@privacyscrubber/mcp-server 1.7.1 → 1.7.2

package/README.md

@@ -148,7 +148,7 @@ Reads a local file, extracts text, sanitizes it, and returns the redacted templa
 
 Looking for real-time protection directly inside your web browser?
 *   **Chrome Extension:** Get the [PrivacyScrubber Chrome Extension](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol) to sanitize prompts directly inside ChatGPT, Claude, and Gemini in real-time.
-*   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/).
+*   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server).
 
 ## 📄 License & Commercial Upgrade
 
@@ -166,7 +166,7 @@ By default, the server runs under the **Free Tier** (restricted to 50,000 charac
 | **Team Rules Sync (GPO)** | ❌ No | ❌ No | ✅ Yes (Shared Link) |
 | **Licensing Cost** | $0 | **$110 Lifetime** | **$99/mo Flat Rate** |
 
-👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)**
+👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server)**
 
 ---
 
@@ -195,12 +195,12 @@ Returns a visual dashboard showing your current tier, session request count, act
     ║  📋 Custom rules: 🔒 Locked — requires PRO       ║
     ╠══════════════════════════════════════════════════╣
     ║  💳 Upgrade to PRO — $110 Lifetime               ║
-    ║     https://privacyscrubber.com/pricing          ║
+    ║     https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server          ║
     ╠══════════════════════════════════════════════════╣
     ║  After purchase, add your key to MCP config:     ║
     ║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║
     ║  Full setup guide:                               ║
-    ║  https://privacyscrubber.com/features/mcp/       ║
+    ║  https://privacyscrubber.com/features/mcp/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server       ║
     ╚══════════════════════════════════════════════════╝
     ```
 
@@ -208,7 +208,7 @@ Returns a visual dashboard showing your current tier, session request count, act
 
 ## 🔐 After Purchase: Activate PRO in Your MCP Client
 
-After purchasing a PRO license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing), you will receive a license key. Add it to your MCP client config as an environment variable: `PRIVACYSCRUBBER_KEY`.
+After purchasing a PRO license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server), you will receive a license key. Add it to your MCP client config as an environment variable: `PRIVACYSCRUBBER_KEY`.
 
 ### Claude Desktop
 

package/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// LicenseManager will be required below
 
 /**
  * PrivacyScrubber MCP Server
@@ -36,6 +37,7 @@ const MCP_VERSION = require('./package.json').version;
 // Import the production core engine with 100% parity
 const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
 const PrivacyScrubberCore = require(scrubberCorePath);
+const LicenseManager = require('./ps-license-manager.js');
 
 // Initialize core engine
 PrivacyScrubberCore.init();
@@ -74,83 +76,31 @@ const DEVOPS_SECRETS_DETECTOR = [
   { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
 ];
 
-// Hardcoded public key for offline cryptographic verification
-const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqN700s8jMq9Rf09prTPB
-ekrFTXi+mnzSgMzwy+rMrJ4kyZQRDTxSFO1d9r5JQIhHfK5ToPiiS/Z/AS+Ga5bb
-BCy50SORDRn1HzrvFjNP+kogYyOeFk2lWw0Lt4/mX3M98zRE2D1HBDQJF8Y5Y/6l
-735iwlF6T1oO0mEbb1FM5tKvO44OkTih7krc3w56R07S1WuYIhGLR6IfDbNU/drL
-nbhUR4HqBRepIsn9mcSODw/FP5t3QlFLfDvZo/1SIUSBa9NowhPtPk0Hq3hndSvR
-pXkyvjeA7HLyXU8hhvausn85QRdEYTMXP9BehDjhli4VELSAY3ARGzemcUgggejg
-CwIDAQAB
------END PUBLIC KEY-----`;
-
 function checkLicenseStatus() {
   const key = (process.env.PRIVACYSCRUBBER_KEY || "").trim();
   if (!key) return { isPro: false, type: null, error: "No license key provided." };
 
-  try {
-    const [payloadBase64, signatureBase64] = key.split('.');
-    if (!payloadBase64 || !signatureBase64) {
-      return { isPro: false, type: null, error: "Invalid license key structure." };
-    }
-
-    const verifier = crypto.createVerify('SHA256');
-    verifier.update(payloadBase64);
-    const isVerified = verifier.verify(PUBLIC_KEY, signatureBase64, 'base64');
-    
-    if (!isVerified) {
-      return { isPro: false, type: null, error: "Signature verification failed." };
-    }
-
-    const payload = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
-    
-    // Expiration check
-    if (payload.expires && payload.expires < Math.floor(Date.now() / 1000)) {
-      return { 
-        isPro: false, 
-        type: payload.type, 
-        error: `License expired on ${new Date(payload.expires * 1000).toLocaleDateString()}` 
-      };
-    }
-
-    return { isPro: true, type: payload.type, error: null };
-  } catch (e) {
-    return { isPro: false, type: null, error: "Error parsing license: " + e.message };
+  const result = LicenseManager.validate(key);
+  
+  if (!result.valid) {
+    return { isPro: false, type: null, error: result.reason || "Invalid license format or signature." };
   }
+
+  return { isPro: true, type: result.tier, error: null };
 }
 
 // ── Session request counter (volatile in-memory) ─────────────────────────────
 let sessionRequestCount = 0;
 const UPSELL_EVERY_N = 10; // show upsell nudge every N free-tier requests
 
-// Build a clean upsell content block visible to the agent / user
+// Build a clean upsell content block (Disabled to prevent agent-visible marketing content)
 function buildUpsellBlock(reason) {
-  const count = sessionRequestCount;
-  let lines = [
-    '─────────────────────────────────────────────',
-    '⚡ PrivacyScrubber PRO — Upgrade your AI setup',
-    '─────────────────────────────────────────────',
-  ];
-  if (reason) lines.push(`ℹ️  ${reason}`);
-  lines.push(
-    `📊 Free session requests: ${count}`,
-    '🔒 PRO unlocks: 22 industry profiles (Dev, Medical, Legal…)',
-    '         + Custom regex rules (privacyscrubber.json)',
-    '         + Unlimited input size',
-    '',
-    '💳 PRO Lifetime: $110  →  https://privacyscrubber.com/pricing',
-    '',
-    'After purchase, add your key to your MCP config:',
-    '  "PRIVACYSCRUBBER_KEY": "<your-key-here>"',
-    '─────────────────────────────────────────────'
-  );
-  return { type: 'text', text: lines.join('\n') };
+  return null;
 }
 
-// Decide if we should attach a soft periodic nudge (every N requests, free tier)
+// Decide if we should attach a soft periodic nudge (Disabled to maintain clean MCP output)
 function shouldNudge(isPro) {
-  return !isPro && sessionRequestCount > 0 && sessionRequestCount % UPSELL_EVERY_N === 0;
+  return false;
 }
 
 // Create the MCP server
@@ -437,27 +387,25 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       sessionRequestCount++;
 
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
       if (isAdvanced && !license.isPro) {
-        if (text.length > 5000) {
-          const reason = license.error ? ` (${license.error})` : "";
-          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' on Free tier is limited to 5,000 chars. Falling back to 'General'.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          finalProfile = "General";
-          extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' on Free tier is limited to 5,000 chars. Upgrade to PRO for unlimited scanning.`));
-        } else {
-          mcpLog(`${colors.cyan}ℹ️  [PrivacyScrubber] Profile '${targetProfile}' active (Free tier: up to 5,000 chars).${colors.reset}\n`);
-        }
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
       }
 
-      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro);
+      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro, charLimit);
       if (wasTruncated) {
-        extraBlocks.push(buildUpsellBlock(`Input was truncated to 50,000 characters (Free Tier limit).`));
+        extraBlocks.push(buildUpsellBlock(`Input was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
       }
 
       if (!license.isPro) {
         const detected = detectSecrets(processedText);
         if (detected.length > 0) {
-          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+          mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
         }
       }
 
@@ -471,7 +419,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       return {
         content: [
           { type: "text", text: sanitized },
-          ...extraBlocks
+          ...extraBlocks.filter(Boolean)
         ]
       };
     }
@@ -586,21 +534,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           sessionRequestCount++;
 
+          const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
           if (isAdvanced && !license.isPro) {
-            const reason = license.error ? ` (${license.error})` : "";
-            mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-            finalProfile = "General";
-            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
           }
 
-          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
           if (!license.isPro) {
             const detected = detectSecrets(processedContent);
             if (detected.length > 0) {
-              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              return {
+                isError: true,
+                content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+              };
             }
           }
 
@@ -613,7 +563,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           return {
             content: [
               { type: "text", text: sanitized },
-              ...extraBlocks
+              ...extraBlocks.filter(Boolean)
             ]
           };
         } catch (docxError) {
@@ -637,7 +587,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             content: [
               {
                 type: "text",
-                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing`
+                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal`
               }
             ]
           };
@@ -656,21 +606,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
             sessionRequestCount++;
 
+            const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
             if (isAdvanced && !license.isPro) {
-              const reason = license.error ? ` (${license.error})` : "";
-              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              finalProfile = "General";
-              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
             }
 
-            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+                mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+                return {
+                  isError: true,
+                  content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+                };
               }
             }
 
@@ -683,7 +635,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             return {
               content: [
                 { type: "text", text: sanitized },
-                ...extraBlocks
+                ...extraBlocks.filter(Boolean)
               ]
             };
           } catch (pdfError) {
@@ -713,21 +665,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
             sessionRequestCount++;
 
+            const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
             if (isAdvanced && !license.isPro) {
-              const reason = license.error ? ` (${license.error})` : "";
-              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              finalProfile = "General";
-              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
             }
 
-            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+                mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+                return {
+                  isError: true,
+                  content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+                };
               }
             }
 
@@ -740,7 +694,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             return {
               content: [
                 { type: "text", text: sanitized },
-                ...extraBlocks
+                ...extraBlocks.filter(Boolean)
               ]
             };
           } catch (xlsxError) {
@@ -784,21 +738,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       sessionRequestCount++;
 
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
       if (isAdvanced && !license.isPro) {
-        const reason = license.error ? ` (${license.error})` : "";
-        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-        finalProfile = "General";
-        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
       }
 
-      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro);
-      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro, charLimit);
+      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
       if (!license.isPro) {
         const detected = detectSecrets(processedContent2);
         if (detected.length > 0) {
-          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+          mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
         }
       }
 
@@ -811,7 +767,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       return {
         content: [
           { type: "text", text: sanitized },
-          ...extraBlocks
+          ...extraBlocks.filter(Boolean)
         ]
       };
     }
@@ -873,7 +829,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
 
         if (isSecretLeak) {
-          return { isError: true, content: [{ type: "text", text: `Error: API Key or Secret detected. Sanitization of raw secrets requires PRO Profile. Upgrade at https://privacyscrubber.com/pricing` }] };
+          return { isError: true, content: [{ type: "text", text: `Error: API Key or Secret detected. Sanitization of raw secrets requires PRO Profile. Upgrade at https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal` }] };
         }
 
         if (!no_backup) {
@@ -906,7 +862,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       const defaultTemplate = {
-        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config",
+        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config?utm_source=mcp_cli&utm_medium=terminal",
         "customRules": [
           {
             "pattern": "my-secret-pattern-\\d+",
@@ -955,7 +911,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const profileList = license.isPro
         ? 'All 23 profiles active (General, Dev, Medical, Legal, Finance, HR…)'
         : 'General only — PRO unlocks 22 industry profiles';
-      const sizeLimit = license.isPro ? 'Unlimited' : '50,000 characters per request';
+      const sizeLimit = license.isPro ? 'Unlimited' : '15,000 characters per request';
 
       const configPath = resolveConfigPath();
       let rulesStatus = '';
@@ -1001,12 +957,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         lines.push(
           '║  ✅ PRO is active. All features unlocked.         ║',
           '║     To regenerate your key or manage billing:     ║',
-          '║     https://privacyscrubber.com/pricing           ║'
+          '║     https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal           ║'
         );
       } else {
         lines.push(
           '║  💳 Upgrade to PRO — $110 Lifetime                ║',
-          '║     https://privacyscrubber.com/pricing           ║',
+          '║     https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal           ║',
           '╠══════════════════════════════════════════════════╣',
           '║  After purchase, add your key to MCP config:     ║',
           '║                                                  ║',
@@ -1014,7 +970,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           '║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║',
           '║                                                  ║',
           '║  Full setup guide:                               ║',
-          '║  https://privacyscrubber.com/features/mcp/       ║'
+          '║  https://privacyscrubber.com/features/mcp/?utm_source=mcp_cli&utm_medium=terminal       ║'
         );
       }
 
@@ -1209,25 +1165,6 @@ function performSanitization(text, profile) {
   const normalizedProfile = (profile || "general").trim().toLowerCase();
   const license = checkLicenseStatus();
   const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap, license.isPro);
-  if (!license.isPro && result.tokenMap) {
-    // Re-scan each masked token's original value against the shared detector.
-    // If it was a raw secret, restore it in the output and remove from sessionMap
-    // so it is never accidentally revealed by reveal_text.
-    Object.entries(result.tokenMap).forEach(([token, original]) => {
-      let isSecret = false;
-      for (const detector of DEVOPS_SECRETS_DETECTOR) {
-        detector.regex.lastIndex = 0;
-        if (detector.regex.test(original)) {
-          isSecret = true;
-          break;
-        }
-      }
-      if (isSecret) {
-        result.scrubbedText = result.scrubbedText.replace(token, original);
-        delete result.tokenMap[token];
-      }
-    });
-  }
 
   // Update our volatile map with new matches
   if (result.tokenMap) {
@@ -1239,11 +1176,10 @@ function performSanitization(text, profile) {
   return result.scrubbedText;
 }
 
-function truncateIfFree(text, isPro) {
-  const MAX_FREE_CHARS = 5000;
-  if (!isPro && text.length > MAX_FREE_CHARS) {
-    mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
-    return { processedText: text.substring(0, MAX_FREE_CHARS), wasTruncated: true };
+function truncateIfFree(text, isPro, charLimit = 15000) {
+  if (!isPro && text.length > charLimit) {
+    mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${charLimit.toLocaleString()} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
+    return { processedText: text.substring(0, charLimit), wasTruncated: true };
   }
   return { processedText: text, wasTruncated: false };
 }

package/install.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+
+console.log('🛡️ PrivacyScrubber MCP Server 1-Click Installer');
+console.log('================================================\n');
+
+const mcpConfig = {
+  command: "npx",
+  args: ["-y", "@privacyscrubber/mcp-server"]
+};
+
+let claudeConfigPath = '';
+if (process.platform === 'darwin') {
+  claudeConfigPath = path.join(os.homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+} else if (process.platform === 'win32') {
+  claudeConfigPath = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json');
+} else {
+  // Linux fallback, though Claude Desktop is not officially supported on Linux yet, we check common paths
+  claudeConfigPath = path.join(os.homedir(), '.config', 'Claude', 'claude_desktop_config.json');
+}
+
+// 1. Configure Claude Desktop
+let installedClaude = false;
+try {
+  let configDir = path.dirname(claudeConfigPath);
+  if (!fs.existsSync(configDir)) {
+    fs.mkdirSync(configDir, { recursive: true });
+  }
+
+  let config = {};
+  if (fs.existsSync(claudeConfigPath)) {
+    const rawData = fs.readFileSync(claudeConfigPath, 'utf8');
+    if (rawData.trim() !== '') {
+      config = JSON.parse(rawData);
+    }
+  }
+
+  if (!config.mcpServers) {
+    config.mcpServers = {};
+  }
+
+  config.mcpServers['privacyscrubber'] = mcpConfig;
+
+  fs.writeFileSync(claudeConfigPath, JSON.stringify(config, null, 2), 'utf8');
+  console.log(`✅ [Claude Desktop] Successfully injected PrivacyScrubber MCP into:`);
+  console.log(`   ${claudeConfigPath}`);
+  installedClaude = true;
+} catch (e) {
+  console.log(`⚠️ [Claude Desktop] Could not configure automatically: ${e.message}`);
+}
+
+console.log('\n---');
+console.log('\n🔵 [Cursor / Windsurf Users]');
+console.log('To install PrivacyScrubber in Cursor or Windsurf:');
+console.log('1. Open Settings -> Features -> MCP Servers (or type "MCP" in settings).');
+console.log('2. Click "+ Add New MCP Server".');
+console.log('3. Set Name: privacyscrubber');
+console.log('4. Set Type: command');
+console.log('5. Set Command: npx -y @privacyscrubber/mcp-server');
+console.log('\n🚀 Installation complete! Restart your IDE or Claude Desktop to start redacting PII locally.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",
@@ -10,6 +10,7 @@
   },
   "files": [
     "index.js",
+    "install.js",
     "pii-masking-run.js",
     "scrubber-core.cjs",
     "smithery.yaml",
@@ -21,7 +22,8 @@
   "bin": {
     "mcp-server": "index.js",
     "privacyscrubber-mcp": "index.js",
-    "pii-masking-run": "pii-masking-run.js"
+    "pii-masking-run": "pii-masking-run.js",
+    "privacyscrubber-mcp-install": "install.js"
   },
   "scripts": {
     "start": "node index.js"
@@ -57,7 +59,7 @@
   ],
   "author": "Ilya Sibiryakov (BrandMeWeb)",
   "license": "MIT",
-  "homepage": "https://privacyscrubber.com/pii-mcp/",
+  "homepage": "https://privacyscrubber.com/pii-mcp/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/moxno/privacyscrubber-mcp.git"

package/pii-masking-run.js

@@ -190,12 +190,12 @@ function performSanitization(text) {
       }
       if (isSecret) {
         hasSecrets = true;
-        result.scrubbedText = result.scrubbedText.replace(token, original);
+        result.scrubbedText = result.scrubbedText.replace(token, '[SECRET_BLOCKED_UPGRADE_TO_PRO]');
       }
     });
 
     if (hasSecrets) {
-      process.stderr.write(`${colors.yellowBold}⚠️  [PrivacyScrubber] Secrets/Keys detected in output. Redaction skipped (Requires PRO tier).${colors.reset}\n`);
+      process.stderr.write(`\x1b[1;31m🚫  [PrivacyScrubber] Secrets/Keys detected in output. Replaced with [SECRET_BLOCKED_UPGRADE_TO_PRO] to protect your data (Requires PRO tier).\x1b[0m\n`);
     }
   }