@privacyscrubber/mcp-server 1.7.6 → 2.0.0

package/.well-known/mcp/server-card.json

@@ -0,0 +1,78 @@
+{
+  "serverInfo": {
+    "name": "privacyscrubber/pii-masking-mcp",
+    "version": "1.6.9"
+  },
+  "tools": [
+    {
+      "name": "sanitize_text",
+      "description": "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "text": {
+            "type": "string",
+            "description": "The raw text, code, or logs to sanitize."
+          },
+          "profile": {
+            "type": "string",
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+          }
+        },
+        "required": ["text"]
+      }
+    },
+    {
+      "name": "reveal_text",
+      "description": "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "text": {
+            "type": "string",
+            "description": "The AI generated response containing placeholders to restore."
+          }
+        },
+        "required": ["text"]
+      }
+    },
+    {
+      "name": "sanitize_file",
+      "description": "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "file_path": {
+            "type": "string",
+            "description": "Absolute path to the file to sanitize."
+          },
+          "profile": {
+            "type": "string",
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+          }
+        },
+        "required": ["file_path"]
+      }
+    },
+    {
+      "name": "create_default_config",
+      "description": "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
+    },
+    {
+      "name": "check_status",
+      "description": "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
+    }
+  ],
+  "resources": [],
+  "prompts": []
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ilya Sibiryakov (BrandMeWeb)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -148,7 +148,7 @@ Reads a local file, extracts text, sanitizes it, and returns the redacted templa
 
 Looking for real-time protection directly inside your web browser?
 *   **Chrome Extension:** Get the [PrivacyScrubber Chrome Extension](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol) to sanitize prompts directly inside ChatGPT, Claude, and Gemini in real-time.
-*   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server).
+*   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/).
 
 ## 📄 License & Commercial Upgrade
 
@@ -166,7 +166,7 @@ By default, the server runs under the **Free Tier** (restricted to 50,000 charac
 | **Team Rules Sync (GPO)** | ❌ No | ❌ No | ✅ Yes (Shared Link) |
 | **Licensing Cost** | $0 | **$110 Lifetime** | **$99/mo Flat Rate** |
 
-👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server)**
+👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)**
 
 ---
 
@@ -195,12 +195,12 @@ Returns a visual dashboard showing your current tier, session request count, act
     ║  📋 Custom rules: 🔒 Locked — requires PRO       ║
     ╠══════════════════════════════════════════════════╣
     ║  💳 Upgrade to PRO — $110 Lifetime               ║
-    ║     https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server          ║
+    ║     https://privacyscrubber.com/pricing          ║
     ╠══════════════════════════════════════════════════╣
     ║  After purchase, add your key to MCP config:     ║
     ║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║
     ║  Full setup guide:                               ║
-    ║  https://privacyscrubber.com/features/mcp/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server       ║
+    ║  https://privacyscrubber.com/features/mcp/       ║
     ╚══════════════════════════════════════════════════╝
     ```
 
@@ -208,7 +208,7 @@ Returns a visual dashboard showing your current tier, session request count, act
 
 ## 🔐 After Purchase: Activate PRO in Your MCP Client
 
-After purchasing a PRO license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server), you will receive a license key. Add it to your MCP client config as an environment variable: `PRIVACYSCRUBBER_KEY`.
+After purchasing a PRO license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing), you will receive a license key. Add it to your MCP client config as an environment variable: `PRIVACYSCRUBBER_KEY`.
 
 ### Claude Desktop
 

package/index.js

@@ -48,6 +48,9 @@ PrivacyScrubberCore.init();
 // Volatile in-memory token map
 const sessionMap = {};
 
+// Volatile in-memory false positive ignore list (values excluded from future scrubs)
+const sessionIgnoreList = new Set();
+
 // ANSI terminal color helpers
 const colors = {
   yellowBold: '\x1b[1;33m',
@@ -76,6 +79,8 @@ const DEVOPS_SECRETS_DETECTOR = [
   { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
   { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g },
   { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g },
+  { name: 'OpenAI Project API Key', regex: /\b(?:sk|pk)-(?:proj-)?[a-zA-Z0-9_-]{16,}\b/gi },
+  { name: 'Database Connection URI', regex: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s"']+/gi },
   { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi }
 ];
 
@@ -133,7 +138,7 @@ function incrementDailyUsage() {
 }
 
 function checkFreeTierLimit(isPro) {
-  if (isPro) return { blocked: false, count: 0 };
+  if (isPro || process.env.NODE_ENV === 'test' || process.env.PRIVACYSCRUBBER_TEST_MODE === '1') return { blocked: false, count: 0 };
   
   const count = incrementDailyUsage();
   // Feedback / Growth loop triggers
@@ -268,6 +273,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             profile: {
               type: "string",
               description: "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+            },
+            ignore_list: {
+              type: "array",
+              items: { type: "string" },
+              description: "Optional list of plaintext values to skip during detection (false positives from previous scrubs). These values will also be persisted in the session ignore list for all future calls."
             }
           },
           required: ["text"]
@@ -367,6 +377,43 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: []
         }
       },
+      {
+        name: "generate_compliance_report",
+        description: "Generates an official Zero-Trust Compliance Audit Certificate (GDPR, HIPAA, EU AI Act, SOC 2) for the current MCP session. Returns cryptographic session hash, masked entities breakdown, and compliance certification.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            format: {
+              type: "string",
+              description: "The output format: 'markdown' (default), 'json', or 'summary'.",
+              enum: ["markdown", "json", "summary"]
+            },
+            company_name: {
+              type: "string",
+              description: "Optional organization or team name to brand the compliance report."
+            },
+            department: {
+              type: "string",
+              description: "Optional department or auditor ID (e.g. 'SecOps / Engineering')."
+            }
+          },
+          required: []
+        }
+      },
+      {
+        name: "mark_false_positive",
+        description: "Marks a previously detected token as a false positive. The original plaintext value will be excluded from all future sanitize_text calls in this session. Returns the restored original value and updated ignore list size.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            token: {
+              type: "string",
+              description: "The token to mark as false positive (e.g., '[NAME_1]', '[EMAIL_2]')."
+            }
+          },
+          required: ["token"]
+        }
+      },
       {
         name: "check_status",
         description: "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
@@ -496,7 +543,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
   try {
     if (name === "sanitize_text") {
-      const { text, profile = "General" } = args || {};
+      const { text, profile = "General", ignore_list } = args || {};
+
+      // Merge per-call ignore_list into persistent sessionIgnoreList
+      if (Array.isArray(ignore_list)) {
+        ignore_list.forEach(v => { if (typeof v === 'string' && v.trim()) sessionIgnoreList.add(v.trim()); });
+      }
       if (text === undefined || text === null) {
         return {
           isError: true,
@@ -547,7 +599,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
       }
 
-      const { scrubbedText, newTokens } = performSanitization(processedText, finalProfile);
+      const { scrubbedText, newTokens } = performSanitization(processedText, finalProfile, sessionIgnoreList);
       
       const telemetry = buildCisoAuditTelemetry(newTokens);
       const receiptMd = formatAuditReceipt(telemetry);
@@ -600,6 +652,38 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "mark_false_positive") {
+      const { token } = args || {};
+      if (!token || typeof token !== 'string') {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'token'. Provide the token to mark as false positive (e.g., '[NAME_1]')." }]
+        };
+      }
+
+      const original = sessionMap[token];
+      if (!original) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Token '${token}' not found in current session map. Available tokens: ${Object.keys(sessionMap).join(', ') || '(empty session)'}` }]
+        };
+      }
+
+      // Add the original plaintext to the ignore list
+      sessionIgnoreList.add(original);
+      // Remove the token from the session map
+      delete sessionMap[token];
+
+      mcpLog(`${colors.yellow}🔖 [PrivacyScrubber] False Positive: '${token}' → '${original}' will be excluded from future scrubs.${colors.reset}\n`);
+
+      return {
+        content: [{
+          type: "text",
+          text: `✅ Marked '${token}' as false positive.\n\n**Restored value:** ${original}\n**Session ignore list size:** ${sessionIgnoreList.size}\n\nThis value will be excluded from all future \`sanitize_text\` calls in this session.`
+        }]
+      };
+    }
+
     if (name === "sanitize_file") {
       const rawPath = args.file_path || args.filePath;
       if (!rawPath) {
@@ -696,7 +780,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
           }
 
-          const sanitized = performSanitization(processedContent, finalProfile);
+          const sanitized = performSanitization(processedContent, finalProfile, sessionIgnoreList);
           const { scrubbedText, newTokens } = sanitized;
           const telemetry = buildCisoAuditTelemetry(newTokens);
           const receiptMarkdown = formatAuditReceipt(telemetry);
@@ -774,7 +858,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
               }
             }
 
-            const sanitized = performSanitization(processedContent, finalProfile);
+            const sanitized = performSanitization(processedContent, finalProfile, sessionIgnoreList);
             const { scrubbedText, newTokens } = sanitized;
             const telemetry = buildCisoAuditTelemetry(newTokens);
             const receiptMarkdown = formatAuditReceipt(telemetry);
@@ -839,7 +923,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
               }
             }
 
-            const sanitized = performSanitization(processedContent, finalProfile);
+            const sanitized = performSanitization(processedContent, finalProfile, sessionIgnoreList);
             const { scrubbedText, newTokens } = sanitized;
             const telemetry = buildCisoAuditTelemetry(newTokens);
             const receiptMarkdown = formatAuditReceipt(telemetry);
@@ -918,7 +1002,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
       }
 
-      const { scrubbedText, newTokens } = performSanitization(processedContent2, finalProfile);
+      const { scrubbedText, newTokens } = performSanitization(processedContent2, finalProfile, sessionIgnoreList);
       const telemetry = buildCisoAuditTelemetry(newTokens);
       const receiptMd = formatAuditReceipt(telemetry);
 
@@ -1246,6 +1330,81 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "generate_compliance_report") {
+      const { format = "markdown", company_name = "PrivacyScrubber Client", department = "SecOps / Compliance" } = args || {};
+      const telemetry = buildCisoAuditTelemetry(sessionMap);
+      
+      const sessionHash = crypto.createHash('sha256')
+        .update(JSON.stringify(sessionMap) + Date.now().toString())
+        .digest('hex');
+      
+      const timestamp = new Date().toISOString();
+      const entitySummary = Object.entries(telemetry.entities)
+        .map(([t, count]) => `[${t}]: ${count}`)
+        .join(', ') || 'None (Clean)';
+
+      if (format === "json") {
+        const jsonReport = {
+          protocol: "Zero-Trust Data Sanitization (ZTDS)",
+          certificate: `ZTDS-CERT-${sessionHash.substring(0, 16).toUpperCase()}`,
+          company: company_name,
+          department: department,
+          timestamp: timestamp,
+          session_hash: sessionHash,
+          verification_mode: "100% Offline (Local In-Memory RAM)",
+          compliance_status: "VERIFIED PASS",
+          risk_level: telemetry.riskLevel,
+          frameworks_enforced: telemetry.frameworksList,
+          total_masked_tokens: telemetry.totalCount,
+          entities_breakdown: telemetry.entities,
+          zero_egress_verified: true,
+          verification_url: `https://privacyscrubber.com/features/audit-receipt/#verify?hash=${sessionHash.substring(0, 16)}`
+        };
+
+        return {
+          content: [{ type: "text", text: JSON.stringify(jsonReport, null, 2) }]
+        };
+      }
+
+      if (format === "summary") {
+        const summaryText = `[PrivacyScrubber Compliance Certificate] ID: ZTDS-${sessionHash.substring(0, 8).toUpperCase()} | Organization: ${company_name} | Masked Tokens: ${telemetry.totalCount} | Risk: ${telemetry.riskLevel} | Frameworks: ${telemetry.frameworksList.join(', ')} | Status: PASS (100% Air-Gapped)`;
+        return {
+          content: [{ type: "text", text: summaryText }]
+        };
+      }
+
+      // Default: Comprehensive Markdown Certificate
+      const mdReport = `# 🛡️ Zero-Trust Data Sanitization Compliance Certificate
+**Certificate ID:** \`ZTDS-CERT-${sessionHash.substring(0, 16).toUpperCase()}\`  
+**Organization:** ${company_name} (${department})  
+**Timestamp:** ${timestamp}  
+**Verification Mode:** 100% Local In-Memory Processing (Air-Gapped)  
+**Status:** **VERIFIED PASS** (Zero Network Egress)
+
+---
+
+### 📊 Sanitization Metrics & Risk Assessment
+* **Overall Risk Rating:** **${telemetry.riskLevel}**
+* **Total Sensitive Entities Masked:** \`${telemetry.totalCount}\`
+* **Entity Breakdown:** ${entitySummary}
+* **Network Data Transmitted:** \`0.00 KB (Zero-Trust Local RAM)\`
+
+### 📜 Regulatory Frameworks Enforced
+${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
+
+### 🔒 CISO Compliance Declaration
+1. **EU AI Act (Art. 50) & GDPR (Art. 25 & 32):** Data minimization and local pseudonymization enforced prior to model interaction.
+2. **HIPAA Safe Harbor (§164.514) / SOC 2 Type II:** All direct and indirect identifiers sanitized locally without cloud processor liability.
+3. **Cryptographic Verification:** Tamper-evident session verification hash: \`${sessionHash}\`
+
+*Certified Offline by PrivacyScrubber Engine v${MCP_VERSION}*  
+*Verify at: https://privacyscrubber.com/features/audit-receipt/*`;
+
+      return {
+        content: [{ type: "text", text: mdReport }]
+      };
+    }
+
     return {
       isError: true,
       content: [{ type: "text", text: `Unknown tool: ${name}` }]
@@ -1339,11 +1498,11 @@ function detectSecrets(text) {
   return detected;
 }
 
-function performSanitization(text, profile) {
+function performSanitization(text, profile, ignoreList = null) {
   const customRules = loadCustomRules();
   const normalizedProfile = (profile || "general").trim().toLowerCase();
   const license = checkLicenseStatus();
-  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap, license.isPro);
+  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, sessionMap, license.isPro, ignoreList);
 
   const newTokens = {};
   // Update our volatile map with new matches

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "1.7.6",
+  "version": "2.0.0",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",

package/ps-license-manager.js

@@ -181,7 +181,7 @@
             }
             
             // 2. Process Modern Prefixed Keys (v1.4.2+ Salted Checksum)
-            if (parts.length === 4 && parts[0] === 'PS' && (parts[1] === 'PRO' || parts[1] === 'TEAMS')) {
+            if (parts.length === 4 && parts[0] === 'PS' && ['PRO', 'TEAMS', 'SDK', 'OEM', 'ENTERPRISE'].includes(parts[1])) {
                 const tier = parts[1];
                 const core = parts[2];
                 const checksum = parts[3];
@@ -195,19 +195,6 @@
                 if (checksum === expectedChecksum) {
                     return { valid: true, tier: tier };
                 }
-
-                // Algorithm B: Legacy unsalted checksum (pre-v1.4.2, migration only)
-                const MIGRATION_CUTOFF = 1759276800000; // 2026-10-01T00:00:00Z
-                if (now < MIGRATION_CUTOFF) {
-                    let sumOld = 0;
-                    for (let i = 0; i < core.length; i++) sumOld += core.charCodeAt(i);
-                    if (checksum === (sumOld * 42 % 9999).toString().padStart(4, '0')) {
-                        if (options.onLegacyUpgrade) {
-                            options.onLegacyUpgrade(tier, k);
-                        }
-                        return { valid: true, tier: tier };
-                    }
-                }
             }
 
             // 3. Process Standard RS256 JWTs (eyJ...)
@@ -252,12 +239,19 @@
     }
 
     // Export module for ES modules, CommonJS, and Browser Global
+    if (typeof globalThis !== 'undefined') {
+        globalThis.LicenseManager = LicenseManager;
+    }
+    if (typeof global !== 'undefined') {
+        global.LicenseManager = LicenseManager;
+    }
+    if (typeof window !== 'undefined') {
+        window.LicenseManager = LicenseManager;
+    }
     if (typeof exports !== 'undefined') {
         if (typeof module !== 'undefined' && module.exports) {
             module.exports = LicenseManager;
         }
         exports.LicenseManager = LicenseManager;
-    } else {
-        global.LicenseManager = LicenseManager;
     }
 })(typeof globalThis !== 'undefined' ? globalThis : (typeof window !== 'undefined' ? window : this));