@privacyscrubber/mcp-server 2.4.2 → 2.4.4

package/.well-known/mcp/server-card.json

@@ -0,0 +1,78 @@
+{
+  "serverInfo": {
+    "name": "privacyscrubber/pii-masking-mcp",
+    "version": "1.6.9"
+  },
+  "tools": [
+    {
+      "name": "sanitize_text",
+      "description": "Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "text": {
+            "type": "string",
+            "description": "The raw text, code, or logs to sanitize."
+          },
+          "profile": {
+            "type": "string",
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+          }
+        },
+        "required": ["text"]
+      }
+    },
+    {
+      "name": "reveal_text",
+      "description": "Replaces masked tokens (e.g., [EMAIL_1], [API_KEY_1]) in the LLM's response back with the original private data from the local volatile RAM-only session map.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "text": {
+            "type": "string",
+            "description": "The AI generated response containing placeholders to restore."
+          }
+        },
+        "required": ["text"]
+      }
+    },
+    {
+      "name": "sanitize_file",
+      "description": "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "file_path": {
+            "type": "string",
+            "description": "Absolute path to the file to sanitize."
+          },
+          "profile": {
+            "type": "string",
+            "description": "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+          }
+        },
+        "required": ["file_path"]
+      }
+    },
+    {
+      "name": "create_default_config",
+      "description": "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
+    },
+    {
+      "name": "check_status",
+      "description": "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "required": []
+      }
+    }
+  ],
+  "resources": [],
+  "prompts": []
+}

package/LICENSE

@@ -0,0 +1,23 @@
+# PrivacyScrubber MCP Server License Agreement
+
+**Copyright (c) 2026 Ilya Sibiryakov (BrandMeWeb). All Rights Reserved.**
+
+### 1. Grant of License — Community / Development Tier
+Subject to the terms and conditions of this Agreement, BrandMeWeb grants you a personal, worldwide, non-exclusive, non-transferable license to install and run the PrivacyScrubber MCP Server (`@privacyscrubber/mcp-server`) in local IDE environments (such as Cursor, Windsurf, Claude Desktop, and CLI tools) solely for personal evaluation, development, and standard local data sanitization under published Free Tier quotas.
+
+### 2. Commercial, Multi-User & Enterprise Tier
+Use of this software within commercial organizations, production automated pipelines, CI/CD gates, high-volume batch processing, multi-seat corporate teams, or the invocation of the 30 Specialized Industry Profiles (HIPAA PHI, Financial PAN/IBAN, Legal Privilege, DevSecOps Cloud Secrets, Automotive, Telecom, Biotech) requires a valid commercial license key:
+- **PrivacyScrubber PRO**: Individual professional use ($15/mo or $110 Lifetime).
+- **PrivacyScrubber TEAMS**: Team and small enterprise seats ($99/mo flat).
+- **PrivacyScrubber Enterprise / Air-Gapped**: Dedicated corporate VPC clusters, Nitro Enclaves, and custom profile calibration ($12,000/yr).
+
+Licensing and key activation: https://privacyscrubber.com/pricing
+
+### 3. Restrictions on Reverse-Engineering & Redistribution
+Except as expressly authorized herein, you may not:
+- Decompile, disassemble, reverse-engineer, or attempt to reconstruct the underlying pattern databases, regular expression taxonomies, or proprietary tokenization finite-state machines.
+- Extract, harvest, or scrape the 30 specialized industry entity taxonomies to train competing machine learning models or build competing redaction products.
+- Distribute, sublicense, lease, or commercially exploit standalone copies of the engine without an active Enterprise OEM agreement.
+
+### 4. Disclaimer of Warranties & Limitation of Liability
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -482,7 +482,7 @@ Returns a visual dashboard showing your current tier, session request count, act
 *   **Response Example (Free Tier):**
     ```
     ╔══════════════════════════════════════════════════╗
-    ║       PrivacyScrubber MCP Server v2.4.2          ║
+    ║       PrivacyScrubber MCP Server v2.4.4          ║
     ╠══════════════════════════════════════════════════╣
     ║  🔓 Tier: FREE                                   ║
     ║  📊 Session requests: 5                          ║

package/index.js

@@ -352,7 +352,7 @@ export class StreamingDetokenizer {
     const tailLen = 160;
     const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
     const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
     if (m) {
       const candidate = m[0];
@@ -814,7 +814,7 @@ function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
-    const m = t.match(/\[([A-Z_]+)_\d+\]/);
+    const m = String(t).trim().match(/^(?:\[|<|\{\{|__)([A-Z0-9_]+)_\d+(?:\]|>|\}\}|__)$/);
     const type = m ? m[1] : 'CUSTOM';
     counts[type] = (counts[type] || 0) + 1;
   }

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "privacyscrubber/pii-masking-mcp",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "author": {
     "name": "PrivacyScrubber",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",
@@ -34,10 +34,10 @@
   },
   "scripts": {
     "start": "node index.js",
-    "build": "node -e \"const fs=require('fs'); if(fs.existsSync('../scripts/build-mcp.js')) require('child_process').execSync('node ../scripts/build-mcp.js', {stdio:'inherit'}); else console.log('MCP assets are pre-built.');\"",
+    "build": "node -e \"const fs=require('fs'); if(fs.existsSync('../scripts/build-mcp.js')) require('child_process').execSync('node ../scripts/build-mcp.js --keep-obfuscated', {stdio:'inherit'}); else console.log('MCP assets are pre-built.');\"",
     "test": "node test-mcp.js && node test-mcp-deep.js && node test-mcp-streaming.js",
     "test:stream": "node test-mcp-streaming.js",
-    "prepublishOnly": "npm test"
+    "prepublishOnly": "npm run build && node -e \"const fs=require('fs'); for(const f of ['ps-license-manager.js','ps-license-manager.cjs','ps-pii-engine.js','ps-pii-engine.cjs','scrubber-core.cjs']){const c=fs.readFileSync(f,'utf8'); if(c.includes('OFFLINE_KEY_SALT')||c.includes('computeV2Signature')||!c.includes('_0x')){console.error('FATAL: Unobfuscated '+f+' detected!'); process.exit(1);}}\" && npm test"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/pii-masking-run.js

@@ -27,7 +27,7 @@ const cmdIndex = args.indexOf("--");
 
 if (args.includes("--version") || args.includes("-v")) {
   const pkgPath = path.resolve(__dirname, './package.json');
-  let version = '2.4.2';
+  let version = '2.4.4';
   try { version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version; } catch (_) {}
   console.log(`ps-guard / pii-masking-run v${version} (PrivacyScrubber MCP)`);
   process.exit(0);
@@ -250,18 +250,23 @@ function performSanitization(text) {
   if (!license.isPro && result.tokenMap) {
     // Free tier: check for secrets and warn
     let hasSecrets = false;
+    const SECRET_TOKEN_RE = /^\[(?:SECRET|API_TOKEN|AWS_KEY|JWT_TOKEN|STRIPE_KEY|OPENAI_KEY|DB_URI)_\d+\]$/;
     Object.entries(result.tokenMap).forEach(([token, original]) => {
-      let isSecret = false;
-      for (const detector of DEVOPS_SECRETS_DETECTOR) {
-        detector.regex.lastIndex = 0;
-        if (detector.regex.test(original)) {
-          isSecret = true;
-          break;
+      let isSecret = SECRET_TOKEN_RE.test(token);
+      if (!isSecret) {
+        for (const detector of DEVOPS_SECRETS_DETECTOR) {
+          detector.regex.lastIndex = 0;
+          if (detector.regex.test(original)) {
+            isSecret = true;
+            break;
+          }
         }
       }
       if (isSecret) {
         hasSecrets = true;
         result.scrubbedText = result.scrubbedText.replaceAll(token, '[SECRET_BLOCKED_UPGRADE_TO_PRO]');
+        delete result.tokenMap[token];
+        delete localSessionMap[token];
       }
     });
 
@@ -280,7 +285,7 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
     const keys = Array.isArray(currentTokenMap) ? currentTokenMap : Object.keys(currentTokenMap);
     for (const t of keys) {
       const tokenStr = typeof t === 'string' ? t : (t.token || t.mask || '');
-      const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+      const match = tokenStr.match(/\[([A-Z0-9_]+)_\d+\]/);
       const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
       entities[baseType] = (entities[baseType] || 0) + 1;
       totalCount++;
@@ -289,7 +294,7 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
   const types = Object.keys(entities);
   let riskLevel = 'LOW EXPOSURE';
   if (totalCount > 0) {
-    const hasHighRisk = types.some(t => ['ID', 'SSN', 'CREDIT_CARD', 'PASSPORT', 'BANK', 'API_KEY', 'SECRET', 'PASSWORD', 'MRN', 'KEY'].includes(t));
+    const hasHighRisk = types.some(t => ['ID', 'SSN', 'CREDIT_CARD', 'PASSPORT', 'BANK', 'API_KEY', 'SECRET', 'PASSWORD', 'MRN', 'KEY', 'AWS_KEY', 'STRIPE_KEY', 'JWT_TOKEN', 'API_TOKEN'].includes(t));
     if (hasHighRisk || types.length >= 3 || totalCount >= 10) {
       riskLevel = 'CRITICAL (HIGH EXPOSURE)';
     } else if (types.length >= 2 || totalCount >= 3) {
@@ -399,7 +404,7 @@ function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString()) {
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
-    const m = t.match(/\[([A-Z_]+)_\d+\]/);
+    const m = String(t).trim().match(/^(?:\[|<|\{\{|__)([A-Z0-9_]+)_\d+(?:\]|>|\}\}|__)$/);
     const type = m ? m[1] : 'CUSTOM';
     counts[type] = (counts[type] || 0) + 1;
   }