@privacyscrubber/mcp-server 2.4.5 → 2.4.7

package/pii-masking-run.js

@@ -27,7 +27,7 @@ const cmdIndex = args.indexOf("--");
 
 if (args.includes("--version") || args.includes("-v")) {
   const pkgPath = path.resolve(__dirname, './package.json');
-  let version = '2.4.5';
+  let version = '2.4.7';
   try { version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version; } catch (_) {}
   console.log(`ps-guard / pii-masking-run v${version} (PrivacyScrubber MCP)`);
   process.exit(0);
@@ -35,6 +35,8 @@ if (args.includes("--version") || args.includes("-v")) {
 
 const isDiffMode = args.includes("--diff");
 const isRulesMode = args.includes("--rules");
+const isHookMode = args.includes("--hook");
+const isWrapMode = args.includes("--wrap");
 const isJsonMode = args.includes("--json");
 const isRestoreMode = args.includes("--restore") || args.includes("--unscrub");
 let tokenMapInput = null;
@@ -42,18 +44,49 @@ const tokenMapIdx = args.indexOf("--token-map");
 if (tokenMapIdx !== -1 && args[tokenMapIdx + 1]) {
   tokenMapInput = args[tokenMapIdx + 1];
 }
-const hasCommand = cmdIndex !== -1 && args.slice(cmdIndex + 1).length > 0;
+let hookPayloadArg = null;
+const payloadIdx = args.indexOf("--payload");
+if (payloadIdx !== -1 && args[payloadIdx + 1]) {
+  hookPayloadArg = args[payloadIdx + 1];
+}
+
+let wrapCommandArgs = [];
+if (isWrapMode) {
+  if (cmdIndex !== -1 && args.slice(cmdIndex + 1).length > 0) {
+    wrapCommandArgs = args.slice(cmdIndex + 1);
+  } else {
+    const wrapIdx = args.indexOf("--wrap");
+    const afterWrap = args.slice(wrapIdx + 1);
+    for (let i = 0; i < afterWrap.length; i++) {
+      const a = afterWrap[i];
+      if ((a === "--profile" || a === "--key" || a === "--token-map") && afterWrap[i + 1]) {
+        i++;
+        continue;
+      }
+      if (a === "--quiet" || a === "-q" || a === "--verbose" || a === "--json") {
+        continue;
+      }
+      wrapCommandArgs = afterWrap.slice(i);
+      break;
+    }
+  }
+}
+
+const hasCommand = (cmdIndex !== -1 && args.slice(cmdIndex + 1).length > 0) || wrapCommandArgs.length > 0;
 const hasStdin = !process.stdin.isTTY;
 
-if (args.includes("-h") || args.includes("--help") || (!hasCommand && !isDiffMode && !isRulesMode && !isRestoreMode && !hasStdin)) {
+if (args.includes("-h") || args.includes("--help") || (!hasCommand && !isDiffMode && !isRulesMode && !isHookMode && !isWrapMode && !isRestoreMode && !hasStdin)) {
   console.log("PrivacyScrubber CLI & Agentic Guard: ps-guard / pii-masking-run");
   console.log("\nUsage:");
   console.log("  npx ps-guard [options] -- <command> [args...]");
+  console.log("  npx ps-guard --wrap [options] [--] <mcp-server-cmd> [args...]");
   console.log("  cat <file> | npx ps-guard [options]");
   console.log("  npx ps-guard --diff [--staged] [options]");
   console.log("  npx ps-guard --restore --token-map <file|json> [options]");
   console.log("  npx ps-guard --rules [targets]");
+  console.log("  npx ps-guard --hook               (Claude Code & Cursor IDE PreToolUse / beforeReadFile hook)");
   console.log("\nOptions:");
+  console.log("  --wrap            Transparent JSON-RPC 2.0 stdio proxy for any 3rd-party MCP server");
   console.log("  --profile <name>  Specify detection profile (e.g. General, Dev, Medical, Legal, HR)");
   console.log("  --key <licKey>    PrivacyScrubber PRO License Key");
   console.log("  --json            Output structured JSON (scrubbedText, tokenMap, count, telemetry)");
@@ -62,11 +95,13 @@ if (args.includes("-h") || args.includes("--help") || (!hasCommand && !isDiffMod
   console.log("  --diff            Sanitize git diff output before committing or sending to AI");
   console.log("  --staged          Use staged git changes with --diff");
   console.log("  --rules [targets] Generate AI agent rules (.cursorrules, .windsurfrules, CLAUDE.md, copilot, cline)");
+  console.log("  --hook            Evaluate IDE lifecycle hook JSON from stdin (Claude Code & Cursor)");
   console.log("  -q, --quiet       Suppress stderr proof telemetry");
   console.log("  -v, --version     Print version");
   console.log("  -h, --help        Show this help screen");
   console.log("\nExamples:");
   console.log("  npx ps-guard -- cat database-dump.sql");
+  console.log("  npx ps-guard --wrap -- npx -y @modelcontextprotocol/server-postgres postgresql://localhost/mydb");
   console.log("  npx ps-guard --profile dev -- npm test");
   console.log("  cat .env | npx ps-guard --profile dev --json");
   console.log("  cat ai_reply.txt | npx ps-guard --restore --token-map map.json");
@@ -75,6 +110,98 @@ if (args.includes("-h") || args.includes("--help") || (!hasCommand && !isDiffMod
   process.exit(0);
 }
 
+// Fast-path Mode 0: Deterministic IDE Lifecycle Hook (--hook) for Claude Code & Cursor v1.7+
+if (isHookMode) {
+  const SENSITIVE_FILE_RX = /(?:^|[\\/])(?:\.env(?:\.[a-zA-Z0-9_-]+)?|id_rsa|id_ed25519|id_ecdsa|.*\.pem|.*\.key|.*\.p12|.*\.pfx|.*credentials.*\.json|.*secret.*\.(?:json|ya?ml|env|txt)|\.npmrc|\.pypirc|\.netrc)$/i;
+  const SAFE_TEMPLATE_RX = /\.(?:example|sample|template|dist|schema)$/i;
+  const SENSITIVE_CMD_RX = /(?:^|[;&|]\s*)(?:cat|head|tail|less|more|bat|sed|awk|grep)\s+[^\n|;&]*(?:\.env\b|id_rsa|\.pem\b|\.key\b|credentials\.json|\bsecrets?\.)|(?:^|[;&|]\s*)(?:printenv|env\s*$|export\s+-p|aws\s+configure\s+get|gcloud\s+auth\s+print-access-token)/i;
+
+  const evaluateHookPayload = (rawStr) => {
+    let payload = {};
+    try {
+      payload = rawStr && rawStr.trim() ? JSON.parse(rawStr) : {};
+    } catch (_) {
+      process.stdout.write(JSON.stringify({ permission: "allow", continue: true }) + "\n");
+      process.exit(0);
+    }
+
+    const eventName = String(payload.hook_event_name || payload.hookEventName || payload.event || "");
+    const toolName = String(payload.tool_name || payload.toolName || "");
+    const toolInput = (payload.tool_input || payload.toolInput || payload) || {};
+
+    const candidatePath = String(
+      toolInput.file_path || toolInput.path || toolInput.target_file || payload.file_path || payload.path || ""
+    ).trim();
+    const candidateCmd = String(
+      toolInput.command || toolInput.cmd || payload.command || ""
+    ).trim();
+
+    const isCursorEvent = /^(?:beforeReadFile|beforeShellExecution|beforeSubmitPrompt|beforeMCPExecution)$/i.test(eventName) ||
+      (!toolName && (payload.file_path !== undefined || payload.command !== undefined || payload.attachments !== undefined));
+
+    const isReadTool = /^(?:Read|View|read_file|view_file|ReadFile)$/i.test(toolName) || /^beforeReadFile$/i.test(eventName) || (!toolName && Boolean(candidatePath));
+    const isShellTool = /^(?:Bash|Execute|run_command| run_terminal_cmd)$/i.test(toolName) || /^beforeShellExecution$/i.test(eventName) || (!toolName && Boolean(candidateCmd));
+
+    if (isReadTool && candidatePath && SENSITIVE_FILE_RX.test(candidatePath) && !SAFE_TEMPLATE_RX.test(candidatePath)) {
+      const reason = `Blocked by PrivacyScrubber ZTDS policy: Direct read of sensitive file '${path.basename(candidatePath)}' is prohibited. Call the PrivacyScrubber MCP tool 'guard_read_file' or 'sanitize_file' instead so secrets are tokenized in local RAM.`;
+      if (isCursorEvent) {
+        process.stdout.write(JSON.stringify({
+          permission: "deny",
+          userMessage: `[PrivacyScrubber ZTDS] Direct read of ${path.basename(candidatePath)} blocked to prevent cloud egress.`,
+          agentMessage: reason
+        }) + "\n");
+        process.exit(0);
+      }
+      process.stdout.write(JSON.stringify({
+        permission: "deny",
+        hookSpecificOutput: {
+          hookEventName: eventName || "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: reason
+        }
+      }) + "\n");
+      process.stderr.write(reason + "\n");
+      process.exit(2);
+    }
+
+    if (isShellTool && candidateCmd && SENSITIVE_CMD_RX.test(candidateCmd)) {
+      const reason = `Blocked by PrivacyScrubber ZTDS policy: Shell command exposing raw credentials ('${candidateCmd.slice(0, 60)}') is prohibited. Call the PrivacyScrubber MCP tool 'guard_exec' instead so stdout/stderr are sanitized in local RAM.`;
+      if (isCursorEvent) {
+        process.stdout.write(JSON.stringify({
+          permission: "deny",
+          userMessage: `[PrivacyScrubber ZTDS] Shell command exposing raw credentials blocked.`,
+          agentMessage: reason
+        }) + "\n");
+        process.exit(0);
+      }
+      process.stdout.write(JSON.stringify({
+        permission: "deny",
+        hookSpecificOutput: {
+          hookEventName: eventName || "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: reason
+        }
+      }) + "\n");
+      process.stderr.write(reason + "\n");
+      process.exit(2);
+    }
+
+    process.stdout.write(JSON.stringify({ permission: "allow", continue: true }) + "\n");
+    process.exit(0);
+  };
+
+  if (hookPayloadArg !== null) {
+    evaluateHookPayload(hookPayloadArg);
+  } else if (!process.stdin.isTTY) {
+    let buf = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (c) => { buf += c; });
+    process.stdin.on("end", () => evaluateHookPayload(buf));
+  } else {
+    evaluateHookPayload("{}");
+  }
+}
+
 // Import the production core engine
 const scrubberCorePath = path.resolve(__dirname, './scrubber-core.cjs');
 const PrivacyScrubberCore = require(scrubberCorePath);
@@ -154,6 +281,13 @@ function resolveConfigPath() {
   return configPath;
 }
 
+function isCatastrophicRegex(pattern) {
+  if (!pattern || typeof pattern !== 'string' || pattern.length > 500) return true;
+  if (/(\([^)]*[+*][^)]*\))[+*?{]/.test(pattern)) return true;
+  if (/(\.\*){3,}/.test(pattern)) return true;
+  return false;
+}
+
 function loadCustomRules() {
   const license = checkLicenseStatus();
   const configPath = resolveConfigPath();
@@ -164,12 +298,20 @@ function loadCustomRules() {
       const rules = config.customRules || [];
       if (rules.length > 0) {
         if (license.isPro) {
-          return rules.map(r => ({
-            pattern: r.pattern || r.regex || "",
-            label: (r.label || r.category || "CUSTOM").toUpperCase(),
-            regex: r.pattern || r.regex || "",
-            category: (r.label || r.category || "CUSTOM").toUpperCase()
-          })).filter(r => r.pattern);
+          return rules.map(r => {
+            const pat = r.pattern || r.regex || "";
+            if (!pat || isCatastrophicRegex(pat)) return null;
+            try {
+              return {
+                pattern: pat,
+                label: (r.label || r.category || "CUSTOM").toUpperCase(),
+                regex: new RegExp(pat, "gi"),
+                category: (r.label || r.category || "CUSTOM").toUpperCase()
+              };
+            } catch (_) {
+              return null;
+            }
+          }).filter(Boolean);
         } else {
           process.stderr.write(`⚠️  [PrivacyScrubber] Custom rules detected in privacyscrubber.json, but are ignored in the Free Tier.\n👉  Set PRIVACYSCRUBBER_KEY to your PRO license key.\n`);
         }
@@ -246,34 +388,6 @@ function performSanitization(text) {
   if (result && result.tokenMap) {
     Object.assign(localSessionMap, result.tokenMap);
   }
-  
-  if (!license.isPro && result.tokenMap) {
-    // Free tier: check for secrets and warn
-    let hasSecrets = false;
-    const SECRET_TOKEN_RE = /^\[(?:SECRET|API_TOKEN|AWS_KEY|JWT_TOKEN|STRIPE_KEY|OPENAI_KEY|DB_URI)_\d+\]$/;
-    Object.entries(result.tokenMap).forEach(([token, original]) => {
-      let isSecret = SECRET_TOKEN_RE.test(token);
-      if (!isSecret) {
-        for (const detector of DEVOPS_SECRETS_DETECTOR) {
-          detector.regex.lastIndex = 0;
-          if (detector.regex.test(original)) {
-            isSecret = true;
-            break;
-          }
-        }
-      }
-      if (isSecret) {
-        hasSecrets = true;
-        result.scrubbedText = result.scrubbedText.replaceAll(token, '[SECRET_BLOCKED_UPGRADE_TO_PRO]');
-        delete result.tokenMap[token];
-        delete localSessionMap[token];
-      }
-    });
-
-    if (hasSecrets) {
-      process.stderr.write(`\x1b[1;31m🚫  [PrivacyScrubber] Secrets/Keys detected in output. Replaced with [SECRET_BLOCKED_UPGRADE_TO_PRO] to protect your data (Requires PRO tier).\x1b[0m\n`);
-    }
-  }
 
   return result.scrubbedText + (wasTruncated ? `\n\n[PrivacyScrubber Free Tier: Payload truncated to ${limit.toLocaleString()} characters. Upgrade to PRO ($15/mo or $110 Lifetime) or Developer SDK ($299/mo) for unlimited payload processing: https://privacyscrubber.com/pricing]` : '');
 }
@@ -338,11 +452,27 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
     trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
   };
 
+  const agenticProtocol = {
+    protocolsSupported: ['MCP-1.0 (stdio/SSE)', 'A2A-1.0 (Agent2Agent)', 'ZTDS-RFC-v1.0'],
+    agentCardUrl: 'https://privacyscrubber.com/.well-known/agent-card.json',
+    ztdsStandardCardUrl: 'https://ztds.ai/.well-known/agent-card.json',
+    regulatorySafeHarbor: [
+      'GDPR-Art-4(5)-Pseudonymization',
+      'GDPR-Art-25-Privacy-by-Design',
+      'GDPR-Art-32-TOMs',
+      'EU-AI-Act-Art-50',
+      'EU-AI-Act-Art-17-EN-18286-QMS',
+      'CNIL-ICO-Agentic-Memory-Compartmentalization',
+      'IL-PPL-Amendment-13-Sec-17'
+    ],
+    zeroCleartextEgress: true
+  };
+
   const statutoryCitations = [
     {
-      statute: 'EU AI Act (Art. 50)',
-      scope: 'AI Transparency & Data Minimization',
-      rule: 'Sanitization runs locally by design; reduces the content sent to external AI models. Informational mapping, not a compliance determination.'
+      statute: 'EU AI Act (Art. 50 & Art. 17 / EN 18286:2026 QMS)',
+      scope: 'AI Transparency, Data Minimization & Harmonized QMS Governance',
+      rule: 'Sanitization runs locally by design; reduces the content sent to external AI models and supports Article 17 Quality Management System (EN 18286:2026) data governance controls. Informational mapping, not a compliance determination.'
     },
     {
       statute: 'GDPR (Art. 4, 25, 28, 32)',
@@ -374,6 +504,7 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
     frameworksList: Array.from(frameworksSet),
     statutoryCitations,
     ipHoldings,
+    agenticProtocol,
     multimodalEgress: '0.00 Bytes (Solid Blackout & Burn-in Verified)'
   };
 }
@@ -453,10 +584,26 @@ if (isRestoreMode) {
   let tokenMap = {};
   if (tokenMapInput) {
     try {
+      const safeReviver = (k, v) => (k === '__proto__' || k === 'constructor' || k === 'prototype') ? undefined : v;
       if (tokenMapInput.trim().startsWith('{')) {
-        tokenMap = JSON.parse(tokenMapInput);
-      } else if (fs.existsSync(tokenMapInput)) {
-        tokenMap = JSON.parse(fs.readFileSync(tokenMapInput, 'utf8'));
+        tokenMap = JSON.parse(tokenMapInput, safeReviver);
+      } else {
+        const workspaceRoot = fs.existsSync(process.cwd()) ? fs.realpathSync(process.cwd()) : path.resolve(process.cwd());
+        const resolvedMapPath = path.resolve(workspaceRoot, tokenMapInput);
+        const relToRoot = path.relative(workspaceRoot, resolvedMapPath);
+        if (relToRoot.startsWith('..') || path.isAbsolute(relToRoot)) {
+          throw new Error('Security policy violation: --token-map path resolves outside active workspace.');
+        }
+        if (fs.existsSync(resolvedMapPath)) {
+          const lstat = fs.lstatSync(resolvedMapPath);
+          if (lstat.isSymbolicLink() || !lstat.isFile()) {
+            throw new Error('Security policy violation: --token-map must be a regular non-symlink file.');
+          }
+          if (lstat.size > 10 * 1024 * 1024) {
+            throw new Error('Token map file exceeds 10MB limit.');
+          }
+          tokenMap = JSON.parse(fs.readFileSync(resolvedMapPath, 'utf8'), safeReviver);
+        }
       }
     } catch (e) {
       console.error(`Error parsing token map: ${e.message}`);
@@ -526,6 +673,11 @@ Before reading sensitive files, running terminal commands that may print credent
   if (targets.includes("cursor")) {
     fs.writeFileSync(path.join(targetDir, '.cursorrules'), RULE_TEXT, 'utf8');
     generatedFiles.push('.cursorrules');
+    const cursorRulesDir = path.join(targetDir, '.cursor', 'rules');
+    if (!fs.existsSync(cursorRulesDir)) fs.mkdirSync(cursorRulesDir, { recursive: true });
+    const mdcContent = `---\ndescription: PrivacyScrubber Zero-Trust Data Sanitization (ZTDS) — Mandatory PII & Secret Guard\nglobs: "**/*"\nalwaysApply: true\n---\n\n${RULE_TEXT}`;
+    fs.writeFileSync(path.join(cursorRulesDir, 'privacyscrubber.mdc'), mdcContent, 'utf8');
+    generatedFiles.push('.cursor/rules/privacyscrubber.mdc');
   }
   if (targets.includes("windsurf")) {
     fs.writeFileSync(path.join(targetDir, '.windsurfrules'), RULE_TEXT, 'utf8');
@@ -546,6 +698,21 @@ Before reading sensitive files, running terminal commands that may print credent
       generatedFiles.push('CLAUDE.md');
     }
   }
+  if (targets.includes("agents_md") || targets.includes("codex") || rulesTargets.includes("all")) {
+    const agentsPath = path.join(targetDir, 'AGENTS.md');
+    if (fs.existsSync(agentsPath)) {
+      const existing = fs.readFileSync(agentsPath, 'utf8');
+      if (!existing.includes("Zero-Trust Agentic Guard")) {
+        fs.writeFileSync(agentsPath, existing.trimEnd() + "\n\n" + RULE_TEXT, 'utf8');
+        generatedFiles.push('AGENTS.md (appended)');
+      } else {
+        generatedFiles.push('AGENTS.md (already present)');
+      }
+    } else {
+      fs.writeFileSync(agentsPath, RULE_TEXT, 'utf8');
+      generatedFiles.push('AGENTS.md');
+    }
+  }
   if (targets.includes("copilot")) {
     const copilotDir = path.join(targetDir, '.github');
     if (!fs.existsSync(copilotDir)) fs.mkdirSync(copilotDir, { recursive: true });
@@ -556,6 +723,46 @@ Before reading sensitive files, running terminal commands that may print credent
     fs.writeFileSync(path.join(targetDir, '.clinerules'), RULE_TEXT, 'utf8');
     generatedFiles.push('.clinerules');
   }
+  if (args.includes("--hooks") || targets.includes("hooks") || rulesTargets.includes("all")) {
+    try {
+      const cursorHooksPath = path.join(targetDir, '.cursor', 'hooks.json');
+      fs.mkdirSync(path.dirname(cursorHooksPath), { recursive: true });
+      let cursorHooks = { version: 1, hooks: {} };
+      if (fs.existsSync(cursorHooksPath)) {
+        try { cursorHooks = JSON.parse(fs.readFileSync(cursorHooksPath, 'utf8')); } catch (_) {}
+      }
+      if (!cursorHooks.hooks || typeof cursorHooks.hooks !== 'object') cursorHooks.hooks = {};
+      const hookCmd = "npx -y @privacyscrubber/mcp-server --hook";
+      for (const ev of ['beforeReadFile', 'beforeShellExecution']) {
+        if (!Array.isArray(cursorHooks.hooks[ev])) cursorHooks.hooks[ev] = [];
+        if (!cursorHooks.hooks[ev].some(h => h && h.command && h.command.includes('privacyscrubber'))) {
+          cursorHooks.hooks[ev].push({ command: hookCmd });
+        }
+      }
+      fs.writeFileSync(cursorHooksPath, JSON.stringify(cursorHooks, null, 2) + '\n', 'utf8');
+      generatedFiles.push('.cursor/hooks.json');
+
+      const claudeSettingsPath = path.join(targetDir, '.claude', 'settings.json');
+      fs.mkdirSync(path.dirname(claudeSettingsPath), { recursive: true });
+      let claudeSettings = {};
+      if (fs.existsSync(claudeSettingsPath)) {
+        try { claudeSettings = JSON.parse(fs.readFileSync(claudeSettingsPath, 'utf8')); } catch (_) {}
+      }
+      if (!claudeSettings.hooks || typeof claudeSettings.hooks !== 'object') claudeSettings.hooks = {};
+      if (!Array.isArray(claudeSettings.hooks.PreToolUse)) claudeSettings.hooks.PreToolUse = [];
+      const hasClaudeHook = claudeSettings.hooks.PreToolUse.some(entry =>
+        Array.isArray(entry?.hooks) && entry.hooks.some(h => h && h.command && h.command.includes('privacyscrubber'))
+      );
+      if (!hasClaudeHook) {
+        claudeSettings.hooks.PreToolUse.push({
+          matcher: "Read|Bash",
+          hooks: [{ type: "command", command: hookCmd }]
+        });
+      }
+      fs.writeFileSync(claudeSettingsPath, JSON.stringify(claudeSettings, null, 2) + '\n', 'utf8');
+      generatedFiles.push('.claude/settings.json');
+    } catch (_) {}
+  }
 
   console.log(`[Zero-Trust Agentic Guard: Agent Rules Generated]`);
   console.log(`Workspace: ${targetDir}`);
@@ -612,8 +819,183 @@ if (isDiffMode) {
   }
 }
 
-// Mode 3: Stdin Stream Mode (pipe)
-if (hasStdin && !hasCommand && !isRestoreMode && !isDiffMode && !isRulesMode) {
+// Mode 2.5: Transparent MCP JSON-RPC 2.0 Stdio Proxy Wrapper (--wrap)
+if (isWrapMode) {
+  if (wrapCommandArgs.length === 0) {
+    console.error('Error: --wrap requires an upstream MCP server command (e.g. npx ps-guard --wrap -- npx -y @modelcontextprotocol/server-postgres ...)');
+    process.exit(1);
+  }
+
+  const SKIP_SANITIZE_KEYS = new Set([
+    'jsonrpc', 'id', 'method', 'type', 'mimeType', 'uri', 'name', 'role',
+    'protocolVersion', 'cursor', 'nextCursor', 'isError', 'version'
+  ]);
+
+  const deepDetokenizeParams = (node, depth = 0) => {
+    if (depth > 20 || node === null || node === undefined) return node;
+    if (typeof node === 'string') {
+      if (Object.keys(localSessionMap).length === 0) return node;
+      const res = PrivacyScrubberCore.unscrubText(node, localSessionMap);
+      return (res && typeof res.restoredText === 'string') ? res.restoredText : node;
+    }
+    if (Array.isArray(node)) {
+      return node.map(item => deepDetokenizeParams(item, depth + 1));
+    }
+    if (typeof node === 'object') {
+      const out = {};
+      for (const [k, v] of Object.entries(node)) {
+        if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;
+        out[k] = deepDetokenizeParams(v, depth + 1);
+      }
+      return out;
+    }
+    return node;
+  };
+
+  const deepSanitizeResult = (node, keyName = '', depth = 0) => {
+    if (depth > 20 || node === null || node === undefined) return node;
+    if (typeof node === 'string') {
+      if (SKIP_SANITIZE_KEYS.has(keyName) || node.length < 4) return node;
+      return performSanitization(node);
+    }
+    if (Array.isArray(node)) {
+      return node.map(item => deepSanitizeResult(item, keyName, depth + 1));
+    }
+    if (typeof node === 'object') {
+      const out = {};
+      for (const [k, v] of Object.entries(node)) {
+        if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;
+        if (k === 'inputSchema' || k === 'outputSchema' || k === 'capabilities' || k === 'serverInfo' || k === '_meta') {
+          out[k] = v;
+        } else {
+          out[k] = deepSanitizeResult(v, k, depth + 1);
+        }
+      }
+      return out;
+    }
+    return node;
+  };
+
+  const zeroizeSessionMap = () => {
+    for (const k of Object.keys(localSessionMap)) {
+      localSessionMap[k] = '';
+      delete localSessionMap[k];
+    }
+  };
+
+  const [cmdBin, ...cmdRest] = wrapCommandArgs;
+  const child = spawn(cmdBin, cmdRest, {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    shell: process.platform === 'win32'
+  });
+
+  // Intercept client -> upstream MCP server (JSON-RPC requests on stdin)
+  const rlClientIn = readline.createInterface({
+    input: process.stdin,
+    terminal: false
+  });
+
+  rlClientIn.on('line', (line) => {
+    if (!child.stdin || child.stdin.destroyed) return;
+    const trimmed = line.trim();
+    if (!trimmed.startsWith('{')) {
+      child.stdin.write(line + '\n');
+      return;
+    }
+    try {
+      const msg = JSON.parse(trimmed);
+      if (msg && typeof msg === 'object' && msg.params && (msg.method === 'tools/call' || msg.method === 'prompts/get' || msg.method === 'resources/read' || msg.method === 'sampling/createMessage')) {
+        msg.params = deepDetokenizeParams(msg.params);
+        child.stdin.write(JSON.stringify(msg) + '\n');
+        return;
+      }
+    } catch (_) {}
+    child.stdin.write(line + '\n');
+  });
+
+  rlClientIn.on('close', () => {
+    if (child.stdin && !child.stdin.destroyed) {
+      child.stdin.end();
+    }
+  });
+
+  // Intercept upstream MCP server -> client (JSON-RPC responses/notifications on stdout)
+  const rlUpstreamOut = readline.createInterface({
+    input: child.stdout,
+    terminal: false
+  });
+
+  rlUpstreamOut.on('line', (line) => {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith('{')) {
+      process.stdout.write(performSanitization(line) + '\n');
+      return;
+    }
+    try {
+      const msg = JSON.parse(trimmed);
+      if (msg && typeof msg === 'object') {
+        if (msg.result && typeof msg.result === 'object') {
+          const isSchemaListing = Array.isArray(msg.result.tools) || Array.isArray(msg.result.prompts) || Array.isArray(msg.result.resourceTemplates) || Boolean(msg.result.protocolVersion);
+          if (!isSchemaListing) {
+            msg.result = deepSanitizeResult(msg.result);
+            const receipt = buildPsr2Receipt(localSessionMap);
+            const telemetry = buildCisoAuditTelemetry(localSessionMap);
+            msg.result._meta = Object.assign({}, msg.result._meta || {}, {
+              ztds_receipt: {
+                version: receipt.version,
+                timestamp: receipt.timestamp,
+                manifestSha256: receipt.manifestSha256,
+                receiptSha256: receipt.receiptSha256,
+                entityCounts: receipt.entityCounts,
+                tokensTotal: receipt.tokensTotal,
+                riskLevel: telemetry.riskLevel,
+                regulatorySafeHarbor: telemetry.agenticProtocol ? telemetry.agenticProtocol.regulatorySafeHarbor : [],
+                zero_cleartext_egress: true
+              }
+            });
+          }
+        } else if (msg.params && typeof msg.params === 'object') {
+          msg.params = deepSanitizeResult(msg.params);
+        }
+        process.stdout.write(JSON.stringify(msg) + '\n');
+        return;
+      }
+    } catch (_) {}
+    process.stdout.write(performSanitization(line) + '\n');
+  });
+
+  const rlUpstreamErr = readline.createInterface({
+    input: child.stderr,
+    terminal: false
+  });
+
+  rlUpstreamErr.on('line', (line) => {
+    process.stderr.write(performSanitization(line) + '\n');
+  });
+
+  const handleSignal = (sig) => {
+    zeroizeSessionMap();
+    if (!child.killed) {
+      try { child.kill(sig); } catch (_) {}
+    }
+  };
+  process.on('SIGINT', () => handleSignal('SIGINT'));
+  process.on('SIGTERM', () => handleSignal('SIGTERM'));
+  process.on('exit', zeroizeSessionMap);
+
+  child.on('close', (code) => {
+    emitProofFeedback();
+    zeroizeSessionMap();
+    process.exit(code || 0);
+  });
+
+  child.on('error', (err) => {
+    zeroizeSessionMap();
+    console.error(`Error spawning wrapped MCP server: ${err.message}`);
+    process.exit(1);
+  });
+} else if (hasStdin && !hasCommand && !isRestoreMode && !isDiffMode && !isRulesMode) {
+  // Mode 3: Stdin Stream Mode (pipe)
   if (isJsonMode) {
     let rawInput = '';
     process.stdin.setEncoding('utf8');