@privacyscrubber/mcp-server 1.7.1 → 1.7.6

package/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// LicenseManager will be required below
 
 /**
  * PrivacyScrubber MCP Server
@@ -36,6 +37,10 @@ const MCP_VERSION = require('./package.json').version;
 // Import the production core engine with 100% parity
 const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
 const PrivacyScrubberCore = require(scrubberCorePath);
+let LicenseManager = require('./ps-license-manager.js');
+if (!LicenseManager || typeof LicenseManager.validate !== 'function') {
+  LicenseManager = global.LicenseManager;
+}
 
 // Initialize core engine
 PrivacyScrubberCore.init();
@@ -74,83 +79,160 @@ const DEVOPS_SECRETS_DETECTOR = [
   { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
 ];
 
-// Hardcoded public key for offline cryptographic verification
-const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqN700s8jMq9Rf09prTPB
-ekrFTXi+mnzSgMzwy+rMrJ4kyZQRDTxSFO1d9r5JQIhHfK5ToPiiS/Z/AS+Ga5bb
-BCy50SORDRn1HzrvFjNP+kogYyOeFk2lWw0Lt4/mX3M98zRE2D1HBDQJF8Y5Y/6l
-735iwlF6T1oO0mEbb1FM5tKvO44OkTih7krc3w56R07S1WuYIhGLR6IfDbNU/drL
-nbhUR4HqBRepIsn9mcSODw/FP5t3QlFLfDvZo/1SIUSBa9NowhPtPk0Hq3hndSvR
-pXkyvjeA7HLyXU8hhvausn85QRdEYTMXP9BehDjhli4VELSAY3ARGzemcUgggejg
-CwIDAQAB
------END PUBLIC KEY-----`;
-
 function checkLicenseStatus() {
   const key = (process.env.PRIVACYSCRUBBER_KEY || "").trim();
   if (!key) return { isPro: false, type: null, error: "No license key provided." };
 
+  const result = LicenseManager.validate(key);
+  
+  if (!result.valid) {
+    mcpLog(`DEBUG: License invalid because: ${result.reason || "Unknown"}`);
+    return { isPro: false, type: null, error: result.reason || "Invalid license format or signature." };
+  }
+
+  return { isPro: true, type: result.tier, error: null };
+}
+
+// ── Free Tier Usage Tracking (Persistent) ─────────────────────────────
+const FREE_TIER_DAILY_LIMIT = 10;
+const STAR_PROMPT_THRESHOLD = 5;
+
+function getUsageFilePath() {
+  const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+  return path.resolve(homeDir, '.privacyscrubber-usage.json');
+}
+
+function getDailyUsage() {
+  const file = getUsageFilePath();
+  const today = new Date().toISOString().split('T')[0];
+  if (!fs.existsSync(file)) return 0;
   try {
-    const [payloadBase64, signatureBase64] = key.split('.');
-    if (!payloadBase64 || !signatureBase64) {
-      return { isPro: false, type: null, error: "Invalid license key structure." };
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (data.date === today) {
+      return data.count || 0;
     }
+  } catch (e) {}
+  return 0;
+}
 
-    const verifier = crypto.createVerify('SHA256');
-    verifier.update(payloadBase64);
-    const isVerified = verifier.verify(PUBLIC_KEY, signatureBase64, 'base64');
-    
-    if (!isVerified) {
-      return { isPro: false, type: null, error: "Signature verification failed." };
+function incrementDailyUsage() {
+  const file = getUsageFilePath();
+  const today = new Date().toISOString().split('T')[0];
+  let count = 0;
+  if (fs.existsSync(file)) {
+    try {
+      const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (data.date === today) count = data.count || 0;
+    } catch (e) {}
+  }
+  count++;
+  try {
+    fs.writeFileSync(file, JSON.stringify({ date: today, count }), 'utf8');
+  } catch (e) {}
+  return count;
+}
+
+function checkFreeTierLimit(isPro) {
+  if (isPro) return { blocked: false, count: 0 };
+  
+  const count = incrementDailyUsage();
+  // Feedback / Growth loop triggers
+  if (count === 3) {
+    mcpLog(`${colors.cyan}💬 We are building the ultimate privacy tool for developers. What feature should we add next? Let us know: https://privacyscrubber.com/feedback${colors.reset}\n`);
+  }
+  if (count === STAR_PROMPT_THRESHOLD) {
+    mcpLog(`${colors.yellowBold}🔒 PrivacyScrubber is running securely. If this tool saved your PII today, please drop a star on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
+  }
+  
+  if (count >= FREE_TIER_DAILY_LIMIT) {
+    mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Request BLOCKED.${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing${colors.reset}\n`);
+    return { blocked: true, count };
+  }
+  
+  return { blocked: false, count };
+}
+
+function buildCisoAuditTelemetry(currentTokenMap = {}) {
+    const entities = {};
+    let totalCount = 0;
+
+    if (currentTokenMap && typeof currentTokenMap === 'object') {
+        const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
+        for (const t of keys) {
+            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
+            entities[baseType] = (entities[baseType] || 0) + 1;
+            totalCount++;
+        }
     }
 
-    const payload = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
-    
-    // Expiration check
-    if (payload.expires && payload.expires < Math.floor(Date.now() / 1000)) {
-      return { 
-        isPro: false, 
-        type: payload.type, 
-        error: `License expired on ${new Date(payload.expires * 1000).toLocaleDateString()}` 
-      };
+    const types = Object.keys(entities);
+    let riskLevel = 'LOW EXPOSURE';
+
+    if (totalCount > 0) {
+        const hasHighRiskEntities = types.some(t => ['ID', 'SSN', 'CREDIT_CARD', 'PASSPORT', 'BANK', 'API_KEY', 'SECRET', 'PASSWORD', 'MRN', 'KEY'].includes(t));
+        if (hasHighRiskEntities || types.length >= 3 || totalCount >= 10) {
+            riskLevel = 'CRITICAL (HIGH EXPOSURE)';
+        } else if (types.length >= 2 || totalCount >= 3) {
+            riskLevel = 'MODERATE EXPOSURE';
+        } else {
+            riskLevel = 'LOW EXPOSURE';
+        }
+    } else {
+        riskLevel = 'CLEAN (ZERO PII)';
     }
 
-    return { isPro: true, type: payload.type, error: null };
-  } catch (e) {
-    return { isPro: false, type: null, error: "Error parsing license: " + e.message };
-  }
+    const frameworksSet = new Set(['ZTDS Standard']);
+    if (types.includes('NAME') || types.includes('EMAIL') || types.includes('PHONE')) {
+        frameworksSet.add('GDPR (Art. 4)');
+        frameworksSet.add('CCPA/CPRA');
+    }
+    if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT')) {
+        frameworksSet.add('SOC 2 Type II');
+        frameworksSet.add('ISO 27001 (A.8.11)');
+    }
+    if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD'].includes(t))) {
+        frameworksSet.add('PCI DSS v4.0');
+    }
+    if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT'].includes(t))) {
+        frameworksSet.add('HIPAA §164.514');
+    }
+    if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY'].includes(t))) {
+        frameworksSet.add('NIST SP 800-53');
+    }
+
+    return {
+        totalCount,
+        entities,
+        types,
+        riskLevel,
+        frameworksList: Array.from(frameworksSet)
+    };
 }
 
-// ── Session request counter (volatile in-memory) ─────────────────────────────
-let sessionRequestCount = 0;
-const UPSELL_EVERY_N = 10; // show upsell nudge every N free-tier requests
+function formatAuditReceipt(telemetry) {
+  if (telemetry.totalCount === 0) {
+    return "\\n\\n> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\\n";
+  }
+  
+  const entitiesList = Object.entries(telemetry.entities)
+    .map(([type, count]) => `${count} ${type}`)
+    .join(', ');
+
+  const icon = telemetry.riskLevel.includes('CRITICAL') ? '🔴' : (telemetry.riskLevel.includes('MODERATE') ? '🟠' : '🟢');
 
-// Build a clean upsell content block visible to the agent / user
+  return `\\n\\n> 🛡️ **PrivacyScrubber Audit Receipt**\\n> * **Risk Level:** ${icon} ${telemetry.riskLevel}\\n> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\\n> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\\n`;
+}
+
+// Build a clean upsell content block (Disabled to prevent agent-visible marketing content)
 function buildUpsellBlock(reason) {
-  const count = sessionRequestCount;
-  let lines = [
-    '─────────────────────────────────────────────',
-    '⚡ PrivacyScrubber PRO — Upgrade your AI setup',
-    '─────────────────────────────────────────────',
-  ];
-  if (reason) lines.push(`ℹ️  ${reason}`);
-  lines.push(
-    `📊 Free session requests: ${count}`,
-    '🔒 PRO unlocks: 22 industry profiles (Dev, Medical, Legal…)',
-    '         + Custom regex rules (privacyscrubber.json)',
-    '         + Unlimited input size',
-    '',
-    '💳 PRO Lifetime: $110  →  https://privacyscrubber.com/pricing',
-    '',
-    'After purchase, add your key to your MCP config:',
-    '  "PRIVACYSCRUBBER_KEY": "<your-key-here>"',
-    '─────────────────────────────────────────────'
-  );
-  return { type: 'text', text: lines.join('\n') };
+  return null;
 }
 
-// Decide if we should attach a soft periodic nudge (every N requests, free tier)
+// Decide if we should attach a soft periodic nudge (Disabled to maintain clean MCP output)
 function shouldNudge(isPro) {
-  return !isPro && sessionRequestCount > 0 && sessionRequestCount % UPSELL_EVERY_N === 0;
+  return false;
 }
 
 // Create the MCP server
@@ -435,43 +517,45 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       let finalProfile = targetProfile;
       const extraBlocks = [];
 
-      sessionRequestCount++;
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+        };
+      }
 
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
       if (isAdvanced && !license.isPro) {
-        if (text.length > 5000) {
-          const reason = license.error ? ` (${license.error})` : "";
-          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' on Free tier is limited to 5,000 chars. Falling back to 'General'.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          finalProfile = "General";
-          extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' on Free tier is limited to 5,000 chars. Upgrade to PRO for unlimited scanning.`));
-        } else {
-          mcpLog(`${colors.cyan}ℹ️  [PrivacyScrubber] Profile '${targetProfile}' active (Free tier: up to 5,000 chars).${colors.reset}\n`);
-        }
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
       }
 
-      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro);
+      const { processedText, wasTruncated } = truncateIfFree(text, license.isPro, charLimit);
       if (wasTruncated) {
-        extraBlocks.push(buildUpsellBlock(`Input was truncated to 50,000 characters (Free Tier limit).`));
+        extraBlocks.push(buildUpsellBlock(`Input was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
       }
 
       if (!license.isPro) {
         const detected = detectSecrets(processedText);
         if (detected.length > 0) {
-          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+          mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
         }
       }
 
-      const sanitized = performSanitization(processedText, finalProfile);
-
-      // Periodic soft nudge every N free-tier requests (no trigger event needed)
-      if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
-        extraBlocks.push(buildUpsellBlock(null));
-      }
+      const { scrubbedText, newTokens } = performSanitization(processedText, finalProfile);
+      
+      const telemetry = buildCisoAuditTelemetry(newTokens);
+      const receiptMd = formatAuditReceipt(telemetry);
 
       return {
         content: [
-          { type: "text", text: sanitized },
-          ...extraBlocks
+          { type: "text", text: scrubbedText + receiptMd },
+          ...extraBlocks.filter(Boolean)
         ]
       };
     }
@@ -584,36 +668,44 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           let finalProfile = targetProfile;
           const extraBlocks = [];
 
-          sessionRequestCount++;
+          const limitStatus = checkFreeTierLimit(license.isPro);
+          if (limitStatus.blocked) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+            };
+          }
 
+          const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
           if (isAdvanced && !license.isPro) {
-            const reason = license.error ? ` (${license.error})` : "";
-            mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-            finalProfile = "General";
-            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+            mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+            extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
           }
 
-          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+          const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+          if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
           if (!license.isPro) {
             const detected = detectSecrets(processedContent);
             if (detected.length > 0) {
-              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+              mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              return {
+                isError: true,
+                content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+              };
             }
           }
 
           const sanitized = performSanitization(processedContent, finalProfile);
-
-          if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
-            extraBlocks.push(buildUpsellBlock(null));
-          }
+          const { scrubbedText, newTokens } = sanitized;
+          const telemetry = buildCisoAuditTelemetry(newTokens);
+          const receiptMarkdown = formatAuditReceipt(telemetry);
+          const combinedOutput = `${scrubbedText}\n\n${receiptMarkdown}`;
 
           return {
             content: [
-              { type: "text", text: sanitized },
-              ...extraBlocks
+              { type: "text", text: combinedOutput },
+              ...extraBlocks.filter(Boolean)
             ]
           };
         } catch (docxError) {
@@ -637,7 +729,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             content: [
               {
                 type: "text",
-                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing`
+                text: `Error: PDF and Excel file sanitization is a PRO feature. Set PRIVACYSCRUBBER_KEY to your PRO license key to unlock local document parsing. Get a key at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal`
               }
             ]
           };
@@ -654,36 +746,44 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             let finalProfile = targetProfile;
             const extraBlocks = [];
 
-            sessionRequestCount++;
+            const limitStatus = checkFreeTierLimit(license.isPro);
+            if (limitStatus.blocked) {
+              return {
+                isError: true,
+                content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+              };
+            }
 
+            const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
             if (isAdvanced && !license.isPro) {
-              const reason = license.error ? ` (${license.error})` : "";
-              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              finalProfile = "General";
-              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
             }
 
-            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+                mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+                return {
+                  isError: true,
+                  content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+                };
               }
             }
 
             const sanitized = performSanitization(processedContent, finalProfile);
-
-            if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
-              extraBlocks.push(buildUpsellBlock(null));
-            }
+            const { scrubbedText, newTokens } = sanitized;
+            const telemetry = buildCisoAuditTelemetry(newTokens);
+            const receiptMarkdown = formatAuditReceipt(telemetry);
+            const combinedOutput = `${scrubbedText}\n\n${receiptMarkdown}`;
 
             return {
               content: [
-                { type: "text", text: sanitized },
-                ...extraBlocks
+                { type: "text", text: combinedOutput },
+                ...extraBlocks.filter(Boolean)
               ]
             };
           } catch (pdfError) {
@@ -711,36 +811,44 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             let finalProfile = targetProfile;
             const extraBlocks = [];
 
-            sessionRequestCount++;
+            const limitStatus = checkFreeTierLimit(license.isPro);
+            if (limitStatus.blocked) {
+              return {
+                isError: true,
+                content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+              };
+            }
 
+            const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
             if (isAdvanced && !license.isPro) {
-              const reason = license.error ? ` (${license.error})` : "";
-              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-              finalProfile = "General";
-              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+              mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+              extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
             }
 
-            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro);
-            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+            const { processedText: processedContent, wasTruncated } = truncateIfFree(content, license.isPro, charLimit);
+            if (wasTruncated) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
             if (!license.isPro) {
               const detected = detectSecrets(processedContent);
               if (detected.length > 0) {
-                mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-                extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+                mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+                return {
+                  isError: true,
+                  content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+                };
               }
             }
 
             const sanitized = performSanitization(processedContent, finalProfile);
-
-            if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
-              extraBlocks.push(buildUpsellBlock(null));
-            }
+            const { scrubbedText, newTokens } = sanitized;
+            const telemetry = buildCisoAuditTelemetry(newTokens);
+            const receiptMarkdown = formatAuditReceipt(telemetry);
+            const combinedOutput = `${scrubbedText}\n\n${receiptMarkdown}`;
 
             return {
               content: [
-                { type: "text", text: sanitized },
-                ...extraBlocks
+                { type: "text", text: combinedOutput },
+                ...extraBlocks.filter(Boolean)
               ]
             };
           } catch (xlsxError) {
@@ -782,36 +890,42 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       let finalProfile = targetProfile;
       const extraBlocks = [];
 
-      sessionRequestCount++;
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+        };
+      }
 
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
       if (isAdvanced && !license.isPro) {
-        const reason = license.error ? ` (${license.error})` : "";
-        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Advanced profile '${targetProfile}' is locked in the FREE tier. Falling back to 'General' profile.${reason}${colors.reset}\n${colors.cyan}👉  Get a PRO key at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-        finalProfile = "General";
-        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' requires PRO. Using 'General' as fallback.`));
+        mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Profile '${targetProfile}' active on Free Tier (5,000 char limit).${colors.reset}\n${colors.cyan}👉  Get a PRO key for unlimited use: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+        extraBlocks.push(buildUpsellBlock(`Profile '${targetProfile}' active (Free Tier limit: 5,000 chars). Upgrade to PRO for unlimited text.`));
       }
 
-      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro);
-      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to 50,000 characters (Free Tier limit).`));
+      const { processedText: processedContent2, wasTruncated: wasTruncated2 } = truncateIfFree(content, license.isPro, charLimit);
+      if (wasTruncated2) extraBlocks.push(buildUpsellBlock(`File content was truncated to ${charLimit.toLocaleString()} characters (Free Tier limit).`));
 
       if (!license.isPro) {
         const detected = detectSecrets(processedContent2);
         if (detected.length > 0) {
-          mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing${colors.reset}\n`);
-          extraBlocks.push(buildUpsellBlock(`API Key / Secret (${detected.join(', ')}) detected! Sanitization skipped (Requires PRO Profile).`));
+          mcpLog(`${colors.redBold}🚫  [PrivacyScrubber] API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data (Requires PRO Profile).${colors.reset}\n${colors.cyan}👉  Upgrade at: https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal${colors.reset}\n`);
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: API Key / Secret (${detected.join(', ')}) detected! Request BLOCKED to protect your data. Sanitizing DevOps secrets requires a PRO license. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
         }
       }
 
-      const sanitized = performSanitization(processedContent2, finalProfile);
-
-      if (!license.isPro && extraBlocks.length === 0 && sessionRequestCount % UPSELL_EVERY_N === 0) {
-        extraBlocks.push(buildUpsellBlock(null));
-      }
+      const { scrubbedText, newTokens } = performSanitization(processedContent2, finalProfile);
+      const telemetry = buildCisoAuditTelemetry(newTokens);
+      const receiptMd = formatAuditReceipt(telemetry);
 
       return {
         content: [
-          { type: "text", text: sanitized },
-          ...extraBlocks
+          { type: "text", text: scrubbedText + receiptMd },
+          ...extraBlocks.filter(Boolean)
         ]
       };
     }
@@ -837,6 +951,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const customRules = loadCustomRules();
         const normalizedProfile = (profile || "general").trim().toLowerCase();
         const license = checkLicenseStatus();
+        
+        const limitStatus = checkFreeTierLimit(license.isPro);
+        if (limitStatus.blocked) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+          };
+        }
         const localSessionMap = {};
         
         const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
@@ -873,7 +995,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
 
         if (isSecretLeak) {
-          return { isError: true, content: [{ type: "text", text: `Error: API Key or Secret detected. Sanitization of raw secrets requires PRO Profile. Upgrade at https://privacyscrubber.com/pricing` }] };
+          return { isError: true, content: [{ type: "text", text: `Error: API Key or Secret detected. Sanitization of raw secrets requires PRO Profile. Upgrade at https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal` }] };
         }
 
         if (!no_backup) {
@@ -906,7 +1028,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       const defaultTemplate = {
-        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config",
+        "_comment": "PrivacyScrubber local configuration. Add custom rules and restart your MCP client (Cursor/Windsurf). Details: https://privacyscrubber.com/docs/config?utm_source=mcp_cli&utm_medium=terminal",
         "customRules": [
           {
             "pattern": "my-secret-pattern-\\d+",
@@ -955,7 +1077,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const profileList = license.isPro
         ? 'All 23 profiles active (General, Dev, Medical, Legal, Finance, HR…)'
         : 'General only — PRO unlocks 22 industry profiles';
-      const sizeLimit = license.isPro ? 'Unlimited' : '50,000 characters per request';
+      const sizeLimit = license.isPro ? 'Unlimited' : '15,000 characters per request';
 
       const configPath = resolveConfigPath();
       let rulesStatus = '';
@@ -987,7 +1109,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         `║       PrivacyScrubber MCP Server v${MCP_VERSION.padEnd(10)}          ║`,
         '╠══════════════════════════════════════════════════╣',
         `║  ${tierIcon} Tier: ${tier.padEnd(43)}║`,
-        `║  📊 Session requests: ${String(sessionRequestCount).padEnd(27)}║`,
+        `║  📊 Session requests: ${String(getDailyUsage()).padEnd(27)}║`,
         `║  📁 Input size limit: ${sizeLimit.padEnd(27)}║`,
         '╠══════════════════════════════════════════════════╣',
         `║  🏷️  Profiles: ${profileList.substring(0,35).padEnd(35)}║`,
@@ -1001,12 +1123,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         lines.push(
           '║  ✅ PRO is active. All features unlocked.         ║',
           '║     To regenerate your key or manage billing:     ║',
-          '║     https://privacyscrubber.com/pricing           ║'
+          '║     https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal           ║'
         );
       } else {
         lines.push(
           '║  💳 Upgrade to PRO — $110 Lifetime                ║',
-          '║     https://privacyscrubber.com/pricing           ║',
+          '║     https://privacyscrubber.com/pricing?utm_source=mcp_cli&utm_medium=terminal           ║',
           '╠══════════════════════════════════════════════════╣',
           '║  After purchase, add your key to MCP config:     ║',
           '║                                                  ║',
@@ -1014,7 +1136,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           '║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║',
           '║                                                  ║',
           '║  Full setup guide:                               ║',
-          '║  https://privacyscrubber.com/features/mcp/       ║'
+          '║  https://privacyscrubber.com/features/mcp/?utm_source=mcp_cli&utm_medium=terminal       ║'
         );
       }
 
@@ -1057,20 +1179,30 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const customRules = loadCustomRules();
       const normalizedProfile = (profile || "general").trim().toLowerCase();
       const license = checkLicenseStatus();
+      
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Please set your PRO license key to continue. Get a key at: https://privacyscrubber.com/pricing` }]
+        };
+      }
 
+      let totalTokensForDirectory = {};
       for (const file of filesToScan) {
         try {
           const stat = await fs.promises.stat(file);
           if (stat.size > 10 * 1024 * 1024) continue; // skip >10MB
 
           const buffer = fs.readFileSync(file);
-          // basic binary check
           if (buffer.indexOf(0) !== -1) continue; 
           const content = buffer.toString('utf8');
 
           const localSessionMap = {};
           const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
           
+          Object.assign(totalTokensForDirectory, localSessionMap);
+          
           let isSecretLeak = false;
           if (!license.isPro && result.tokenMap) {
             Object.entries(result.tokenMap).forEach(([token, original]) => {
@@ -1106,8 +1238,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         reportLines.push("✅ Clean. No PII or secrets detected in the scanned files.");
       }
 
+      const telemetry = buildCisoAuditTelemetry(totalTokensForDirectory);
+      const receiptMd = formatAuditReceipt(telemetry);
+      
       return {
-        content: [{ type: "text", text: reportLines.join('\n') }]
+        content: [{ type: "text", text: reportLines.join('\n') + receiptMd }]
       };
     }
 
@@ -1209,41 +1344,23 @@ function performSanitization(text, profile) {
   const normalizedProfile = (profile || "general").trim().toLowerCase();
   const license = checkLicenseStatus();
   const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap, license.isPro);
-  if (!license.isPro && result.tokenMap) {
-    // Re-scan each masked token's original value against the shared detector.
-    // If it was a raw secret, restore it in the output and remove from sessionMap
-    // so it is never accidentally revealed by reveal_text.
-    Object.entries(result.tokenMap).forEach(([token, original]) => {
-      let isSecret = false;
-      for (const detector of DEVOPS_SECRETS_DETECTOR) {
-        detector.regex.lastIndex = 0;
-        if (detector.regex.test(original)) {
-          isSecret = true;
-          break;
-        }
-      }
-      if (isSecret) {
-        result.scrubbedText = result.scrubbedText.replace(token, original);
-        delete result.tokenMap[token];
-      }
-    });
-  }
 
+  const newTokens = {};
   // Update our volatile map with new matches
   if (result.tokenMap) {
     Object.entries(result.tokenMap).forEach(([token, original]) => {
       sessionMap[token] = original;
+      newTokens[token] = original;
     });
   }
 
-  return result.scrubbedText;
+  return { scrubbedText: result.scrubbedText, newTokens };
 }
 
-function truncateIfFree(text, isPro) {
-  const MAX_FREE_CHARS = 5000;
-  if (!isPro && text.length > MAX_FREE_CHARS) {
-    mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${MAX_FREE_CHARS} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
-    return { processedText: text.substring(0, MAX_FREE_CHARS), wasTruncated: true };
+function truncateIfFree(text, isPro, charLimit = 15000) {
+  if (!isPro && text.length > charLimit) {
+    mcpLog(`${colors.yellowBold}⚠️  [PrivacyScrubber] Input truncated to ${charLimit.toLocaleString()} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}👉  Set PRIVACYSCRUBBER_KEY to your PRO license key for unlimited size.${colors.reset}\n`);
+    return { processedText: text.substring(0, charLimit), wasTruncated: true };
   }
   return { processedText: text, wasTruncated: false };
 }