@privacyscrubber/mcp-server 2.2.2 → 2.2.5

package/LICENSE.md

@@ -0,0 +1,23 @@
+# PrivacyScrubber MCP Server License Agreement
+
+**Copyright (c) 2026 Ilya Sibiryakov (BrandMeWeb). All Rights Reserved.**
+
+### 1. Grant of License — Community / Development Tier
+Subject to the terms and conditions of this Agreement, BrandMeWeb grants you a personal, worldwide, non-exclusive, non-transferable license to install and run the PrivacyScrubber MCP Server (`@privacyscrubber/mcp-server`) in local IDE environments (such as Cursor, Windsurf, Claude Desktop, and CLI tools) solely for personal evaluation, development, and standard local data sanitization under published Free Tier quotas.
+
+### 2. Commercial, Multi-User & Enterprise Tier
+Use of this software within commercial organizations, production automated pipelines, CI/CD gates, high-volume batch processing, multi-seat corporate teams, or the invocation of the 30 Specialized Industry Profiles (HIPAA PHI, Financial PAN/IBAN, Legal Privilege, DevSecOps Cloud Secrets, Automotive, Telecom, Biotech) requires a valid commercial license key:
+- **PrivacyScrubber PRO**: Individual professional use ($15/mo or $110 Lifetime).
+- **PrivacyScrubber TEAMS**: Team and small enterprise seats ($99/mo flat).
+- **PrivacyScrubber Enterprise / Air-Gapped**: Dedicated corporate VPC clusters, Nitro Enclaves, and custom profile calibration ($12,000/yr).
+
+Licensing and key activation: https://privacyscrubber.com/pricing
+
+### 3. Restrictions on Reverse-Engineering & Redistribution
+Except as expressly authorized herein, you may not:
+- Decompile, disassemble, reverse-engineer, or attempt to reconstruct the underlying pattern databases, regular expression taxonomies, or proprietary tokenization finite-state machines.
+- Extract, harvest, or scrape the 30 specialized industry entity taxonomies to train competing machine learning models or build competing redaction products.
+- Distribute, sublicense, lease, or commercially exploit standalone copies of the engine without an active Enterprise OEM agreement.
+
+### 4. Disclaimer of Warranties & Limitation of Liability
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -3,10 +3,13 @@
 [![NPM Version](https://img.shields.io/npm/v/@privacyscrubber/mcp-server?color=blue)](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
 [![NPM Downloads](https://img.shields.io/npm/dm/@privacyscrubber/mcp-server?color=3b82f6)](https://www.npmjs.com/package/@privacyscrubber/mcp-server)
 [![NPM SDK](https://img.shields.io/npm/v/@privacyscrubber/sdk?label=%40privacyscrubber%2Fsdk&color=10b981)](https://www.npmjs.com/package/@privacyscrubber/sdk)
+[![Presidio Alternative](https://img.shields.io/badge/Presidio%20Alternative-Node.js%20%26%20TS-0078D4.svg)](https://www.npmjs.com/package/@privacyscrubber/sdk)
+[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-success.svg)](https://www.npmjs.com/package/@privacyscrubber/sdk)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22058770.svg)](https://zenodo.org/records/22058770)
 [![OSF DOI](https://img.shields.io/badge/OSF%20DOI-10.17605%2FOSF.IO%2F5BYJF-blue.svg)](https://osf.io/5byjf/)
 [![SSRN](https://img.shields.io/badge/SSRN-7335581-darkred.svg)](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7335581)
+[![IETF Specification](https://img.shields.io/badge/IETF-ZTDS--Protocol-0284c7.svg)](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
 [![smithery badge](https://smithery.ai/badge/privacyscrubber/pii-masking-mcp)](https://smithery.ai/servers/privacyscrubber/pii-masking-mcp)
 [![Cursor Directory](https://img.shields.io/badge/Cursor%20Directory-Verified%20Plugin-000000.svg)](https://cursor.directory/plugins/privacyscrubber-mcp)
 [![Glama.ai](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp/badge)](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp)
@@ -50,22 +53,63 @@ Run the server directly without local installation:
 npx -y @privacyscrubber/mcp-server
 ```
 
-### 3. Programmatic Node.js / TypeScript SDK
-Need direct, in-memory zero-trust PII sanitization in your backend microservice or custom AI agent rather than an MCP server? Use our official zero-dependency SDK:
+### 3. Programmatic Node.js / TypeScript SDK (Lightweight Presidio Alternative)
+Need direct, in-memory zero-trust PII sanitization in your backend microservice, Next.js app, or RAG vector pipeline rather than an MCP server? Use our official zero-dependency SDK:
 
 ```bash
 npm install @privacyscrubber/sdk
 ```
 
-```javascript
+```typescript
 import OpenAI from 'openai';
 import { wrapOpenAI } from '@privacyscrubber/sdk';
 
 // Transparently masks PII before sending to LLM and rehydrates responses:
 const openai = wrapOpenAI(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }));
+
+// Outbound prompt is sanitized in local RAM before leaving your machine:
+// "Schedule a call with [NAME_1] at [EMAIL_1] regarding API key [AWS_KEY_1]."
+const completion = await openai.chat.completions.create({
+  model: 'gpt-4o',
+  messages: [{ role: 'user', content: 'Schedule a call with Alice Smith at alice@acme.com with AKIAIOSFODNN7EXAMPLE.' }]
+});
+
+// Incoming LLM answer is automatically rehydrated with "Alice Smith (alice@acme.com)":
+console.log(completion.choices[0].message.content);
 ```
 
-👉 [View @privacyscrubber/sdk on NPM](https://www.npmjs.com/package/@privacyscrubber/sdk) | Includes `wrapOpenAI()` middleware, TypeScript definitions, and 25 compliance profiles.
+#### ⚡ Why @privacyscrubber/sdk vs Microsoft Presidio?
+
+Microsoft Presidio is the Python standard, but deploying it in a Node.js / TypeScript stack requires running heavy Python microservices, Docker containers, and 500MB+ spaCy NLP models with 35–120ms latency. `@privacyscrubber/sdk` runs **100% in-process with zero dependencies**:
+
+| Feature / Metric | `@privacyscrubber/sdk` | Microsoft Presidio | AWS Comprehend / Google Cloud DLP |
+| :--- | :--- | :--- | :--- |
+| **Runtime & Dependencies** | **0 dependencies (~150KB)** | Python + Docker + spaCy (~500MB) | Heavy Cloud SDKs |
+| **Execution Latency** | **Sub-millisecond in RAM (<1ms)** | 35–120ms HTTP/gRPC roundtrip | 180–400ms external cloud roundtrip |
+| **Docker / Sidecar Needed** | **None (Pure in-process Node/WASM)** | Mandatory Docker container | VPC endpoints & IAM configurations |
+| **Network Egress** | **0 Bytes (100% Air-gapped)** | Local internal network hop | Full unencrypted payload to cloud |
+| **Data Loss & Reversibility** | **0 Loss (RAM-reversible via `restore()`)** | Manual token vault configuration | Irreversible masking / hashing |
+| **OpenAI / LangChain 1-Liner** | **Built-in (`wrapOpenAI`, `wrapAiStream`)** | Complex custom pipeline glue | Custom proxy architecture |
+| **DevOps Secrets Interception**| **Built-in (AWS, JWT, DB URIs, GitHub PAT)**| Custom regex recognizers needed | Cloud-specific classifiers |
+| **Streaming Rehydration** | **Built-in (`wrapAiStream`, `TransformStream`)**| Buffering / chunk split failures | Not supported in real-time streams |
+
+👉 [View @privacyscrubber/sdk on NPM](https://www.npmjs.com/package/@privacyscrubber/sdk) | Full documentation, Express middleware, LangChain transforms, and 25 compliance profiles.
+
+#### 🛡️ Architecture & Security Deep-Dive (Zero-Trust vs Cloud DLP)
+
+When AI IDEs (Cursor, Claude Desktop, Windsurf) connect to model providers, developer credentials, database connection strings, and internal customer PII are at continuous risk of prompt exfiltration. The `@privacyscrubber/mcp-server` enforces four immutable architectural guarantees:
+
+1. **Stdio Air-Gapped Transport**:
+   The MCP server communicates exclusively over local standard input/output (`stdio`) child processes spawned by your IDE. It opens **zero external listening ports** and initiates **zero remote network requests**.
+2. **Volatile RAM-Only Token Map**:
+   The mapping table between synthetic tokens (`[AWS_KEY_1]`, `[EMAIL_1]`) and raw cleartext is maintained exclusively in ephemeral node memory and is wiped the moment your IDE session closes.
+3. **Deterministic AST Lookarounds vs Cloud Proxy Overhead**:
+   Unlike cloud DLP gateways (Nightfall, Skyflow) that add 200–400ms latency and transmit unencrypted code to third parties, `@privacyscrubber/mcp-server` runs locally in <2ms with zero data egress.
+4. **Permanent Standards & Academic Validation**:
+   - **IETF Specification**: [draft-sibiryakov-ztds-protocol-00](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
+   - **CERN / Zenodo Foundation**: [DOI 10.5281/zenodo.22058770](https://doi.org/10.5281/zenodo.22058770)
+   - **Center for Open Science (OSF)**: [DOI 10.17605/OSF.IO/5BYJF](https://doi.org/10.17605/OSF.IO/5BYJF)
+   - **Patent Pending**: Israel Patent Office Application `IL 331905` (WIPO DAS Code: `B17B`)
 
 ---
 
@@ -246,7 +290,7 @@ Returns a visual dashboard showing your current tier, session request count, act
 *   **Response Example (Free Tier):**
     ```
     ╔══════════════════════════════════════════════════╗
-    ║       PrivacyScrubber MCP Server v2.2.2          ║
+    ║       PrivacyScrubber MCP Server v2.2.4          ║
     ╠══════════════════════════════════════════════════╣
     ║  🔓 Tier: FREE                                   ║
     ║  📊 Session requests: 5                          ║
@@ -295,7 +339,7 @@ Looking for real-time protection directly inside your web browser?
 
 ## 📄 License & Commercial Upgrade
 
-By default, the server runs under the **Free Tier** (restricted to 15,000 characters per request and the basic `General` PII profile). To unlock 25 specialized engineering, medical, legal, and financial PII profiles, as well as team-wide custom rules, you can purchase a commercial license.
+By default, the server runs under the **Free Tier** (restricted to 15,000 characters per request and the basic `General` PII profile). To unlock 30 specialized engineering, medical, legal, and financial PII profiles, as well as team-wide custom rules, you can purchase a commercial license.
 
 ### Feature Comparison
 
@@ -304,7 +348,7 @@ By default, the server runs under the **Free Tier** (restricted to 15,000 charac
 | **Volatile Tokenization** | ✅ Yes | ✅ Yes | ✅ Yes |
 | **Standard PII Masking** | ✅ Yes | ✅ Yes | ✅ Yes |
 | **Max Character Length** | 15,000 chars | ♾️ Unlimited | ♾️ Unlimited |
-| **Industry Profiles** | General Only | 25 Profiles | 25 Profiles |
+| **Industry Profiles** | General Only | 30 Profiles | 30 Profiles |
 | **Custom Regex Rules** | ❌ Locked | ♾️ Unlimited | ♾️ Unlimited |
 | **Team Rules Sync (GPO)** | ❌ No | ❌ No | ✅ Yes (Shared Link) |
 | **Licensing Cost** | $0 | **$110 Lifetime** | **$99/mo Flat Rate** |
@@ -395,6 +439,7 @@ PrivacyScrubber and the Zero-Trust Data Sanitization (ZTDS) protocol are backed
 
 | Repository / Archive | DOI / Identifier | Focus Area | Regulatory & Compliance Scope |
 |---|---|---|---|
+| **IETF Standards Track** | [`draft-sibiryakov-ztds-protocol`](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/) | The ZTDS Protocol for Frontier AI Ingestion | Global AI Privacy, Zero-Egress Architecture |
 | **Zenodo / CERN** | [`10.5281/zenodo.22058770`](https://zenodo.org/records/22058770) | Zero-Trust Data Sanitization (ZTDS) Protocol Foundation | Cross-Border AI Privacy, ISO 27001 A.8.11 |
 | **OSF (Center for Open Science)** | [`10.17605/OSF.IO/5BYJF`](https://osf.io/5byjf/) | Empirical Latency Benchmark & Memory Profiling (<2ms RAM) | Performance vs Cloud DLP Proxies |
 | **SSRN / Elsevier** | [`SSRN ID: 7335581`](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7335581) | Enterprise Generative AI Governance | EU AI Act, UK GDPR, US State Privacy |
@@ -431,4 +476,11 @@ The Zero-Trust Data Sanitization (ZTDS) architecture, in-memory deterministic to
 - **Official Title:** *SYSTEM AND METHOD FOR CLIENT-SIDE ZERO-TRUST DATA SANITIZATION AND CRYPTOGRAPHIC SESSION HANDOFF IN ARTIFICIAL INTELLIGENCE WORKFLOWS*
 - **Virtual Patent Marking:** [privacyscrubber.com/patents/](https://privacyscrubber.com/patents/) in accordance with 35 U.S.C. § 287(a).
 
+### 🌐 Internet Engineering Task Force (IETF) Specification
+- **Specification Title:** *The Zero-Trust Data Sanitization (ZTDS) Protocol for Frontier Artificial Intelligence Ingestion*
+- **Standards Track:** IETF Internet Standard Track
+- **IETF Datatracker:** [https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
+- **Archive Plaintext:** [https://www.ietf.org/archive/id/draft-sibiryakov-ztds-protocol-00.txt](https://www.ietf.org/archive/id/draft-sibiryakov-ztds-protocol-00.txt)
+
+