@privacyscrubber/mcp-server 2.4.5 → 2.4.7

package/install.js

@@ -234,6 +234,8 @@ export function parseArgs(rawArgs = process.argv.slice(2)) {
     dryRun: false,
     remove: false,
     all: false,
+    rules: false,
+    hooks: false,
     targets: [],
     help: false
   };
@@ -242,6 +244,8 @@ export function parseArgs(rawArgs = process.argv.slice(2)) {
     if (arg === '--dry-run') options.dryRun = true;
     else if (arg === '--remove' || arg === '--uninstall') options.remove = true;
     else if (arg === '--all') options.all = true;
+    else if (arg === '--rules') options.rules = true;
+    else if (arg === '--hooks') options.hooks = true;
     else if (arg === '--claude') options.targets.push('claude');
     else if (arg === '--claude-code') options.targets.push('claude-code', 'claude-code-project');
     else if (arg === '--cursor') options.targets.push('cursor', 'cursor-storage', 'cursor-workspace');
@@ -249,7 +253,11 @@ export function parseArgs(rawArgs = process.argv.slice(2)) {
     else if (arg === '--zed') options.targets.push('zed');
     else if (arg === '--windsurf') options.targets.push('windsurf');
     else if (arg === '--cline') options.targets.push('cline', 'roo');
-    else if (arg === '--workspace') options.targets.push('cursor-workspace', 'claude-code-project', 'vscode');
+    else if (arg === '--workspace') {
+      options.targets.push('cursor-workspace', 'claude-code-project', 'vscode');
+      options.rules = true;
+      options.hooks = true;
+    }
     else if (arg === '--help' || arg === '-h') options.help = true;
   }
 
@@ -327,7 +335,8 @@ Options:
   --zed           Configure Zed IDE (~/.config/zed/settings.json)
   --windsurf      Configure Windsurf only
   --cline         Configure Cline / Roo-Code only
-  --workspace     Configure workspace paths (.cursor, .mcp.json, .vscode)
+  --workspace     Configure workspace paths (.cursor, .mcp.json, .vscode) & agent rules
+  --rules         Scaffold native AI agent rules (.cursor/rules/privacyscrubber.mdc, AGENTS.md)
   --dry-run       Preview configuration changes without writing files
   --remove        Remove PrivacyScrubber from all target client configurations
   -h, --help      Display this help guide
@@ -400,12 +409,94 @@ Options:
     console.log('');
   }
 
+  if (options.rules && !options.remove) {
+    const cwd = process.cwd();
+    const mdcPath = path.join(cwd, '.cursor', 'rules', 'privacyscrubber.mdc');
+    const agentsMdPath = path.join(cwd, 'AGENTS.md');
+    const ruleBody = [
+      '# PrivacyScrubber Zero-Trust Agentic Guard (ZTDS)',
+      '1. Never read `.env`, `*secret*`, `*credentials*`, `*.pem`, `*.key`, or database dumps with native `read_file` / `cat`. Call `guard_read_file` or `sanitize_file`.',
+      '2. Route shell commands that may print credentials or PII through `guard_exec`, and inspect git diffs via `guard_git_diff`.',
+      '3. Keep tokens like `[API_KEY_1]`, `[EMAIL_1]` intact during reasoning. Restore final answers via `reveal_text` or write to disk via `guard_apply_patch`.'
+    ].join('\n');
+    const mdcContent = `---\ndescription: PrivacyScrubber Zero-Trust Data Sanitization (ZTDS) — Mandatory PII & Secret Guard\nglobs: "**/*"\nalwaysApply: true\n---\n\n${ruleBody}\n`;
+
+    if (options.dryRun) {
+      console.log(`[DRY-RUN OK]: Would scaffold agent rules in ${mdcPath} and ${agentsMdPath}\n`);
+    } else {
+      try {
+        fs.mkdirSync(path.dirname(mdcPath), { recursive: true });
+        if (!fs.existsSync(mdcPath) || !fs.readFileSync(mdcPath, 'utf8').includes('PrivacyScrubber Zero-Trust Agentic Guard')) {
+          fs.writeFileSync(mdcPath, mdcContent, 'utf8');
+          console.log(`[RULES] Created ${mdcPath}`);
+        }
+        if (!fs.existsSync(agentsMdPath)) {
+          fs.writeFileSync(agentsMdPath, ruleBody + '\n', 'utf8');
+          console.log(`[RULES] Created ${agentsMdPath}`);
+        } else {
+          const existingAgents = fs.readFileSync(agentsMdPath, 'utf8');
+          if (!existingAgents.includes('PrivacyScrubber Zero-Trust Agentic Guard')) {
+            fs.writeFileSync(agentsMdPath, existingAgents.trimEnd() + '\n\n' + ruleBody + '\n', 'utf8');
+            console.log(`[RULES] Updated ${agentsMdPath}`);
+          }
+        }
+      } catch (_) {}
+    }
+  }
+
+  if (options.hooks && !options.remove) {
+    const cwd = process.cwd();
+    const cursorHooksPath = path.join(cwd, '.cursor', 'hooks.json');
+    const claudeSettingsPath = path.join(cwd, '.claude', 'settings.json');
+    const hookCmd = 'npx -y @privacyscrubber/mcp-server --hook';
+
+    if (options.dryRun) {
+      console.log(`[DRY-RUN OK]: Would scaffold IDE lifecycle hooks in ${cursorHooksPath} and ${claudeSettingsPath}\n`);
+    } else {
+      try {
+        fs.mkdirSync(path.dirname(cursorHooksPath), { recursive: true });
+        let cursorHooks = { version: 1, hooks: {} };
+        if (fs.existsSync(cursorHooksPath)) {
+          try { cursorHooks = JSON.parse(fs.readFileSync(cursorHooksPath, 'utf8')); } catch (_) {}
+        }
+        if (!cursorHooks.hooks || typeof cursorHooks.hooks !== 'object') cursorHooks.hooks = {};
+        for (const ev of ['beforeReadFile', 'beforeShellExecution']) {
+          if (!Array.isArray(cursorHooks.hooks[ev])) cursorHooks.hooks[ev] = [];
+          if (!cursorHooks.hooks[ev].some(h => h && h.command && h.command.includes('privacyscrubber'))) {
+            cursorHooks.hooks[ev].push({ command: hookCmd });
+          }
+        }
+        fs.writeFileSync(cursorHooksPath, JSON.stringify(cursorHooks, null, 2) + '\n', 'utf8');
+        console.log(`[HOOKS] Configured ${cursorHooksPath}`);
+
+        fs.mkdirSync(path.dirname(claudeSettingsPath), { recursive: true });
+        let claudeSettings = {};
+        if (fs.existsSync(claudeSettingsPath)) {
+          try { claudeSettings = JSON.parse(fs.readFileSync(claudeSettingsPath, 'utf8')); } catch (_) {}
+        }
+        if (!claudeSettings.hooks || typeof claudeSettings.hooks !== 'object') claudeSettings.hooks = {};
+        if (!Array.isArray(claudeSettings.hooks.PreToolUse)) claudeSettings.hooks.PreToolUse = [];
+        const hasClaudeHook = claudeSettings.hooks.PreToolUse.some(entry =>
+          Array.isArray(entry?.hooks) && entry.hooks.some(h => h && h.command && h.command.includes('privacyscrubber'))
+        );
+        if (!hasClaudeHook) {
+          claudeSettings.hooks.PreToolUse.push({
+            matcher: 'Read|Bash',
+            hooks: [{ type: 'command', command: hookCmd }]
+          });
+        }
+        fs.writeFileSync(claudeSettingsPath, JSON.stringify(claudeSettings, null, 2) + '\n', 'utf8');
+        console.log(`[HOOKS] Configured ${claudeSettingsPath}`);
+      } catch (_) {}
+    }
+  }
+
   console.log('--------------------------------------------------');
   if (configuredCount > 0) {
     console.log(`[SUMMARY] ${options.remove ? 'Cleaned' : 'Configured'} ${configuredCount} AI client(s) successfully.`);
     if (!options.remove) {
       console.log('Next step: Restart your AI IDE or Claude Desktop to activate PrivacyScrubber.');
-      console.log('\x1b[36m💼 B2B 7-Day Free Trial (TEAMS/SDK): npx @privacyscrubber/mcp-server trial\x1b[0m');
+      console.log('\x1b[36m💼 B2B 7-Day Free Trial (TEAMS $99/mo · SDK $299/mo): npx @privacyscrubber/mcp-server trial  |  https://privacyscrubber.com/pricing/?tier=teams&trial=true&utm_source=mcp_install\x1b[0m');
       console.log('\x1b[36m📋 Generate CISO Procurement Memo:   npx @privacyscrubber/mcp-server memo\x1b[0m');
       console.log('\x1b[33m⭐ Enjoying zero-trust privacy? Star the repo on GitHub: https://github.com/moxno/privacyscrubber-mcp\x1b[0m');
       console.log('\x1b[90m   One-click CLI: gh repo star moxno/privacyscrubber-mcp && gh repo star moxno/ztds.ai\x1b[0m');

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "privacyscrubber/pii-masking-mcp",
-  "version": "2.4.5",
+  "version": "2.4.7",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "author": {
     "name": "PrivacyScrubber",
@@ -30,21 +30,17 @@
       "description": "STEP 3: Call this last. Restores masked tokens back with original private data from the local volatile RAM-only session map."
     },
     {
-      "name": "audit_context",
-      "description": "STEP 0 (Pre-Flight): Non-destructive security inspection of raw prompts or document chunks before sending to LLMs. Evaluates PII, secrets, risk severity, and triggered regulatory frameworks."
+      "name": "stream_reveal_text",
+      "description": "STEP 3 (Streaming): Real-time streaming token detokenizer for LLM Server-Sent Events (SSE) and stdio chunk pipelines."
     },
     {
-      "name": "scrub_text",
-      "description": "Alias for sanitize_text."
+      "name": "audit_context",
+      "description": "STEP 0 (Pre-Flight): Non-destructive security inspection of raw prompts or document chunks before sending to LLMs. Evaluates PII, secrets, risk severity, and triggered regulatory frameworks."
     },
     {
       "name": "sanitize_file",
       "description": "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory."
     },
-    {
-      "name": "scrub_file",
-      "description": "Alias for sanitize_file."
-    },
     {
       "name": "audit_directory_for_pii",
       "description": "Scans a local directory for leaks of secrets, keys, and PII. Returns a structured security summary report."
@@ -116,7 +112,9 @@
     {
       "name": "generate_procurement_memo",
       "description": "Zero-Trust Enterprise Procurement: Generates an executive-ready Procurement & ROI Memorandum for CISOs, DPOs, and VP of Engineering."
-    },
+    }
+  ],
+  "prompts": [
     {
       "name": "secure_ai_workflow",
       "description": "Zero-Trust Data Sanitization workflow instruction to automatically scrub PII before processing data."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "2.4.5",
+  "version": "2.4.7",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",
@@ -13,10 +13,8 @@
     "install.js",
     "pii-masking-run.js",
     "scrubber-core.cjs",
-    "ps-license-manager.js",
     "ps-license-manager.cjs",
     "ps-pii-engine.cjs",
-    "ps-pii-engine.js",
     "config-schema.json",
     "smithery.yaml",
     "server.json",