Redact MCP — Automatic PII Obfuscation for Claude Code

An MCP server (and Claude Code plugin) that automatically detects and obfuscates sensitive data before Claude ever sees it. Uses regex pattern matching and AI-powered Named Entity Recognition (NER) to catch IPs, hostnames, emails, API keys, person names, organization names, locations, private keys, connection strings, and more.

Built for penetration testers who need Claude's analysis capabilities without exposing client data to a third party.

How It Works

Raw data with real PII ──► Regex + NER detection ──► Claude sees only fake values
                                                              │
Final report for client ◄── Real values restored ◄── /redact:export

The server maintains a bidirectional mapping table. Every sensitive value gets a consistent, deterministic fake replacement that persists across the entire session:

Real Value	Obfuscated As	Detection
10.50.1.100	198.51.100.1	regex
api.clientcorp.com	target-1.example.com	regex
john.smith@clientcorp.com	user-1@example.com	regex
AKIA3EXAMPLE...	[REDACTED_AWS_KEY_1]	regex
James Wilson	Person_A Person_B	NER
Microsoft	Org_A	NER
Seattle	City_A	NER
postgres://admin:pw@host/db	[REDACTED_CONN_STRING_1]	regex
-----BEGIN RSA PRIVATE KEY...	[REDACTED_PRIVATE_KEY_1]	regex

Same real value always maps to the same fake value. obfuscate(text) -> deobfuscate(result) === text is guaranteed.

Install

Quick install via npx (recommended)

claude mcp add @mattzam/redact-mcp -- npx @mattzam/redact-mcp

That's it. Claude Code will launch the server via npx on each session. The NER model (~110MB) downloads automatically on first use and is cached for subsequent runs.

To enable audit logging:

claude mcp add @mattzam/redact-mcp -e REDACT_AUDIT_LOG=true -- npx @mattzam/redact-mcp

As a Claude Code plugin (full features: hooks + skills)

git clone https://github.com/r3352/redact-mcp.git redact
cd redact/server
npm install
npm run build
cd ../..

# Load as a plugin (includes hooks for leak detection + slash commands)
claude --plugin-dir ./redact

The plugin mode adds hooks (automatic leak detection on raw tool output) and skills (/redact:status, /redact:add, /redact:export) on top of the MCP server.

Manual MCP configuration

Add to your Claude Code MCP config (~/.claude/mcp.json or project .mcp.json):

{
  "mcpServers": {
    "redact-server": {
      "command": "npx",
      "args": ["redact-mcp"],
      "env": {
        "REDACT_DATA_DIR": "/path/to/data/directory",
        "REDACT_AUDIT_LOG": "true"
      }
    }
  }
}

Environment Variables

Variable	Default	Description
REDACT_DATA_DIR	./data	Directory for mapping state and audit logs
REDACT_AUDIT_LOG	false	Set to true to enable JSONL audit logging

What Gets Detected

Regex Patterns (19 types)

Zero configuration required. Detected automatically:

Category	Types
Network	IPv4 (private + public), IPv6, hostnames with valid TLDs, MAC addresses
Identity	Emails, person names (JSON context), phone numbers (US + international), SSNs
Secrets	AWS access keys, JWTs, Bearer tokens, API keys (context-aware), generic secrets (password=, secret=), private keys (PEM format), connection strings (postgres/mysql/redis/mongodb/amqp/mssql URIs)
Financial	Credit card numbers (Luhn-validated)
Physical	Street addresses (123 Main Street, 456 Oak Ave, etc.)

NER Detection (AI-powered)

When @huggingface/transformers is installed (included by default), the server loads Xenova/bert-base-NER (~110MB ONNX model, downloaded on first use) to detect:

Entity Type	Example	Obfuscated As
Person names	James Wilson

... View full README on GitHub