@privacyscrubber/mcp-server 2.2.6 → 2.3.1

package/README.md

@@ -10,6 +10,7 @@
 [![OSF DOI](https://img.shields.io/badge/OSF%20DOI-10.17605%2FOSF.IO%2F5BYJF-blue.svg)](https://osf.io/5byjf/)
 [![SSRN](https://img.shields.io/badge/SSRN-7335581-darkred.svg)](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7335581)
 [![IETF Specification](https://img.shields.io/badge/IETF-ZTDS--Protocol-0284c7.svg)](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
+[![ZTDS Verified](https://ztds.ai/badge/privacyscrubber-sdk.svg)](https://ztds.ai/registry/#privacyscrubber-mcp)
 [![smithery badge](https://smithery.ai/badge/privacyscrubber/pii-masking-mcp)](https://smithery.ai/servers/privacyscrubber/pii-masking-mcp)
 [![Cursor Directory](https://img.shields.io/badge/Cursor%20Directory-Verified%20Plugin-000000.svg)](https://cursor.directory/plugins/privacyscrubber-mcp)
 [![Glama.ai](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp/badge)](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp)
@@ -176,7 +177,7 @@ const guardedTools = createGuardedTools(engine);
 ```
 
 > 🏢 **Enterprise & Production Licensing:**  
-> - **Self-Serve Developer SDK ($299/mo flat or $2,990/yr):** Unlimited internal backend nodes, microservices, and RAG pipelines. [Get SDK License](https://privacyscrubber.com/pricing?tier=sdk&utm_source=mcp_readme)  
+> - **Self-Serve Developer SDK ($299/mo flat or $2,990/yr):** Unlimited internal backend nodes, microservices, and RAG pipelines. [Developer SDK Specs & Pricing](https://privacyscrubber.com/sdk/?utm_source=mcp_readme)  
 > - **PrivacyScrubber TEAMS ($99/mo flat):** Unlimited team seats, centralized policy enforcement, encrypted session handoff. [Deploy TEAMS](https://privacyscrubber.com/teams?utm_source=mcp_readme)  
 > - **Enterprise Air-Gapped License:** On-premise source code distribution, zero-network custom models. [Contact Enterprise](https://privacyscrubber.com/enterprise?utm_source=mcp_readme)
 
@@ -375,7 +376,7 @@ Returns a visual dashboard showing your current tier, session request count, act
 *   **Response Example (Free Tier):**
     ```
     ╔══════════════════════════════════════════════════╗
-    ║       PrivacyScrubber MCP Server v2.2.4          ║
+    ║       PrivacyScrubber MCP Server v2.2.8          ║
     ╠══════════════════════════════════════════════════╣
     ║  🔓 Tier: FREE                                   ║
     ║  📊 Session requests: 5                          ║
@@ -390,7 +391,7 @@ Returns a visual dashboard showing your current tier, session request count, act
     ║  After purchase, add your key to MCP config:     ║
     ║  "PRIVACYSCRUBBER_KEY": "<your-key-here>"        ║
     ║  Full setup guide:                               ║
-    ║  https://privacyscrubber.com/features/mcp/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server       ║
+    ║  https://privacyscrubber.com/pii-mcp/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server          ║
     ╚══════════════════════════════════════════════════╝
     ```
 
@@ -510,7 +511,7 @@ Use the check_status tool from PrivacyScrubber MCP
 ## 🔗 Ecosystem & Production Architecture Guides
 
 - 🌐 **Web App**: [https://privacyscrubber.com](https://privacyscrubber.com)
-- 📦 **Node.js / TypeScript SDK**: [@privacyscrubber/sdk](https://www.npmjs.com/package/@privacyscrubber/sdk)
+- 📦 **Node.js / TypeScript SDK**: [@privacyscrubber/sdk](https://privacyscrubber.com/sdk/) ([npm](https://www.npmjs.com/package/@privacyscrubber/sdk))
 - 🧩 **Chrome Extension**: [Chrome Web Store](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-zero-tr/pimoejgefeilajmmbpghifdmhdlkgjol)
 - 🛡️ **RAG & Vector Databases**: [Sanitizing PII Before Vector DB Ingestion (Pinecone, Chroma, Qdrant)](https://privacyscrubber.com/solutions/dev/rag-vector-database-pii-masking/)
 - 🤖 **LangChain & LlamaIndex**: [In-Memory PII Middleware for AI Agent Pipelines](https://privacyscrubber.com/solutions/agents/langchain-llamaindex-pii-anonymizer/)

package/index.js

@@ -67,7 +67,7 @@ PrivacyScrubberCore.init();
 const agentSessions = new Map();
 const MAX_CONCURRENT_SESSIONS = 200;
 
-function getSessionMap(sessionId = 'default') {
+function getSession(sessionId = 'default') {
   const sid = (sessionId || 'default').toString().trim() || 'default';
   let session = agentSessions.get(sid);
   const now = Date.now();
@@ -76,18 +76,31 @@ function getSessionMap(sessionId = 'default') {
       const oldestKey = agentSessions.keys().next().value;
       agentSessions.delete(oldestKey);
     }
-    session = { map: {}, createdAt: now, lastActive: now };
+    session = { map: {}, ignoreList: new Set(), createdAt: now, lastActive: now };
     agentSessions.set(sid, session);
   }
   session.lastActive = now;
-  return session.map;
+  return session;
+}
+
+function getSessionMap(sessionId = 'default') {
+  return getSession(sessionId).map;
+}
+
+function getSessionIgnoreList(sessionId = 'default') {
+  return getSession(sessionId).ignoreList;
 }
 
 // Global default sessionMap maintains 100% backward compatibility
 const sessionMap = getSessionMap('default');
+const sessionIgnoreList = getSessionIgnoreList('default');
 
 function reverseTokens(text, map) {
-  if (!text || typeof text !== 'string' || !map) return text;
+  if (!text || typeof text !== 'string' || !map || Object.keys(map).length === 0) return text;
+  if (PrivacyScrubberCore && typeof PrivacyScrubberCore.unscrubText === 'function') {
+    const res = PrivacyScrubberCore.unscrubText(text, map);
+    return (res && typeof res.restoredText === 'string') ? res.restoredText : (typeof res === 'string' ? res : text);
+  }
   let result = text;
   for (const [token, original] of Object.entries(map)) {
     if (result.includes(token)) {
@@ -97,9 +110,6 @@ function reverseTokens(text, map) {
   return result;
 }
 
-// Volatile in-memory false positive ignore list (values excluded from future scrubs)
-const sessionIgnoreList = new Set();
-
 // ANSI terminal color helpers
 const colors = {
   yellowBold: '\x1b[1;33m',
@@ -156,31 +166,35 @@ function getUsageFilePath() {
   return path.resolve(homeDir, '.privacyscrubber-usage.json');
 }
 
+let cachedDailyUsage = null;
+
 function getDailyUsage() {
-  const file = getUsageFilePath();
   const today = new Date().toISOString().split('T')[0];
-  if (!fs.existsSync(file)) return 0;
+  if (cachedDailyUsage && cachedDailyUsage.date === today) {
+    return cachedDailyUsage.count;
+  }
+  const file = getUsageFilePath();
+  if (!fs.existsSync(file)) {
+    cachedDailyUsage = { date: today, count: 0 };
+    return 0;
+  }
   try {
     const data = JSON.parse(fs.readFileSync(file, 'utf8'));
     if (data.date === today) {
-      return data.count || 0;
+      cachedDailyUsage = { date: today, count: data.count || 0 };
+      return cachedDailyUsage.count;
     }
   } catch (e) {}
+  cachedDailyUsage = { date: today, count: 0 };
   return 0;
 }
 
 function incrementDailyUsage() {
-  const file = getUsageFilePath();
   const today = new Date().toISOString().split('T')[0];
-  let count = 0;
-  if (fs.existsSync(file)) {
-    try {
-      const data = JSON.parse(fs.readFileSync(file, 'utf8'));
-      if (data.date === today) count = data.count || 0;
-    } catch (e) {}
-  }
-  count++;
+  const count = getDailyUsage() + 1;
+  cachedDailyUsage = { date: today, count };
   try {
+    const file = getUsageFilePath();
     fs.writeFileSync(file, JSON.stringify({ date: today, count }), 'utf8');
   } catch (e) {}
   return count;
@@ -216,7 +230,8 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
     if (currentTokenMap && typeof currentTokenMap === 'object') {
         const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
         for (const t of keys) {
-            const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
+            const tokenStr = typeof t === 'string' ? t : (t && (t.token || t.mask)) ? String(t.token || t.mask) : '';
+            if (!tokenStr) continue;
             const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
@@ -245,26 +260,72 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
         frameworksSet.add('GDPR (Art. 4)');
         frameworksSet.add('CCPA/CPRA');
     }
-    if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT')) {
+    if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT') || types.includes('NATIONAL_ID')) {
         frameworksSet.add('SOC 2 Type II');
         frameworksSet.add('ISO 27001 (A.8.11)');
     }
-    if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD'].includes(t))) {
+    if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD', 'STRIPE_KEY', 'TAX_ID', 'EIN', 'W2', '1099', 'SALARY', 'WAGE'].includes(t))) {
         frameworksSet.add('PCI DSS v4.0');
+        frameworksSet.add('IRC § 7216 & GLBA');
     }
-    if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT'].includes(t))) {
+    if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT', 'DIAGNOSIS', 'NPI', 'DEA'].includes(t))) {
         frameworksSet.add('HIPAA §164.514');
     }
-    if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY'].includes(t))) {
+    if (types.some(t => ['CASE_NUMBER', 'DOCKET', 'PRIVILEGED', 'LEGAL', 'ATTORNEY', 'COURT', 'CONTRACT', 'NDA'].includes(t))) {
+        frameworksSet.add('FRE 502 (Privilege)');
+    }
+    if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY', 'AWS_KEY', 'JWT_TOKEN', 'API_TOKEN', 'CREDENTIAL'].includes(t))) {
         frameworksSet.add('NIST SP 800-53');
     }
+    if (totalCount > 0) {
+        frameworksSet.add('EU AI Act (Art. 50)');
+    }
+
+    const ipHoldings = {
+        standard: 'IETF draft-sibiryakov-ztds-protocol-00',
+        standardUrl: 'https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/',
+        patent: 'IL 331905 (Tracking: 94221)',
+        wipoDas: 'B17B',
+        trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
+    };
+
+    const statutoryCitations = [
+        {
+            statute: 'EU AI Act (Art. 50)',
+            scope: 'AI Transparency & Data Minimization',
+            rule: '0-byte external network transmission; prevents unauthorized ingestion into frontier models.'
+        },
+        {
+            statute: 'GDPR (Art. 4, 25, 28, 32)',
+            scope: 'Pseudonymization & Processor Liability',
+            rule: 'Volatile client-side tokenization eliminates GDPR Article 28 data processor liability.'
+        },
+        {
+            statute: 'HIPAA 45 CFR § 164.514(b)',
+            scope: 'Safe Harbor De-Identification',
+            rule: 'Deterministic removal of all 18 PHI identifiers prior to AI analysis.'
+        },
+        {
+            statute: 'IRC § 7216 & IRS Pub. 1075',
+            scope: 'Tax Return Information Confidentiality',
+            rule: 'Strict criminal penalty safeguard against unauthorized disclosure of tax records to cloud LLMs.'
+        },
+        {
+            statute: 'FRE 502',
+            scope: 'Attorney-Client Privilege Preservation',
+            rule: 'Automated in-memory redaction prevents inadvertent waiver of legal privilege in AI workflows.'
+        }
+    ];
 
     return {
         totalCount,
         entities,
         types,
         riskLevel,
-        frameworksList: Array.from(frameworksSet)
+        frameworksList: Array.from(frameworksSet),
+        statutoryCitations,
+        ipHoldings,
+        multimodalEgress: '0.00 Bytes (Solid Blackout & Burn-in Verified)'
     };
 }
 
@@ -288,7 +349,7 @@ function formatAuditReceipt(telemetry, compact = false, wasTruncated = false, ch
   }
 
   if (telemetry.totalCount === 0) {
-    return `\n\n> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n${truncationLine}> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (\`gh repo star moxno/privacyscrubber-mcp\`) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+    return `\n\n> 🛡️ **PrivacyScrubber Audit Receipt**: CLEAN (ZERO PII DETECTED)\n${truncationLine}> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (\`gh repo star moxno/privacyscrubber-mcp\`) | **SDK & Enterprise:** [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/)\n`;
   }
   
   const entitiesList = Object.entries(telemetry.entities)
@@ -297,7 +358,7 @@ function formatAuditReceipt(telemetry, compact = false, wasTruncated = false, ch
 
   const icon = telemetry.riskLevel.includes('CRITICAL') ? '🔴' : (telemetry.riskLevel.includes('MODERATE') ? '🟠' : '🟢');
 
-  return `\n\n> 🛡️ **PrivacyScrubber Audit Receipt**\n> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\n> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n${truncationLine}> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (\`gh repo star moxno/privacyscrubber-mcp\`) | **SDK & Enterprise:** [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing)\n`;
+  return `\n\n> 🛡️ **PrivacyScrubber Audit Receipt**\n> * **Risk Level:** ${icon} ${telemetry.riskLevel}\n> * **Compliance Enforced:** ${telemetry.frameworksList.join(', ')}\n> * **Tokens Masked:** ${telemetry.totalCount} (${entitiesList})\n${truncationLine}> * ⭐ **Star on GitHub:** [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) (\`gh repo star moxno/privacyscrubber-mcp\`) | **SDK & Enterprise:** [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/)\n`;
 }
 
 function formatCefEvent(eventData = {}) {
@@ -652,6 +713,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             token: {
               type: "string",
               description: "The token to mark as false positive (e.g., '[NAME_1]', '[EMAIL_2]')."
+            },
+            session_id: {
+              type: "string",
+              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
             }
           },
           required: ["token"]
@@ -1146,10 +1211,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     if (name === "sanitize_text" || name === "scrub_text") {
       const { text, profile = "General", ignore_list, compact = false, session_id = "default" } = args || {};
       const currentSession = getSessionMap(session_id);
+      const currentIgnoreList = getSessionIgnoreList(session_id);
 
       // Merge per-call ignore_list into persistent sessionIgnoreList
       if (Array.isArray(ignore_list)) {
-        ignore_list.forEach(v => { if (typeof v === 'string' && v.trim()) sessionIgnoreList.add(v.trim()); });
+        ignore_list.forEach(v => { if (typeof v === 'string' && v.trim()) currentIgnoreList.add(v.trim()); });
       }
       if (text === undefined || text === null) {
         return {
@@ -1195,7 +1261,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       const { processedText, wasTruncated } = truncateIfFree(text, license.isPro, charLimit);
 
-      const { scrubbedText, newTokens } = performSanitization(processedText, finalProfile, sessionIgnoreList, currentSession);
+      const { scrubbedText, newTokens } = performSanitization(processedText, finalProfile, currentIgnoreList, currentSession);
       
       const telemetry = buildCisoAuditTelemetry(newTokens);
       const receiptMd = formatAuditReceipt(telemetry, compact, wasTruncated, charLimit);
@@ -1249,7 +1315,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "mark_false_positive") {
-      const { token } = args || {};
+      const { token, session_id = "default" } = args || {};
       if (!token || typeof token !== 'string') {
         return {
           isError: true,
@@ -1257,25 +1323,28 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
-      const original = sessionMap[token];
+      const currentSession = getSessionMap(session_id);
+      const currentIgnoreList = getSessionIgnoreList(session_id);
+
+      const original = currentSession[token];
       if (!original) {
         return {
           isError: true,
-          content: [{ type: "text", text: `Error: Token '${token}' not found in current session map. Available tokens: ${Object.keys(sessionMap).join(', ') || '(empty session)'}` }]
+          content: [{ type: "text", text: `Error: Token '${token}' not found in current session map. Available tokens: ${Object.keys(currentSession).join(', ') || '(empty session)'}` }]
         };
       }
 
       // Add the original plaintext to the ignore list
-      sessionIgnoreList.add(original);
+      currentIgnoreList.add(original);
       // Remove the token from the session map
-      delete sessionMap[token];
+      delete currentSession[token];
 
       mcpLog(`${colors.yellow}🔖 [PrivacyScrubber] False Positive: '${token}' → '${original}' will be excluded from future scrubs.${colors.reset}\n`);
 
       return {
         content: [{
           type: "text",
-          text: `✅ Marked '${token}' as false positive.\n\n**Restored value:** ${original}\n**Session ignore list size:** ${sessionIgnoreList.size}\n\nThis value will be excluded from all future \`sanitize_text\` calls in this session.`
+          text: `✅ Marked '${token}' as false positive.\n\n**Restored value:** ${original}\n**Session ignore list size:** ${currentIgnoreList.size}\n\nThis value will be excluded from all future \`sanitize_text\` calls in this session.`
         }]
       };
     }
@@ -1883,7 +1952,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           verification_url: `https://privacyscrubber.com/features/audit-receipt/#verify?hash=${sessionHash.substring(0, 16)}`,
           licensing_and_governance: {
             teams_governance_url: "https://privacyscrubber.com/teams?src=mcp_compliance_json",
-            sdk_pipeline_url: "https://privacyscrubber.com/pricing?tier=sdk&src=mcp_compliance_json"
+            sdk_pipeline_url: "https://privacyscrubber.com/sdk/?src=mcp_compliance_json"
           }
         };
 
@@ -1925,7 +1994,7 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
 
 ### 🏢 Enterprise & Team Governance
 * **Team Governance & Encrypted Handoff:** Centrally deploy redaction rules, audit logs, and zero-knowledge session handoff with **PrivacyScrubber TEAMS** ($99/mo flat): [privacyscrubber.com/teams](https://privacyscrubber.com/teams?src=mcp_compliance_report)
-* **Backend Microservices & RAG Pipelines:** Integrate in-memory sanitization (<1ms) into your Node.js/Python infrastructure with **Developer SDK** ($299/mo): [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?tier=sdk&src=mcp_compliance_report)
+* **Backend Microservices & RAG Pipelines:** Integrate in-memory sanitization (<1ms) into your Node.js/Python infrastructure with **Developer SDK** ($299/mo): [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/?src=mcp_compliance_report)
 
 *Certified Offline by PrivacyScrubber Engine v${MCP_VERSION}*  
 *Verify at: https://privacyscrubber.com/features/audit-receipt/* | ⭐ *Star on GitHub: https://github.com/moxno/privacyscrubber-mcp*`;
@@ -1953,6 +2022,7 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
       }
 
       const targetSession = getSessionMap(session_id);
+      const targetIgnoreList = getSessionIgnoreList(session_id);
       // Transparent in-memory unmasking of any token placeholders before local execution
       const rawExecutableCommand = reverseTokens(command, targetSession);
 
@@ -1982,9 +2052,9 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
       const { processedText: cleanStdout, wasTruncated: truncOut } = truncateIfFree(stdout, license.isPro, charLimit);
       const { processedText: cleanStderr, wasTruncated: truncErr } = truncateIfFree(stderr, license.isPro, charLimit);
 
-      const resCommand = performSanitization(command, targetProfile, sessionIgnoreList, targetSession);
-      const resStdout = performSanitization(cleanStdout, targetProfile, sessionIgnoreList, targetSession);
-      const resStderr = performSanitization(cleanStderr, targetProfile, sessionIgnoreList, targetSession);
+      const resCommand = performSanitization(command, targetProfile, targetIgnoreList, targetSession);
+      const resStdout = performSanitization(cleanStdout, targetProfile, targetIgnoreList, targetSession);
+      const resStderr = performSanitization(cleanStderr, targetProfile, targetIgnoreList, targetSession);
 
       const allNewTokens = { ...resCommand.newTokens, ...resStdout.newTokens, ...resStderr.newTokens };
       const tokenCount = Object.keys(allNewTokens).length;
@@ -2005,7 +2075,7 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
     }
 
     if (name === "guard_read_file") {
-      const { file_path, profile = "Dev", max_lines = 500 } = args || {};
+      const { file_path, profile = "Dev", max_lines = 500, session_id = "default" } = args || {};
       if (!file_path || typeof file_path !== "string") {
         return {
           isError: true,
@@ -2045,7 +2115,9 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
       const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
 
       const { processedText, wasTruncated: wasCharTruncated } = truncateIfFree(capped, license.isPro, charLimit);
-      const { scrubbedText, newTokens } = performSanitization(processedText, targetProfile, sessionIgnoreList);
+      const currentSession = getSessionMap(session_id);
+      const currentIgnoreList = getSessionIgnoreList(session_id);
+      const { scrubbedText, newTokens } = performSanitization(processedText, targetProfile, currentIgnoreList, currentSession);
 
       const telemetry = buildCisoAuditTelemetry(newTokens);
       const receiptMd = formatAuditReceipt(telemetry, false, (wasLineTruncated || wasCharTruncated), charLimit);
@@ -2448,18 +2520,20 @@ Before reading sensitive files, running terminal commands that may print credent
       for (let i = 0; i < results.length; i++) {
         const item = results[i];
         if (typeof item === 'string') {
-          const restored = reverseTokens(item, targetSession);
-          for (const token of Object.keys(targetSession)) {
-            if (item.includes(token)) totalTokensRestored++;
-          }
+          const res = (PrivacyScrubberCore && typeof PrivacyScrubberCore.unscrubText === 'function')
+            ? PrivacyScrubberCore.unscrubText(item, targetSession)
+            : { restoredText: reverseTokens(item, targetSession), restoredCount: 0 };
+          const restored = (res && typeof res.restoredText === 'string') ? res.restoredText : (typeof res === 'string' ? res : item);
+          totalTokensRestored += (res.restoredCount || 0);
           restoredResults.push(restored);
         } else if (item && typeof item === 'object') {
           const copy = { ...item };
           const rawText = copy.text || copy.pageContent || copy.document || '';
-          const restored = reverseTokens(rawText, targetSession);
-          for (const token of Object.keys(targetSession)) {
-            if (rawText.includes(token)) totalTokensRestored++;
-          }
+          const res = (PrivacyScrubberCore && typeof PrivacyScrubberCore.unscrubText === 'function')
+            ? PrivacyScrubberCore.unscrubText(rawText, targetSession)
+            : { restoredText: reverseTokens(rawText, targetSession), restoredCount: 0 };
+          const restored = (res && typeof res.restoredText === 'string') ? res.restoredText : (typeof res === 'string' ? res : rawText);
+          totalTokensRestored += (res.restoredCount || 0);
 
           if (copy.text !== undefined) copy.text = restored;
           if (copy.pageContent !== undefined) copy.pageContent = restored;
@@ -2549,7 +2623,7 @@ Before reading sensitive files, running terminal commands that may print credent
           verification_url: `https://privacyscrubber.com/features/audit-receipt/#verify?hash=${sessionHash.substring(0, 16)}`,
           licensing_and_governance: {
             teams_governance_url: "https://privacyscrubber.com/teams?src=mcp_audit_json",
-            sdk_pipeline_url: "https://privacyscrubber.com/pricing?tier=sdk&src=mcp_audit_json"
+            sdk_pipeline_url: "https://privacyscrubber.com/sdk/?src=mcp_audit_json"
           }
         }, null, 2);
       } else if (format === "markdown") {
@@ -2581,7 +2655,7 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
 
 ### 🏢 Enterprise & Team Governance
 * **Team Governance & Encrypted Handoff:** Centrally deploy redaction rules, audit logs, and zero-knowledge session handoff with **PrivacyScrubber TEAMS** ($99/mo flat): [privacyscrubber.com/teams](https://privacyscrubber.com/teams?src=mcp_audit_export)
-* **Backend Microservices & RAG Pipelines:** Integrate in-memory sanitization (<1ms) into your Node.js/Python infrastructure with **Developer SDK** ($299/mo): [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?tier=sdk&src=mcp_audit_export)
+* **Backend Microservices & RAG Pipelines:** Integrate in-memory sanitization (<1ms) into your Node.js/Python infrastructure with **Developer SDK** ($299/mo): [privacyscrubber.com/sdk](https://privacyscrubber.com/sdk/?src=mcp_audit_export)
 
 *Certified Offline by PrivacyScrubber Engine v${MCP_VERSION}*  
 *Verify at: https://privacyscrubber.com/features/audit-receipt/* | ⭐ *Star on GitHub: https://github.com/moxno/privacyscrubber-mcp*`;
@@ -2740,7 +2814,7 @@ server.connect(transport).then(() => {
   mcpLog(`${colors.greenBold}✅ PrivacyScrubber ZTDS MCP Server v${MCP_VERSION} started successfully.${colors.reset}\n`);
   mcpLog(`${colors.cyan}📦 Need programmatic in-code redaction? Try: npm install @privacyscrubber/sdk${colors.reset}\n`);
   mcpLog(`${colors.yellowBold}⭐ Star us on GitHub: https://github.com/moxno/privacyscrubber-mcp${colors.reset}\n`);
-  mcpLog(`${colors.cyan}👉 Developer SDK & Enterprise: https://privacyscrubber.com/pricing${colors.reset}\n`);
+  mcpLog(`${colors.cyan}👉 Developer SDK & Enterprise: https://privacyscrubber.com/sdk/${colors.reset}\n`);
 }).catch((error) => {
   console.error("Failed to connect MCP server transport:", error);
   process.exit(1);

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "privacyscrubber/pii-masking-mcp",
-  "version": "2.2.6",
+  "version": "2.3.1",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "author": {
     "name": "PrivacyScrubber",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "2.2.6",
+  "version": "2.3.1",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",

package/pii-masking-run.js

@@ -27,7 +27,7 @@ const cmdIndex = args.indexOf("--");
 
 if (args.includes("--version") || args.includes("-v")) {
   const pkgPath = path.resolve(__dirname, './package.json');
-  let version = '2.2.4';
+  let version = '2.2.10';
   try { version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version; } catch (_) {}
   console.log(`ps-guard / pii-masking-run v${version} (PrivacyScrubber MCP)`);
   process.exit(0);
@@ -278,25 +278,72 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
     frameworksSet.add('GDPR (Art. 4)');
     frameworksSet.add('CCPA/CPRA');
   }
-  if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT')) {
+  if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT') || types.includes('NATIONAL_ID')) {
     frameworksSet.add('SOC 2 Type II');
     frameworksSet.add('ISO 27001 (A.8.11)');
   }
-  if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD'].includes(t))) {
+  if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD', 'STRIPE_KEY', 'TAX_ID', 'EIN', 'W2', '1099', 'SALARY', 'WAGE'].includes(t))) {
     frameworksSet.add('PCI DSS v4.0');
+    frameworksSet.add('IRC § 7216 & GLBA');
   }
-  if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT'].includes(t))) {
+  if (types.some(t => ['MRN', 'HEALTH', 'MEDICAL', 'PATIENT', 'DIAGNOSIS', 'NPI', 'DEA'].includes(t))) {
     frameworksSet.add('HIPAA §164.514');
   }
-  if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY'].includes(t))) {
+  if (types.some(t => ['CASE_NUMBER', 'DOCKET', 'PRIVILEGED', 'LEGAL', 'ATTORNEY', 'COURT', 'CONTRACT', 'NDA'].includes(t))) {
+    frameworksSet.add('FRE 502 (Privilege)');
+  }
+  if (types.some(t => ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'KEY', 'AWS_KEY', 'JWT_TOKEN', 'API_TOKEN', 'CREDENTIAL'].includes(t))) {
     frameworksSet.add('NIST SP 800-53');
   }
+  if (totalCount > 0) {
+    frameworksSet.add('EU AI Act (Art. 50)');
+  }
+
+  const ipHoldings = {
+    standard: 'IETF draft-sibiryakov-ztds-protocol-00',
+    standardUrl: 'https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/',
+    patent: 'IL 331905 (Tracking: 94221)',
+    wipoDas: 'B17B',
+    trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
+  };
+
+  const statutoryCitations = [
+    {
+      statute: 'EU AI Act (Art. 50)',
+      scope: 'AI Transparency & Data Minimization',
+      rule: '0-byte external network transmission; prevents unauthorized ingestion into frontier models.'
+    },
+    {
+      statute: 'GDPR (Art. 4, 25, 28, 32)',
+      scope: 'Pseudonymization & Processor Liability',
+      rule: 'Volatile client-side tokenization eliminates GDPR Article 28 data processor liability.'
+    },
+    {
+      statute: 'HIPAA 45 CFR § 164.514(b)',
+      scope: 'Safe Harbor De-Identification',
+      rule: 'Deterministic removal of all 18 PHI identifiers prior to AI analysis.'
+    },
+    {
+      statute: 'IRC § 7216 & IRS Pub. 1075',
+      scope: 'Tax Return Information Confidentiality',
+      rule: 'Strict criminal penalty safeguard against unauthorized disclosure of tax records to cloud LLMs.'
+    },
+    {
+      statute: 'FRE 502',
+      scope: 'Attorney-Client Privilege Preservation',
+      rule: 'Automated in-memory redaction prevents inadvertent waiver of legal privilege in AI workflows.'
+    }
+  ];
+
   return {
     totalCount,
     entities,
     types,
     riskLevel,
-    frameworksList: Array.from(frameworksSet)
+    frameworksList: Array.from(frameworksSet),
+    statutoryCitations,
+    ipHoldings,
+    multimodalEgress: '0.00 Bytes (Solid Blackout & Burn-in Verified)'
   };
 }
 
@@ -437,7 +484,7 @@ Before reading sensitive files, running terminal commands that may print credent
   generatedFiles.forEach(f => console.log(`  - ${f}`));
   console.log(`\nSupport open-source Zero-Trust AI tools:`);
   console.log(`  GitHub Star: https://github.com/moxno/privacyscrubber-mcp (or: gh repo star moxno/privacyscrubber-mcp)`);
-  console.log(`  Backend SDK: npm install @privacyscrubber/sdk (https://privacyscrubber.com/pricing)`);
+  console.log(`  Backend SDK: npm install @privacyscrubber/sdk (https://privacyscrubber.com/sdk/)`);
   process.exit(0);
 }