler(ListPromptsRequestSchema, async () => {
+  return {
+    prompts: [
+      {
+        name: "secure_ai_workflow",
+        description: "Zero-Trust Data Sanitization workflow instruction. Use this to automatically scrub PII before processing data.",
+      },
+      {
+        name: "safe_redaction_workflow",
+        description: "Instructions for using the redact_file tool safely with QA checks.",
+      }
+    ]
+  };
+});
+
+// Handle prompt execution
+server.setRequestHandler(GetPromptRequestSchema, async (request) => {
+  if (request.params.name === "safe_redaction_workflow") {
+    return {
+      description: "Instructions for safely redacting files in-place.",
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: "When you need to redact or scrub a file on disk permanently, follow this quality-assured workflow:\n1. Run `redact_file` with `dry_run: true` to preview the changes and check how many PII tokens will be replaced.\n2. Verify the metrics. If the numbers look correct and no unintended data is being scrubbed, run `redact_file` with `dry_run: false` to apply the redaction.\n3. Ensure you have backups. `redact_file` creates a `.bak` backup by default. NEVER set `no_backup: true` unless the user explicitly asks to destroy the original data without a backup."
+          }
+        }
+      ]
+    };
+  }
+
+  if (request.params.name !== "secure_ai_workflow") {
+    throw new Error(`Unknown prompt: ${request.params.name}`);
+  }
+  return {
+    description: "Instructions for securely processing data with PrivacyScrubber.",
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: "You are a secure, privacy-first AI agent. Whenever you are asked to process, analyze, or rewrite text or files that may contain PII (Personally Identifiable Information), secrets, or credentials, you MUST follow this Zero-Trust workflow:\n\n1. STEP 1: Call the `sanitize_text` or `sanitize_file` tool first to scrub the input. DO NOT process the raw user data.\n2. STEP 2: Perform your analysis or task on the sanitized output provided by the tool.\n3. STEP 3: Before returning your final answer to the user, you MUST call the `reveal_text` tool, passing your final answer. This will restore the original private data (e.g., replacing [EMAIL_1] with the real email).\n4. STEP 4: Return the result of the `reveal_text` tool to the user."
+        }
+      }
+    ]
+  };
+});
+
+// List Resource Templates
+server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => {
+  return {
+    resourceTemplates: [
+      {
+        uriTemplate: "mcp://privacyscrubber/profiles/{name}",
+        name: "PII Detection Profile Details",
+        description: "Returns the description and target entities of a specific PrivacyScrubber profile (e.g., 'Medical', 'Finance', 'General'). Use this to understand what a profile does."
+      }
+    ]
+  };
+});
+
+// Read Resource
+server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+  const uri = request.params.uri;
+  const match = uri.match(/^mcp:\/\/privacyscrubber\/profiles\/(.+)$/);
+  if (match) {
+    const profileName = match[1];
+    const descriptions = {
+      "general": "Scrubs basic PII: Names, Emails, Phone Numbers, Credit Cards, SSN, IPv4/IPv6, and standard API Keys.",
+      "dev": "Engineering profile. Scrubs AWS keys, JWTs, GCP keys, Stripe keys, database connection strings, and internal IP addresses.",
+      "engineering": "Engineering profile. Scrubs AWS keys, JWTs, GCP keys, Stripe keys, database connection strings, internal IPs, Docker paths, and K8s internal endpoints.",
+      "tech": "Technology profile. Scrubs cloud instance IDs, node/cluster IDs, environment tags, kubeconfig, and terraform states.",
+      "medical": "HIPAA compliance profile. Scrubs ICD-10 codes, medical record numbers (MRN), DEA numbers, NPI, patient names, and health conditions.",
+      "finance": "PCI/Finance profile. Scrubs IBAN, SWIFT codes, credit cards, routing numbers, and financial transaction IDs.",
+      "wealthmgmt": "Wealth Management profile. Scrubs ABA/Routing numbers, trust names, portfolio values, net worth, RMDs, and account numbers.",
+      "insurance": "Insurance profile. Scrubs claim numbers, policy numbers, settlement amounts, NAIC, adjustor IDs, and insured names.",
+      "accounting": "Accounting profile. Scrubs EIN, FEIN, Tax IDs, AGI, tax forms (1040, W-2, 1099), refund amounts, and PTINs.",
+      "legal": "Legal profile. Scrubs case numbers, matter numbers, attorney-client privilege markers, and litigation IDs.",
+      "hr": "Human Resources profile. Scrubs employee IDs (EEID), resumes, DOBs, tenant IDs, and home addresses.",
+      "security": "Security profile. Scrubs secrets, AWS keys, JWTs, Stripe keys, incident IDs, and breach reports.",
+      "marketing": "Marketing profile. Scrubs lead IDs, prospect IDs, GCLID/FBCLID, LTV/CAC amounts, cohort IDs, and segment IDs.",
+      "bizops": "BizOps profile. Scrubs deals, KPIs, vendor IDs, EBITDA/Revenue figures, NDAs, and M&A identifiers.",
+      "sales": "Sales profile. Scrubs opportunity IDs, DocuSign hashes, ARR/MRR/Quota amounts, and SFDC/HubSpot IDs.",
+      "support": "Support profile. Scrubs Zendesk/Jira ticket numbers, RMA/Return IDs, and loyalty/rewards numbers.",
+      "realestate": "Real Estate profile. Scrubs MLS numbers, LIS IDs, parcel numbers, rent/escrow amounts, and gate/lobby codes.",
+      "compliance": "Compliance profile. Scrubs GDPR/HIPAA/SOC2 audit IDs, DPA policy numbers, and SAR/DSAR request IDs.",
+      "ccpa": "CCPA profile. Scrubs driver licenses, precise geolocation (Lat/Long), CCPA/CPRA opt-out markers, and account numbers.",
+      "agents": "AI Agents profile. Scrubs agent IDs, vector IDs, task IDs, system prompts, and OpenAI API keys.",
+      "academic": "Academic profile. Scrubs student/alumni IDs, course numbers, FERPA/IRB IDs, and academic grades.",
+      "creative": "Creative profile. Scrubs project IDs, script drafts, spoiler/embargo tags, and ghostwriter names.",
+      "personal": "Personal profile. Scrubs birthdays, passwords, PINs, and emergency contacts/family phone numbers.",
+      "pharma": "Pharma/Clinical profile. Scrubs patient IDs, study protocols, IND/NDA numbers, IRB IDs, batch/lot serials, and dosages."
+    };
+    const desc = descriptions[profileName.toLowerCase()] || `The '${profileName}' profile is a PRO-tier detection ruleset tuned for specific industry compliance. It detects and sanitizes domain-specific identifiers.`;
+    
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: "text/markdown",
+          text: `# Profile: ${profileName}\n\n**Description:** ${desc}\n\n*Note: To use this profile, pass \`"profile": "${profileName}"\` to the \`sanitize_text\` or \`sanitize_file\` tools. Advanced profiles require a PRO license.*`
+        }
+      ]
+    };
+  }
+  throw new Error(`Resource not found: ${uri}`);
+});
+
 // Handle tool execution calls
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args } = request.params;
@@ -255,23 +387,25 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       sessionRequestCount++;
 
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
       if (isAdvanced && !license.isPro) {
-        const reason = license.error ? ` (${license.error})` : "";
-        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-        finalProfile = "General";
-        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
       }
 
-      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro);
+      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro, charLimit);
       if (wasTruncated) {
-        extraBlocks.push(buildUpsellBlock(`Input was truncated to 50,000 characters (Free Tier limit).`));
+        extraBlocks.push(buildUpsellBlock(`Input was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
       }
 
       if (!license.isPro) {
         const detected = detectSecrets(processedText);
         if (detected.length > 0) {
-          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+          mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
         }
       }
 
@@ -285,7 +419,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       return {
         content: [
           { type: "text", text: sanitized },
-          ...extraBlocks
+          ...extraBlocks.filter(Boolean)
         ]
       };
     }
@@ -400,21 +534,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           sessionRequestCount++;
 
+          const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
           if (isAdvanced && !license.isPro) {
-            const reason = license.error ? ` (${license.error})` : "";
-            process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-            finalProfile = "General";
-            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
           }
 
-          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
           if (!license.isPro) {
             const detected = detectSecrets(processedContent);
             if (detected.length > 0) {
-              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              return {
+                isError: true,
+                content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+              };
             }
           }
 
@@ -427,7 +563,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           return {
             content: [
               { type: "text", text: sanitized },
-              ...extraBlocks
+              ...extraBlocks.filter(Boolean)
             ]
           };
         } catch (docxError) {
@@ -451,7 +587,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             content: [
               {
                 type: "text",
-                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing`
+                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal`
               }
             ]
           };
@@ -470,21 +606,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
             sessionRequestCount++;
 
+            const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
             if (isAdvanced && !license.isPro) {
-              const reason = license.error ? ` (${license.error})` : "";
-              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              finalProfile = "General";
-              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
             }
 
-            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+                mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+                return {
+                  isError: true,
+                  content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+                };
               }
             }
 
@@ -497,7 +635,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             return {
               content: [
                 { type: "text", text: sanitized },
-                ...extraBlocks
+                ...extraBlocks.filter(Boolean)
               ]
             };
           } catch (pdfError) {
@@ -527,21 +665,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
             sessionRequestCount++;
 
+            const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
             if (isAdvanced && !license.isPro) {
-              const reason = license.error ? ` (${license.error})` : "";
-              process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              finalProfile = "General";
-              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
             }
 
-            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+                mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+                return {
+                  isError: true,
+                  content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+                };
               }
             }
 
@@ -554,7 +694,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             return {
               content: [
                 { type: "text", text: sanitized },
-                ...extraBlocks
+                ...extraBlocks.filter(Boolean)
               ]
             };
           } catch (xlsxError) {
@@ -598,21 +738,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       sessionRequestCount++;
 
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
       if (isAdvanced && !license.isPro) {
-        const reason = license.error ? ` (${license.error})` : "";
-        process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-        finalProfile = "General";
-        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
       }
 
-      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro);
-      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro, charLimit);
+      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
       if (!license.isPro) {
         const detected = detectSecrets(processedContent2);
         if (detected.length > 0) {
-          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+          mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
         }
       }
 
@@ -625,11 +767,89 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       return {
         content: [
           { type: "text", text: sanitized },
-          ...extraBlocks
+          ...extraBlocks.filter(Boolean)
         ]
       };
     }
 
+    if (name === "redact_file") {
+      const { file_path, profile, dry_run, no_backup } = args;
+      if (!file_path || !fs.existsSync(file_path)) {
+        return { isError: true, content: [{ type: "text", text: `Error: File not found at path: ${file_path}` }] };
+      }
+
+      try {
+        const stat = await fs.promises.stat(file_path);
+        if (stat.size > 50 * 1024 * 1024) {
+          return { isError: true, content: [{ type: "text", text: `Error: File is too large (>50MB).` }] };
+        }
+
+        const buffer = fs.readFileSync(file_path);
+        if (buffer.indexOf(0) !== -1) {
+          return { isError: true, content: [{ type: "text", text: `Error: Cannot redact binary file.` }] };
+        }
+        const content = buffer.toString('utf8');
+
+        const customRules = loadCustomRules();
+        const normalizedProfile = (profile || "general").trim().toLowerCase();
+        const license = checkLicenseStatus();
+        const localSessionMap = {};
+        
+        const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+        
+        let isSecretLeak = false;
+        if (!license.isPro && result.tokenMap) {
+          Object.entries(result.tokenMap).forEach(([token, original]) => {
+            for (const detector of DEVOPS_SECRETS_DETECTOR) {
+              detector.regex.lastIndex = 0;
+              if (detector.regex.test(original)) {
+                isSecretLeak = true;
+                break;
+              }
+            }
+          });
+        }
+
+        const counts = {};
+        Object.keys(localSessionMap).forEach(token => {
+          const match = token.match(/^\[([A-Z_]+)_\d+\]$/);
+          if (match) {
+            counts[match[1]] = (counts[match[1]] || 0) + 1;
+          }
+        });
+        const summary = Object.entries(counts).map(([type, count]) => `${count} ${type}`).join(', ') || 'None';
+        
+        if (dry_run) {
+          return {
+            content: [{ 
+              type: "text", 
+              text: `DRY RUN: ⚠️ Would redact ${Object.keys(localSessionMap).length} tokens (${summary}).\n${isSecretLeak ? "⚠️ RAW SECRET DETECTED (Requires PRO to actually redact)\n" : ""}Run again with dry_run: false to apply changes.` 
+            }]
+          };
+        }
+
+        if (isSecretLeak) {
+          return { isError: true, content: [{ type: "text", text: `Error: API Key or Secret detected. Sanitization of raw secrets requires PRO Profile. Upgrade at https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal` }] };
+        }
+
+        if (!no_backup) {
+          fs.writeFileSync(`${file_path}.bak`, content, 'utf8');
+        }
+
+        fs.writeFileSync(file_path, result.scrubbedText, 'utf8');
+
+        return {
+          content: [{ 
+            type: "text", 
+            text: `✅ File successfully redacted.\nReplaced ${Object.keys(localSessionMap).length} tokens (${summary}).\n${!no_backup ? `Backup saved to ${file_path}.bak` : "No backup created (no_backup=true)."}` 
+          }]
+        };
+
+      } catch (err) {
+        return { isError: true, content: [{ type: "text", text: `Error redacting file: ${err.message}` }] };
+      }
+    }
+
     if (name === "create_default_config") {
       const configPath = path.resolve(process.cwd(), 'privacyscrubber.json');
       if (fs.existsSync(configPath)) {
@@ -642,7 +862,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       const defaultTemplate = {
-        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config",
+        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config?utm_source=mcp_cli&utm_medium=terminal",
         "customRules": [
           {
             "pattern": "my-secret-pattern-\\d+",
@@ -691,7 +911,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const profileList = license.isPro
         ? 'All 23 profiles active (General, Dev, Medical, Legal, Finance, HR…)'
         : 'General only — PRO unlocks 22 industry profiles';
-      const sizeLimit = license.isPro ? 'Unlimited' : '50,000 characters per request';
+      const sizeLimit = license.isPro ? 'Unlimited' : '15,000 characters per request';
 
       const configPath = resolveConfigPath();
       let rulesStatus = '';
@@ -737,12 +957,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         lines.push(
           '║  ✅ PRO is active. All features unlocked.         ║',
           '║     To regenerate your key or manage billing:     ║',
-          '║     https://privacyscrubber.com/pricing           ║'
+          '║     https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal           ║'
         );
       } else {
         lines.push(
           '║  💳 Upgrade to PRO — $110 Lifetime                ║',
-          '║     https://privacyscrubber.com/pricing           ║',
+          '║     https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal           ║',
           '╠══════════════════════════════════════════════════╣',
           '║  After purchase, add your key to MCP config:     ║',
           '║                                                  ║',
@@ -750,7 +970,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           '║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║',
           '║                                                  ║',
           '║  Full setup guide:                               ║',
-          '║  https://privacyscrubber.com/features/mcp/       ║'
+          '║  https://privacyscrubber.com/features/mcp/?utm_source=mcp_cli&utm_medium=terminal       ║'
         );
       }
 
@@ -761,6 +981,92 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "audit_directory_for_pii") {
+      const { directory_path, profile, extensions, ignore_node_modules } = args;
+      if (!directory_path || !fs.existsSync(directory_path)) {
+        return { isError: true, content: [{ type: "text", text: `Error: Directory not found at path: ${directory_path}` }] };
+      }
+
+      const filesToScan = [];
+      const ignoreDirs = ignore_node_modules !== false ? ['.git', 'node_modules', '.next', 'dist', 'build', '.cache'] : ['.git'];
+      
+      async function walkDir(dir) {
+        const entries = await fs.promises.readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+          const fullPath = path.join(dir, entry.name);
+          if (entry.isDirectory()) {
+            if (!ignoreDirs.includes(entry.name)) await walkDir(fullPath);
+          } else if (entry.isFile()) {
+            if (extensions && extensions.length > 0) {
+              const ext = path.extname(entry.name);
+              if (!extensions.includes(ext)) continue;
+            }
+            filesToScan.push(fullPath);
+          }
+        }
+      }
+
+      await walkDir(directory_path);
+
+      let reportLines = [`## Security Audit Report: ${directory_path}`];
+      let filesWithIssues = 0;
+      const customRules = loadCustomRules();
+      const normalizedProfile = (profile || "general").trim().toLowerCase();
+      const license = checkLicenseStatus();
+
+      for (const file of filesToScan) {
+        try {
+          const stat = await fs.promises.stat(file);
+          if (stat.size > 10 * 1024 * 1024) continue; // skip >10MB
+
+          const buffer = fs.readFileSync(file);
+          // basic binary check
+          if (buffer.indexOf(0) !== -1) continue; 
+          const content = buffer.toString('utf8');
+
+          const localSessionMap = {};
+          const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+          
+          let isSecretLeak = false;
+          if (!license.isPro && result.tokenMap) {
+            Object.entries(result.tokenMap).forEach(([token, original]) => {
+              for (const detector of DEVOPS_SECRETS_DETECTOR) {
+                detector.regex.lastIndex = 0;
+                if (detector.regex.test(original)) {
+                  isSecretLeak = true;
+                  break;
+                }
+              }
+            });
+          }
+
+          if (Object.keys(localSessionMap).length > 0 || isSecretLeak) {
+            filesWithIssues++;
+            const counts = {};
+            Object.keys(localSessionMap).forEach(token => {
+              const match = token.match(/^\[([A-Z_]+)_\d+\]$/);
+              if (match) {
+                counts[match[1]] = (counts[match[1]] || 0) + 1;
+              }
+            });
+            const summary = Object.entries(counts).map(([type, count]) => `${count} ${type}`).join(', ');
+            let leakMsg = isSecretLeak ? " (⚠️ RAW SECRET DETECTED — REQUIRES PRO)" : "";
+            reportLines.push(`- \`${path.relative(directory_path, file)}\`: ⚠️ Found ${summary}${leakMsg}`);
+          }
+        } catch (err) {
+          // ignore file read errors
+        }
+      }
+
+      if (filesWithIssues === 0) {
+        reportLines.push("✅ Clean. No PII or secrets detected in the scanned files.");
+      }
+
+      return {
+        content: [{ type: "text", text: reportLines.join('\n') }]
+      };
+    }
+
     return {
       isError: true,
       content: [{ type: "text", text: `Unknown tool: ${name}` }]
@@ -831,11 +1137,11 @@ function loadCustomRules() {
             category: (r.label || r.category || "CUSTOM").toUpperCase()
           })).filter(r => r.pattern);
         } else {
-          process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.${colors.reset}\n`);
+          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.${colors.reset}\n`);
         }
       }
     } catch (e) {
-      process.stderr.write(`Error parsing privacyscrubber.json: ${e.message}\n`);
+      mcpLog(`Error parsing privacyscrubber.json: ${e.message}\n`);
     }
   }
   return [];
@@ -857,28 +1163,8 @@ function detectSecrets(text) {
 function performSanitization(text, profile) {
   const customRules = loadCustomRules();
   const normalizedProfile = (profile || "general").trim().toLowerCase();
-  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap);
-  
   const license = checkLicenseStatus();
-  if (!license.isPro && result.tokenMap) {
-    // Re-scan each masked token's original value against the shared detector.
-    // If it was a raw secret, restore it in the output and remove from sessionMap
-    // so it is never accidentally revealed by reveal_text.
-    Object.entries(result.tokenMap).forEach(([token, original]) => {
-      let isSecret = false;
-      for (const detector of DEVOPS_SECRETS_DETECTOR) {
-        detector.regex.lastIndex = 0;
-        if (detector.regex.test(original)) {
-          isSecret = true;
-          break;
-        }
-      }
-      if (isSecret) {
-        result.scrubbedText = result.scrubbedText.replace(token, original);
-        delete result.tokenMap[token];
-      }
-    });
-  }
+  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap, license.isPro);
 
   // Update our volatile map with new matches
   if (result.tokenMap) {
@@ -890,11 +1176,10 @@ function performSanitization(text, profile) {
   return result.scrubbedText;
 }
 
-function truncateIfFree(text, isPro) {
-  const MAX_FREE_CHARS = 50000;
-  if (!isPro && text.length > MAX_FREE_CHARS) {
-    process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
-    return { processedText: text.substring(0, MAX_FREE_CHARS), wasTruncated: true };
+function truncateIfFree(text, isPro, charLimit = 15000) {
+  if (!isPro && text.length > charLimit) {
+    mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${charLimit.toLocaleString()} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
+    return { processedText: text.substring(0, charLimit), wasTruncated: true };
   }
   return { processedText: text, wasTruncated: false };
 }
@@ -902,8 +1187,8 @@ function truncateIfFree(text, isPro) {
 // Start the server transport
 const transport = new StdioServerTransport();
 server.connect(transport).then(() => {
-  process.stderr.write(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server started successfully.${colors.reset}\n`);
-  process.stderr.write(`${colors.cyan}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
+  mcpLog(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server started successfully.${colors.reset}\n`);
+  mcpLog(`${colors.cyan}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
 }).catch((error) => {
   console.error("Failed to connect MCP server transport:", error);
   process.exit(1);