@privacyscrubber/mcp-server 2.4.5 → 2.4.6

package/index.js

@@ -82,6 +82,9 @@ if (rawCliArgs.includes('--memo') || rawCliArgs.includes('memo')) {
   console.log(generateProcurementMemo({ targetTier: tierArg, format: 'text' }));
   process.exit(0);
 }
+if (rawCliArgs.includes('--hook')) {
+  await import('./pii-masking-run.js');
+}
 if (rawCliArgs.some(arg => ['init', 'install', '--install', 'setup', '--setup', 'uninstall', '--uninstall', '--remove'].includes(arg))) {
   const { runInstaller } = await import('./install.js');
   const isRemove = rawCliArgs.some(arg => ['uninstall', '--uninstall', '--remove'].includes(arg));
@@ -1364,6 +1367,15 @@ We request approval to acquire a **PrivacyScrubber TEAMS License** (\$99/month f
 `;
 }
 
+const MCP_SYSTEM_INSTRUCTIONS = [
+  "Zero-Trust Data Sanitization (ZTDS) Protocol Active (100% local RAM, 0 network egress).",
+  "AUTOMATIC INTERCEPTION RULES FOR AI AGENTS:",
+  "1. FILE READS: Before reading .env, configs, logs, database dumps, or documents (DOCX/PDF/XLSX/CSV/JSON), call 'guard_read_file' (or 'sanitize_file') instead of native file read tools.",
+  "2. SHELL & GIT: Route terminal commands that may output secrets or PII through 'guard_exec', and inspect diffs via 'guard_git_diff'.",
+  "3. RAW TEXT & RAG: Sanitize raw user PII/secrets in prompts via 'sanitize_text' (or 'guard_rag_chunk' for vector chunks) before external reasoning.",
+  "4. LOCAL RESTORATION: Keep placeholders like [EMAIL_1], [API_KEY_1], [NAME_1] intact during reasoning. Call 'reveal_text' to restore final answers, 'guard_apply_patch' to write unmasked code/configs to disk, or 'guard_unmask_args' for local tool calls."
+].join("\n");
+
 // Create the MCP server
 const server = new Server(
   {
@@ -1377,6 +1389,7 @@ const server = new Server(
       logging: {},
       resources: {},
     },
+    instructions: MCP_SYSTEM_INSTRUCTIONS,
   }
 );
 
@@ -1387,6 +1400,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "audit_context",
         description: "STEP 0 (Pre-Flight): Non-destructive security inspection of raw prompts or document chunks before sending to LLMs. Evaluates PII, secrets, risk severity (CLEAN, LOW, MODERATE, CRITICAL), and triggered regulatory frameworks (GDPR, HIPAA, SOC 2, PCI DSS) with zero text mutation.",
+        annotations: {
+          title: "Audit Context for PII & Secrets",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1414,6 +1434,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "sanitize_text",
         description: "STEP 1: Call this first. You MUST NOT process raw user data before calling this. Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM. Supports General and all 30 specialized industry profiles in RAM session map. (For in-code backend services or RAG vector pipelines outside of MCP, use '@privacyscrubber/sdk': npm i @privacyscrubber/sdk)",
+        annotations: {
+          title: "Sanitize Text in Local RAM",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1446,44 +1473,16 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["text"]
         }
       },
-      {
-        name: "scrub_text",
-        description: "Alias for 'sanitize_text'. Locally scrubs PII, secrets, and credentials from prompts or text before LLM ingestion. Supports General and all 30 specialized industry profiles in RAM session map.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            text: {
-              type: "string",
-              description: "The raw text, code, or logs to sanitize."
-            },
-            profile: {
-              type: "string",
-              description: PROFILE_PARAM_DESCRIPTION
-            },
-            sector: {
-              type: "string",
-              description: SECTOR_PARAM_DESCRIPTION
-            },
-            compact: {
-              type: "boolean",
-              description: "Optional. Compact 1-line audit summary."
-            },
-            ignore_list: {
-              type: "array",
-              items: { type: "string" },
-              description: "Optional list of plaintext values to skip during detection."
-            },
-            session_id: {
-              type: "string",
-              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
-            }
-          },
-          required: ["text"]
-        }
-      },
       {
         name: "reveal_text",
         description: "STEP 3: Call this last. You MUST pass your final generated response through this tool to restore tokens (e.g., [EMAIL_1]) back with the original private data from the local volatile RAM-only session map before showing it to the user. Supports both standard batch mode and real-time streaming mode (stream: true).",
+        annotations: {
+          title: "Restore Tokens in Local RAM",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1510,6 +1509,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "stream_reveal_text",
         description: "STEP 3 (Streaming): Real-time streaming token detokenizer for LLM Server-Sent Events (SSE) and stdio chunk pipelines. Buffers split token candidates across chunk boundaries (e.g. '[EM' + 'AIL_1]') so no characters or tokens are corrupted. Pass 'flush: true' on the final chunk.",
+        annotations: {
+          title: "Streaming Token Detokenizer",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: false,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1535,43 +1541,20 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "sanitize_file",
-        description: "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            file_path: {
-              type: "string",
-              description: "Absolute path to the file to sanitize."
-            },
-            profile: {
-              type: "string",
-              description: PROFILE_PARAM_DESCRIPTION
-            },
-            sector: {
-              type: "string",
-              description: SECTOR_PARAM_DESCRIPTION
-            },
-            compact: {
-              type: "boolean",
-              description: "Optional. Compact 1-line audit summary."
-            },
-            session_id: {
-              type: "string",
-              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
-            }
-          },
-          required: ["file_path"]
-        }
-      },
-      {
-        name: "scrub_file",
-        description: "Alias for 'sanitize_file'. Reads and sanitizes a local file.",
+        description: "Reads a local file (including plain text, source code, .eml, .rtf, .docx, .pdf, .xlsx), sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
+        annotations: {
+          title: "Sanitize Local File in RAM",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
             file_path: {
               type: "string",
-              description: "Absolute path to the file to sanitize."
+              description: "Absolute or workspace-relative path to the file to sanitize."
             },
             profile: {
               type: "string",
@@ -1596,6 +1579,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "audit_directory_for_pii",
         description: "Scans a local directory for leaks of secrets, keys, and PII. Returns a summary report. Use this tool for Security Auditing.",
+        annotations: {
+          title: "Audit Directory for PII & Secrets",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1627,6 +1617,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "redact_file",
         description: "Action/Redact: In-place redaction of a local file. Replaces PII and secrets with tokens and saves the file. By default, creates a .bak backup. Use dry_run=true to test without modifying.",
+        annotations: {
+          title: "In-Place File Redaction",
+          readOnlyHint: false,
+          destructiveHint: true,
+          idempotentHint: false,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1657,6 +1654,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "create_default_config",
         description: "Creates a default 'privacyscrubber.json' configuration file in the active workspace root directory if one does not exist. Includes template structures for custom regex rules and exclusion bypass patterns.",
+        annotations: {
+          title: "Create Default Workspace Config",
+          readOnlyHint: false,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {},
@@ -1666,6 +1670,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "generate_compliance_report",
         description: "Generates an official Zero-Trust Compliance Audit Certificate (GDPR, HIPAA, EU AI Act, SOC 2) for the current MCP session. Returns cryptographic session hash, masked entities breakdown, and compliance certification.",
+        annotations: {
+          title: "Generate Compliance Audit Certificate",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1693,6 +1704,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "mark_false_positive",
         description: "Marks a previously detected token as a false positive. The original plaintext value will be excluded from all future sanitize_text calls in this session. Returns the restored original value and updated ignore list size.",
+        annotations: {
+          title: "Mark Token as False Positive",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1711,6 +1729,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "check_status",
         description: "Returns the current PrivacyScrubber MCP tier, session usage, available profiles, and PRO upgrade instructions. Call this to see your license status or get setup help.",
+        annotations: {
+          title: "Check MCP License & Session Status",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {},
@@ -1720,6 +1745,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_exec",
         description: "Zero-Trust Agentic Guard: Safely executes a shell/terminal command locally in isolated process, sanitizes stdout and stderr in volatile RAM, tokenizes any API keys, credentials, database URIs, or PII before sending output to LLM. Maps original values in memory for safe local restoration.",
+        annotations: {
+          title: "Guard Shell Command Execution",
+          readOnlyHint: false,
+          destructiveHint: true,
+          idempotentHint: false,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1742,6 +1774,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             timeout_ms: {
               type: "number",
               description: "Execution timeout in milliseconds. Defaults to 15000 (15s)."
+            },
+            session_id: {
+              type: "string",
+              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
             }
           },
           required: ["command"]
@@ -1749,7 +1785,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "guard_read_file",
-        description: "Zero-Trust Agentic Guard: Reads a sensitive local file (.env, config, credentials, source code, database dumps), sanitizes all credentials and PII in volatile RAM, and returns safe tokenized content for AI agent context.",
+        description: "Zero-Trust Agentic Guard: Preferred over native file read tools. Reads any sensitive local file (.env, config, credentials, source code, database dumps, .docx, .pdf, .xlsx, .eml, .rtf), sanitizes all credentials and PII in volatile RAM, and returns safe tokenized content for AI agent context.",
+        annotations: {
+          title: "Guard Local File Read",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1768,6 +1811,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             max_lines: {
               type: "number",
               description: "Optional line cap for large files. Defaults to 500."
+            },
+            session_id: {
+              type: "string",
+              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
             }
           },
           required: ["file_path"]
@@ -1776,6 +1823,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_git_diff",
         description: "Zero-Trust Agentic Guard: Inspects unstaged or staged git diffs locally, sanitizes any newly added or modified credentials, tokens, or PII in RAM, and returns safe diff for AI commit generation or code review.",
+        annotations: {
+          title: "Guard Git Diff Inspection",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1806,6 +1860,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_apply_patch",
         description: "Zero-Trust Agentic Guard: Reverses token placeholders ([API_KEY_1], [SECRET_1]) in AI-generated code or text, restores authentic values from local volatile RAM, and writes real content directly to target file on disk. Remote LLM never learns actual secrets.",
+        annotations: {
+          title: "Guard Apply Unmasked Patch to Disk",
+          readOnlyHint: false,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1820,6 +1881,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             create_backup: {
               type: "boolean",
               description: "Whether to create a .bak backup if target file already exists. Defaults to true."
+            },
+            session_id: {
+              type: "string",
+              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
             }
           },
           required: ["file_path", "content"]
@@ -1827,7 +1892,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "create_agent_rules",
-        description: "Zero-Trust Agentic Guard: Scaffolds CISO-grade AI Agent Rules in workspace (.cursorrules, .windsurfrules, CLAUDE.md, .github/copilot-instructions.md, .clinerules). Guides autonomous agents to route all file reads, git diffs, and shell commands through PrivacyScrubber Guard tools.",
+        description: "Zero-Trust Agentic Guard: Scaffolds CISO-grade AI Agent Rules in workspace (.cursor/rules/privacyscrubber.mdc, .cursorrules, .windsurfrules, CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, .clinerules). Guides autonomous agents to route all file reads, git diffs, and shell commands through PrivacyScrubber Guard tools.",
+        annotations: {
+          title: "Scaffold AI Agent Security Rules",
+          readOnlyHint: false,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1835,7 +1907,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
               type: "array",
               items: {
                 type: "string",
-                enum: ["all", "cursor", "windsurf", "claude_code", "copilot", "cline"]
+                enum: ["all", "cursor", "windsurf", "claude_code", "agents_md", "codex", "copilot", "cline"]
               },
               description: "List of agent targets to generate rules for. Use ['all'] to generate rules for all supported AI agents."
             },
@@ -1850,6 +1922,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_unmask_args",
         description: "Zero-Trust Agentic Guard: Detokenizes parameters, JSON objects, or arguments in local RAM before dispatching to local tools or APIs without sending cleartext secrets back to the LLM.",
+        annotations: {
+          title: "Unmask Tool Arguments in Local RAM",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1867,6 +1946,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_session_info",
         description: "Zero-Trust Agentic Guard: Returns diagnostic metrics on active in-memory sessions, token counts, and memory footprint with zero plaintext leakage.",
+        annotations: {
+          title: "Inspect RAM Session Diagnostics",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1881,6 +1967,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_session_reset",
         description: "Zero-Trust Agentic Guard: Explicitly purges the in-memory token map for a specific session_id or all sessions upon agent task completion.",
+        annotations: {
+          title: "Reset RAM Session Token Map",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1899,6 +1992,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_rag_chunk",
         description: "Zero-Trust Agentic Guard: Sanitizes an array of document chunks or knowledge base records before sending to embedding models or vector databases (Chroma, Pinecone, Qdrant). Keeps authentic data in local RAM with zero network leakage.",
+        annotations: {
+          title: "Sanitize RAG Document Chunks",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1939,6 +2039,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "guard_rag_restore",
         description: "Zero-Trust Agentic Guard: Re-hydrates retrieved vector search results or chunks by restoring token placeholders with authentic data from the volatile RAM session before presenting to the user.",
+        annotations: {
+          title: "Restore RAG Vector Search Results",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -1972,6 +2079,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "export_audit_log",
         description: "Zero-Trust Enterprise Compliance: Exports an immutable, tamper-evident audit log in SIEM standard formats (CEF / ArcSight, RFC 5424 Syslog, JSONL, or JSON) with zero plaintext PII leakage. Can write directly to a local log file or stream.",
+        annotations: {
+          title: "Export SIEM Compliance Audit Log",
+          readOnlyHint: false,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -2006,6 +2120,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "generate_procurement_memo",
         description: "Zero-Trust Enterprise Procurement: Generates an executive-ready Procurement & ROI Memorandum for Chief Information Security Officers (CISO), Data Protection Officers (DPO), and VP of Engineering. Compares TCO of traditional Cloud DLP ($1.5k–$4k/mo) vs PrivacyScrubber TEAMS ($99/mo flat) or Developer SDK ($299/mo flat), citing statutory frameworks (GDPR Art. 4/28, HIPAA §164.514, SOC 2 Type II, PCI DSS v4.0, NIST SP 800-53, EU AI Act Art. 50).",
+        annotations: {
+          title: "Generate CISO Procurement & ROI Memo",
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        },
         inputSchema: {
           type: "object",
           properties: {
@@ -2178,11 +2299,51 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
   throw new Error(`Resource not found: ${uri}`);
 });
 
+function getEffectiveWorkspaceRoots() {
+  const roots = [];
+  const addCandidate = (dir) => {
+    if (!dir || typeof dir !== 'string') return;
+    const trimmed = dir.trim();
+    if (!trimmed) return;
+    try {
+      const resolved = fs.existsSync(trimmed) ? fs.realpathSync(trimmed) : path.resolve(trimmed);
+      if (!roots.includes(resolved)) roots.push(resolved);
+    } catch (_) {
+      const fallback = path.resolve(trimmed);
+      if (!roots.includes(fallback)) roots.push(fallback);
+    }
+  };
+
+  addCandidate(process.cwd());
+  addCandidate(process.env.PRIVACYSCRUBBER_WORKSPACE);
+  addCandidate(process.env.CURSOR_WORKSPACE_PATH);
+  addCandidate(process.env.VSCODE_CWD);
+  addCandidate(process.env.PROJECT_ROOT);
+  addCandidate(process.env.INIT_CWD);
+  if (process.env.WORKSPACE_FOLDER_PATHS) {
+    for (const part of process.env.WORKSPACE_FOLDER_PATHS.split(path.delimiter)) {
+      addCandidate(part);
+    }
+  }
+  return roots;
+}
+
+function isWithinAnyWorkspaceRoot(targetPath, roots) {
+  for (const root of roots) {
+    const rel = path.relative(root, targetPath);
+    if (!rel.startsWith("..") && !path.isAbsolute(rel)) {
+      return { ok: true, matchedRoot: root };
+    }
+  }
+  return { ok: false, matchedRoot: roots[0] || process.cwd() };
+}
+
 function resolveWorkspaceSafePath(inputPath, paramName = "file_path") {
-  const workspaceRoot = fs.existsSync(process.cwd()) ? fs.realpathSync(process.cwd()) : path.resolve(process.cwd());
-  const resolvedPath = path.resolve(workspaceRoot, inputPath);
-  const relToRoot = path.relative(workspaceRoot, resolvedPath);
-  if (relToRoot.startsWith("..") || path.isAbsolute(relToRoot)) {
+  const roots = getEffectiveWorkspaceRoots();
+  const primaryRoot = roots[0];
+  const resolvedPath = path.resolve(primaryRoot, inputPath);
+  const boundaryCheck = isWithinAnyWorkspaceRoot(resolvedPath, roots);
+  if (!boundaryCheck.ok) {
     return {
       ok: false,
       error: `Error: Security policy violation — target '${paramName}' resolves outside the active workspace directory (path traversal blocked).`
@@ -2196,15 +2357,15 @@ function resolveWorkspaceSafePath(inputPath, paramName = "file_path") {
   }
   if (fs.existsSync(checkCursor)) {
     const realCheck = fs.realpathSync(checkCursor);
-    const relReal = path.relative(workspaceRoot, realCheck);
-    if (relReal.startsWith("..") || path.isAbsolute(relReal)) {
+    const realBoundary = isWithinAnyWorkspaceRoot(realCheck, roots);
+    if (!realBoundary.ok) {
       return {
         ok: false,
         error: `Error: Security policy violation — target path symlink escapes the active workspace directory.`
       };
     }
   }
-  return { ok: true, resolvedPath, workspaceRoot };
+  return { ok: true, resolvedPath, workspaceRoot: boundaryCheck.matchedRoot };
 }
 
 // Handle tool execution calls
@@ -2239,18 +2400,21 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, dryRunMap, license.isPro);
       const telemetry = buildCisoAuditTelemetry(result.tokenMap || {});
 
+      const structuredAudit = {
+        riskLevel: telemetry.riskLevel,
+        totalDetected: telemetry.totalDetected,
+        entities: telemetry.entities,
+        triggeredFrameworks: telemetry.triggeredFrameworks,
+        profile: targetProfile,
+        executionEngine: "ZTDS Client-Side RAM"
+      };
+
       if (format === "json") {
         return {
+          structuredContent: structuredAudit,
           content: [{
             type: "text",
-            text: JSON.stringify({
-              riskLevel: telemetry.riskLevel,
-              totalDetected: telemetry.totalDetected,
-              entities: telemetry.entities,
-              triggeredFrameworks: telemetry.triggeredFrameworks,
-              profile: targetProfile,
-              executionEngine: "ZTDS Client-Side RAM"
-            }, null, 2)
+            text: JSON.stringify(structuredAudit, null, 2)
           }]
         };
       }
@@ -2275,6 +2439,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       return {
+        structuredContent: structuredAudit,
         content: [{ type: "text", text: report }]
       };
     }
@@ -2335,6 +2500,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const receiptMd = formatAuditReceipt(telemetry, compact, wasTruncated, charLimit);
 
       return {
+        structuredContent: {
+          scrubbedText,
+          tokensRedacted: telemetry.totalCount,
+          riskLevel: telemetry.riskLevel,
+          entities: telemetry.entities,
+          frameworks: telemetry.frameworksList,
+          profile: finalProfile,
+          sessionId: session_id,
+          wasTruncated: Boolean(wasTruncated)
+        },
         content: [
           { type: "text", text: scrubbedText + receiptMd }
         ]
@@ -2404,6 +2579,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       restoredText = restoredText.replace(/\b(mysql|postgresql|postgres|redis|mongodb|https?|ftp|ssh|git|aws):\/\/\1:\/\//gi, '$1://');
 
       return {
+        structuredContent: {
+          restoredText,
+          restoredCount: restored.restoredCount || 0,
+          sessionId: session_id
+        },
         content: [
           {
             type: "text",
@@ -2584,9 +2764,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                   const dataStart = localOffset + 30 + lNameLen + lExtraLen;
                   const compData = docxBuf.subarray(dataStart, dataStart + compSize);
                   if (method === 0) {
-                    zipEntries[entryName] = compData.toString('utf8');
+                    if (compData.length <= 20 * 1024 * 1024) {
+                      zipEntries[entryName] = compData.toString('utf8');
+                    }
                   } else if (method === 8) {
-                    zipEntries[entryName] = zlib.inflateRawSync(compData).toString('utf8');
+                    zipEntries[entryName] = zlib.inflateRawSync(compData, { maxOutputLength: 20 * 1024 * 1024 }).toString('utf8');
                   }
                 }
                 pos += 46 + nameLen + extraLen + commentLen;
@@ -2910,6 +3092,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const receiptMd = formatAuditReceipt(telemetry, compact, wasTruncated, charLimit);
 
       return {
+        structuredContent: {
+          scrubbedText,
+          tokensRedacted: telemetry.totalCount,
+          riskLevel: telemetry.riskLevel,
+          entities: telemetry.entities,
+          frameworks: telemetry.frameworksList,
+          profile: finalProfile,
+          sessionId: session_id,
+          wasTruncated: Boolean(wasTruncated)
+        },
         content: [
           { type: "text", text: scrubbedText + receiptMd }
         ]
@@ -2931,7 +3123,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       try {
-        const stat = await fs.promises.stat(resolvedRedactPath);
+        const lstat = await fs.promises.lstat(resolvedRedactPath);
+        if (lstat.isSymbolicLink() || !lstat.isFile()) {
+          return { isError: true, content: [{ type: "text", text: `Error: Target must be a regular non-symlink file.` }] };
+        }
+        const stat = lstat;
         if (stat.size > 50 * 1024 * 1024) {
           return { isError: true, content: [{ type: "text", text: `Error: File is too large (>50MB).` }] };
         }
@@ -3229,20 +3425,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       async function walkDir(dir) {
         const entries = await fs.promises.readdir(dir, { withFileTypes: true });
         for (const entry of entries) {
+          if (entry.isSymbolicLink && entry.isSymbolicLink()) continue;
           const fullPath = path.join(dir, entry.name);
+          const safeChild = resolveWorkspaceSafePath(fullPath, "directory_path");
+          if (!safeChild.ok) continue;
           if (entry.isDirectory()) {
-            if (!ignoreDirs.includes(entry.name)) await walkDir(fullPath);
+            if (!ignoreDirs.includes(entry.name)) await walkDir(safeChild.resolvedPath);
           } else if (entry.isFile()) {
             if (extensions && extensions.length > 0) {
               const ext = path.extname(entry.name);
               if (!extensions.includes(ext)) continue;
             }
-            filesToScan.push(fullPath);
+            filesToScan.push(safeChild.resolvedPath);
           }
         }
       }
 
-      await walkDir(directory_path);
+      await walkDir(safeDir.resolvedPath);
 
       let reportLines = [`## Security Audit Report: ${directory_path}`];
       let filesWithIssues = 0;
@@ -3443,23 +3642,72 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
       const rawBuffer = fs.readFileSync(resolvedPath);
-      const checkLen = Math.min(rawBuffer.length, 8000);
-      for (let i = 0; i < checkLen; i++) {
-        if (rawBuffer[i] === 0) {
-          return {
-            isError: true,
-            content: [{ type: "text", text: `Error: Binary file format detected. Use sanitize_file for DOCX/PDF/XLSX documents.` }]
-          };
-        }
-      }
+      const ext = path.extname(resolvedPath).toLowerCase();
       const license = checkLicenseStatus();
       const limitStatus = checkFreeTierLimit(license.isPro);
       if (limitStatus.blocked) {
         return buildDailyLimitBlockedResponse();
       }
 
-      let rawContent = rawBuffer.toString('utf8');
-      const ext = path.extname(resolvedPath).toLowerCase();
+      let rawContent = '';
+      if (ext === '.docx') {
+        try {
+          const mammoth = require('mammoth');
+          const result = await mammoth.extractRawText({ buffer: rawBuffer });
+          rawContent = result.value || '';
+        } catch (docxErr) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: Failed to parse DOCX file: ${docxErr.message}` }]
+          };
+        }
+      } else if (ext === '.pdf' || ext === '.xlsx' || ext === '.xls') {
+        if (!license.isPro) {
+          return {
+            isError: true,
+            content: [{
+              type: "text",
+              text: `🔒 [PrivacyScrubber PRO / TEAMS] PDF and Excel file sanitization is a PRO feature (${ext === '.pdf' ? 'PDF' : 'Excel/XLSX'} detected).\n\n👉 7-Day Free B2B Trial (No card): https://privacyscrubber.com/pricing/?tier=teams&trial=true&utm_source=mcp_cli&utm_medium=file_type&utm_campaign=b2b_trial`
+            }]
+          };
+        }
+        if (ext === '.pdf') {
+          try {
+            const pdf = require('pdf-parse');
+            const data = await pdf(rawBuffer);
+            rawContent = data.text || '';
+          } catch (pdfErr) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Failed to parse PDF file: ${pdfErr.message}` }]
+            };
+          }
+        } else {
+          try {
+            const XLSX = require('xlsx');
+            const workbook = XLSX.read(rawBuffer, { type: 'buffer' });
+            workbook.SheetNames.forEach(sheetName => {
+              rawContent += `--- Sheet: ${sheetName} ---\n` + XLSX.utils.sheet_to_csv(workbook.Sheets[sheetName]) + '\n';
+            });
+          } catch (xlsxErr) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Failed to parse Excel file: ${xlsxErr.message}` }]
+            };
+          }
+        }
+      } else {
+        const checkLen = Math.min(rawBuffer.length, 8000);
+        for (let i = 0; i < checkLen; i++) {
+          if (rawBuffer[i] === 0) {
+            return {
+              isError: true,
+              content: [{ type: "text", text: `Error: Binary file format detected. Only plain text, source code, and document formats (.docx, .pdf, .xlsx, .eml, .rtf) are supported.` }]
+            };
+          }
+        }
+        rawContent = rawBuffer.toString('utf8');
+      }
       if (ext === '.eml') {
         const decodeQpUtf8 = (str) =>
           str.replace(/=\r?\n/g, '').replace(/(?:=[0-9A-Fa-f]{2})+/g, (seq) => {
@@ -3599,28 +3847,26 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
-      const workspaceRoot = fs.existsSync(process.cwd()) ? fs.realpathSync(process.cwd()) : path.resolve(process.cwd());
-      const resolvedPath = path.resolve(workspaceRoot, file_path);
-      const relToRoot = path.relative(workspaceRoot, resolvedPath);
-      if (relToRoot.startsWith("..") || path.isAbsolute(relToRoot)) {
+      const safeTarget = resolveWorkspaceSafePath(file_path, "file_path");
+      if (!safeTarget.ok) {
         return {
           isError: true,
-          content: [{ type: "text", text: "Error: Security policy violation — target 'file_path' resolves outside the active workspace directory (path traversal blocked)." }]
+          content: [{ type: "text", text: safeTarget.error }]
         };
       }
-      let checkCursor = resolvedPath;
-      while (!fs.existsSync(checkCursor)) {
-        const parentCursor = path.dirname(checkCursor);
-        if (parentCursor === checkCursor) break;
-        checkCursor = parentCursor;
+      const resolvedPath = safeTarget.resolvedPath;
+
+      const license = checkLicenseStatus();
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return buildDailyLimitBlockedResponse();
       }
-      if (fs.existsSync(checkCursor)) {
-        const realCheck = fs.realpathSync(checkCursor);
-        const relReal = path.relative(workspaceRoot, realCheck);
-        if (relReal.startsWith("..") || path.isAbsolute(relReal)) {
+      if (fs.existsSync(resolvedPath)) {
+        const existingLstat = fs.lstatSync(resolvedPath);
+        if (existingLstat.isSymbolicLink() || !existingLstat.isFile()) {
           return {
             isError: true,
-            content: [{ type: "text", text: "Error: Security policy violation — target path symlink escapes the active workspace directory." }]
+            content: [{ type: "text", text: "Error: Security policy violation — target must be a regular non-symlink file." }]
           };
         }
       }
@@ -3665,7 +3911,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
         targetDir = safeWorkspace.resolvedPath;
       }
-      const targets = agent_types.includes("all") ? ["cursor", "windsurf", "claude_code", "copilot", "cline"] : agent_types;
+      const targets = agent_types.includes("all") ? ["cursor", "windsurf", "claude_code", "copilot", "cline", "agents_md"] : agent_types;
 
       const ruleText = `# PrivacyScrubber Zero-Trust Agentic Guard (CISO Security Rules)
 # 100% Local In-Memory Data Sanitization. Zero Network Egress.
@@ -3689,6 +3935,14 @@ Before reading sensitive files, running terminal commands that may print credent
         const p = path.join(targetDir, '.cursorrules');
         fs.writeFileSync(p, ruleText, 'utf8');
         generatedFiles.push('.cursorrules');
+
+        const cursorRulesDir = path.join(targetDir, '.cursor', 'rules');
+        try {
+          if (!fs.existsSync(cursorRulesDir)) fs.mkdirSync(cursorRulesDir, { recursive: true });
+          const mdcContent = `---\ndescription: PrivacyScrubber Zero-Trust Data Sanitization (ZTDS) Agentic Guard\nglobs: *\nalwaysApply: true\n---\n\n${ruleText}`;
+          fs.writeFileSync(path.join(cursorRulesDir, 'privacyscrubber.mdc'), mdcContent, 'utf8');
+          generatedFiles.push('.cursor/rules/privacyscrubber.mdc');
+        } catch (_) {}
       }
       if (targets.includes("windsurf")) {
         const p = path.join(targetDir, '.windsurfrules');
@@ -3708,6 +3962,19 @@ Before reading sensitive files, running terminal commands that may print credent
           generatedFiles.push('CLAUDE.md');
         }
       }
+      if (targets.includes("agents_md") || targets.includes("codex")) {
+        const p = path.join(targetDir, 'AGENTS.md');
+        if (fs.existsSync(p)) {
+          const existing = fs.readFileSync(p, 'utf8');
+          if (!existing.includes("Zero-Trust Agentic Guard")) {
+            fs.writeFileSync(p, existing + "\n\n" + ruleText, 'utf8');
+            generatedFiles.push('AGENTS.md (appended)');
+          }
+        } else {
+          fs.writeFileSync(p, ruleText, 'utf8');
+          generatedFiles.push('AGENTS.md');
+        }
+      }
       if (targets.includes("copilot")) {
         const copilotDir = path.join(targetDir, '.github');
         if (!fs.existsSync(copilotDir)) fs.mkdirSync(copilotDir, { recursive: true });
@@ -3721,7 +3988,57 @@ Before reading sensitive files, running terminal commands that may print credent
         generatedFiles.push('.clinerules');
       }
 
+      if (args?.include_hooks !== false && (targets.includes("cursor") || targets.includes("claude_code") || agent_types.includes("all"))) {
+        const hookCmd = "npx -y @privacyscrubber/mcp-server --hook";
+        if (targets.includes("cursor") || agent_types.includes("all")) {
+          try {
+            const cursorHooksPath = path.join(targetDir, '.cursor', 'hooks.json');
+            fs.mkdirSync(path.dirname(cursorHooksPath), { recursive: true });
+            let cursorHooks = { version: 1, hooks: {} };
+            if (fs.existsSync(cursorHooksPath)) {
+              try { cursorHooks = JSON.parse(fs.readFileSync(cursorHooksPath, 'utf8')); } catch (_) {}
+            }
+            if (!cursorHooks.hooks || typeof cursorHooks.hooks !== 'object') cursorHooks.hooks = {};
+            for (const ev of ['beforeReadFile', 'beforeShellExecution']) {
+              if (!Array.isArray(cursorHooks.hooks[ev])) cursorHooks.hooks[ev] = [];
+              if (!cursorHooks.hooks[ev].some(h => h && h.command && h.command.includes('privacyscrubber'))) {
+                cursorHooks.hooks[ev].push({ command: hookCmd });
+              }
+            }
+            fs.writeFileSync(cursorHooksPath, JSON.stringify(cursorHooks, null, 2) + '\n', 'utf8');
+            generatedFiles.push('.cursor/hooks.json');
+          } catch (_) {}
+        }
+        if (targets.includes("claude_code") || agent_types.includes("all")) {
+          try {
+            const claudeSettingsPath = path.join(targetDir, '.claude', 'settings.json');
+            fs.mkdirSync(path.dirname(claudeSettingsPath), { recursive: true });
+            let claudeSettings = {};
+            if (fs.existsSync(claudeSettingsPath)) {
+              try { claudeSettings = JSON.parse(fs.readFileSync(claudeSettingsPath, 'utf8')); } catch (_) {}
+            }
+            if (!claudeSettings.hooks || typeof claudeSettings.hooks !== 'object') claudeSettings.hooks = {};
+            if (!Array.isArray(claudeSettings.hooks.PreToolUse)) claudeSettings.hooks.PreToolUse = [];
+            const hasClaudeHook = claudeSettings.hooks.PreToolUse.some(entry =>
+              Array.isArray(entry?.hooks) && entry.hooks.some(h => h && h.command && h.command.includes('privacyscrubber'))
+            );
+            if (!hasClaudeHook) {
+              claudeSettings.hooks.PreToolUse.push({
+                matcher: "Read|Bash",
+                hooks: [{ type: "command", command: hookCmd }]
+              });
+            }
+            fs.writeFileSync(claudeSettingsPath, JSON.stringify(claudeSettings, null, 2) + '\n', 'utf8');
+            generatedFiles.push('.claude/settings.json');
+          } catch (_) {}
+        }
+      }
+
       return {
+        structuredContent: {
+          workspace: targetDir,
+          generatedFiles
+        },
         content: [{
           type: "text",
           text: `[Zero-Trust Agentic Guard: Agent Rules Generated]\n` +
@@ -3744,22 +4061,38 @@ Before reading sensitive files, running terminal commands that may print credent
       }
 
       const targetSession = getSessionMap(session_id);
+      const seenUnmask = new WeakMap();
 
       function unmaskRecursive(val) {
         if (typeof val === 'string') {
           return reverseTokens(val, targetSession);
         }
-        if (Array.isArray(val)) {
-          return val.map(unmaskRecursive);
+        if (val === null || typeof val !== 'object') return val;
+        if (
+          val instanceof Date ||
+          val instanceof RegExp ||
+          val instanceof Error ||
+          ArrayBuffer.isView(val) ||
+          (typeof ArrayBuffer !== 'undefined' && val instanceof ArrayBuffer)
+        ) {
+          return val;
         }
-        if (val !== null && typeof val === 'object') {
-          const res = {};
-          for (const [k, v] of Object.entries(val)) {
-            res[k] = unmaskRecursive(v);
+        if (seenUnmask.has(val)) return seenUnmask.get(val);
+        if (Array.isArray(val)) {
+          const outArr = [];
+          seenUnmask.set(val, outArr);
+          for (let i = 0; i < val.length; i++) {
+            outArr.push(unmaskRecursive(val[i]));
           }
-          return res;
+          return outArr;
         }
-        return val;
+        const res = {};
+        seenUnmask.set(val, res);
+        for (const [k, v] of Object.entries(val)) {
+          if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;
+          res[k] = unmaskRecursive(v);
+        }
+        return res;
       }
 
       const unmasked = unmaskRecursive(targetArgs);
@@ -3772,17 +4105,20 @@ Before reading sensitive files, running terminal commands that may print credent
         }
       }
 
+      const unmaskPayload = {
+        status: "success",
+        success: true,
+        session_id,
+        tokens_restored: tokensRestored,
+        unmasked_count: tokensRestored,
+        unmasked_args: unmasked
+      };
+
       return {
+        structuredContent: unmaskPayload,
         content: [{
           type: "text",
-          text: JSON.stringify({
-            status: "success",
-            success: true,
-            session_id,
-            tokens_restored: tokensRestored,
-            unmasked_count: tokensRestored,
-            unmasked_args: unmasked
-          }, null, 2)
+          text: JSON.stringify(unmaskPayload, null, 2)
         }]
       };
     }
@@ -3796,6 +4132,7 @@ Before reading sensitive files, running terminal commands that may print credent
         const session = agentSessions.get(sid);
         if (!session) {
           return {
+            structuredContent: { sessionId: sid, exists: false, totalTokens: 0 },
             content: [{
               type: "text",
               text: `[Zero-Trust Agentic Guard: Session Info]\nSession '${sid}' does not exist or has expired.`
@@ -3806,6 +4143,16 @@ Before reading sensitive files, running terminal commands that may print credent
         const telemetry = buildCisoAuditTelemetry(session.map);
         const streamBufferLen = session.streamDetokenizer ? session.streamDetokenizer.buffer.length : 0;
         return {
+          structuredContent: {
+            sessionId: sid,
+            exists: true,
+            createdAt: new Date(session.createdAt).toISOString(),
+            lastActive: new Date(session.lastActive).toISOString(),
+            totalTokens: tokenEntries.length,
+            streamBufferBytes: streamBufferLen,
+            entities: telemetry.entities,
+            riskLevel: telemetry.riskLevel
+          },
           content: [{
             type: "text",
             text: `[Zero-Trust Agentic Guard: Session Info - ${sid}]\n` +
@@ -3830,6 +4177,13 @@ Before reading sensitive files, running terminal commands that may print credent
       }
 
       return {
+        structuredContent: {
+          activeSessions: agentSessions.size,
+          totalTokens,
+          heapUsedMb: Number((memUsage.heapUsed / (1024 * 1024)).toFixed(2)),
+          uptimeSeconds: Math.floor(process.uptime()),
+          sessions: sessionList
+        },
         content: [{
           type: "text",
           text: `[Zero-Trust Agentic Guard: Global Session Diagnostics]\n` +
@@ -3928,19 +4282,21 @@ Before reading sensitive files, running terminal commands that may print credent
 
       const telemetry = buildCisoAuditTelemetry(targetSession);
       const auditReceipt = formatAuditReceipt(telemetry);
+      const ragChunkPayload = {
+        status: "success",
+        session_id,
+        total_chunks: chunks.length,
+        tokens_redacted_in_batch: totalTokensRedacted,
+        total_session_tokens: Object.keys(targetSession).length,
+        risk_level: telemetry.riskLevel,
+        sanitized_chunks: sanitizedChunks
+      };
 
       return {
+        structuredContent: ragChunkPayload,
         content: [{
           type: "text",
-          text: JSON.stringify({
-            status: "success",
-            session_id,
-            total_chunks: chunks.length,
-            tokens_redacted_in_batch: totalTokensRedacted,
-            total_session_tokens: Object.keys(targetSession).length,
-            risk_level: telemetry.riskLevel,
-            sanitized_chunks: sanitizedChunks
-          }, null, 2) + `\n\n${auditReceipt}`
+          text: JSON.stringify(ragChunkPayload, null, 2) + `\n\n${auditReceipt}`
         }]
       };
     }
@@ -3988,16 +4344,19 @@ Before reading sensitive files, running terminal commands that may print credent
         }
       }
 
+      const ragRestorePayload = {
+        status: "success",
+        session_id,
+        total_results: results.length,
+        tokens_restored: totalTokensRestored,
+        restored_results: restoredResults
+      };
+
       return {
+        structuredContent: ragRestorePayload,
         content: [{
           type: "text",
-          text: JSON.stringify({
-            status: "success",
-            session_id,
-            total_results: results.length,
-            tokens_restored: totalTokensRestored,
-            restored_results: restoredResults
-          }, null, 2)
+          text: JSON.stringify(ragRestorePayload, null, 2)
         }]
       };
     }
@@ -4026,6 +4385,9 @@ Before reading sensitive files, running terminal commands that may print credent
       const sessionHash = receipt.receiptSha256;
 
       let outputText = "";
+      const safeCompanyName = String(company_name || "Organization").replace(/[\r\n\x00-\x1f]/g, " ").trim().slice(0, 120);
+      const safeDepartment = String(department || "Security & Compliance").replace(/[\r\n\x00-\x1f]/g, " ").trim().slice(0, 120);
+
       const eventData = {
         vendor: "PrivacyScrubber",
         product: "ZTDS",
@@ -4036,8 +4398,8 @@ Before reading sensitive files, running terminal commands that may print credent
         entities: telemetry.entities,
         frameworks: telemetry.frameworksList,
         sessionHash,
-        organization: company_name,
-        department
+        organization: safeCompanyName,
+        department: safeDepartment
       };
 
       if (format === "cef") {
@@ -4045,19 +4407,35 @@ Before reading sensitive files, running terminal commands that may print credent
       } else if (format === "syslog") {
         outputText = formatSyslogEvent(eventData);
       } else if (format === "json" || format === "markdown") {
-        outputText = formatPsr2Report({ format, receipt, telemetry, company_name, department, utmSource: 'mcp_audit_export', utmMedium: format });
+        outputText = formatPsr2Report({ format, receipt, telemetry, company_name: safeCompanyName, department: safeDepartment, utmSource: 'mcp_audit_export', utmMedium: format });
       } else {
         // Default: jsonl
         outputText = formatJsonlEvent(eventData);
       }
 
       if (typeof destination_file === 'string' && destination_file.trim()) {
+        const safeDest = resolveWorkspaceSafePath(destination_file.trim(), "destination_file");
+        if (!safeDest.ok) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: safeDest.error }]
+          };
+        }
         try {
-          const dir = path.dirname(destination_file);
+          if (fs.existsSync(safeDest.resolvedPath)) {
+            const st = fs.lstatSync(safeDest.resolvedPath);
+            if (st.isSymbolicLink() || !st.isFile()) {
+              return {
+                isError: true,
+                content: [{ type: "text", text: "Error: Security policy violation — destination_file must be a regular non-symlink file." }]
+              };
+            }
+          }
+          const dir = path.dirname(safeDest.resolvedPath);
           if (!fs.existsSync(dir)) {
             fs.mkdirSync(dir, { recursive: true });
           }
-          fs.appendFileSync(destination_file, outputText + '\n', 'utf8');
+          fs.appendFileSync(safeDest.resolvedPath, outputText + '\n', 'utf8');
         } catch (e) {
           return {
             isError: true,
@@ -4067,6 +4445,15 @@ Before reading sensitive files, running terminal commands that may print credent
       }
 
       return {
+        structuredContent: {
+          format,
+          riskLevel: telemetry.riskLevel,
+          tokensMasked: telemetry.totalCount,
+          entities: telemetry.entities,
+          frameworks: telemetry.frameworksList,
+          receiptSha256: sessionHash,
+          timestamp
+        },
         content: [{
           type: "text",
           text: outputText