# phi-guard-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Abidit/phi-guard-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 230  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/phi-guard-mcp

## Description
Local-first PHI detection for source code, LLM prompts, logs, and analytics

## Tools
Capabilities this server exposes over MCP:

- **redact_suggest** — Given a raw text snippet (a log line, a prompt, an error message), detect PHI-shaped values and return a redacted version.
- **scan_code** — Scan a local directory of source files for sensitive identifiers (patient, diagnosis, dob, ssn, mrn, birthdate, medicalrecord) flowing into risky sinks (LLM calls, logging, analytics) before they ship.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "phi-guard-mcp": {
    "command": "npx",
    "args": ["-y","phi-guard-mcp"]
  }
}
```

## Documentation

## What phi-guard-mcp MCP server does

The phi-guard-mcp MCP server helps identify likely protected health information in text and source code. It is intended for codebases where patient-related values might be inserted into LLM prompts, written to logs, sent to analytics, or passed to error-reporting functions.

The server exposes two MCP tools:

- `scan_code` walks a directory and reports source lines where a sensitive-looking identifier appears alongside a configured risky sink.

The implementation is local-first. It does not make network calls or upload source code. Results still pass to the MCP client that launched the process, so a hosted assistant may place those results in a model context.

## How it works

`redact_suggest` uses a fixed set of narrow patterns for SSNs, medical record numbers, dates of birth, names following “Patient,” phone numbers, and email addresses. Each match includes a type, confidence score, and character offsets into the original text. By default, matched values and the original unredacted text are omitted. An `includeMatchedValues` option can expose them for local command-line use or testing.

`scan_code` performs lexical, line-based matching rather than parsing code or resolving types. It recognizes the sensitive identifiers `patient`, `diagnosis`, `dob`, `ssn`, `mrn`, `birthdate`, and `medicalrecord`, without regard to case when bounded by non-letters. It checks those identifiers against LLM provider names, console methods, logger patterns, analytics calls, and error-reporting calls.

The scanner reads TypeScript, JavaScript, Python, and Go files based on their extensions. It skips common generated or dependency directories, including `node_modules`, `dist`, `build`, `coverage`, `out`, `.next`, and `.turbo`, along with dotfiles and dot-directories. Full-line `//` and `#` comments are ignored.

## Setup and configuration

Node.js 22 or newer is required. The package can be started without cloning the repository:

```bash
npx -y phi-guard-mcp
```

For a source checkout, clone the repository and run `npm ci`; the prepare step builds the `dist` output. MCP clients start the server as a local stdio process. A typical configuration uses `npx` as the command with `-y` and `phi-guard-mcp` as arguments. A local checkout can instead use `node` with an absolute path to `dist/index.js`.

After changing the build or configuration, restart the client or reconnect the MCP server so the running stdio process is replaced.

## Tools and capabilities

`redact_suggest` returns a redacted string using labels such as `[SSN]`, `[MRN]`, `[DOB]`, `[NAME]`, `[PHONE]`, and `[EMAIL]`, along with detected match metadata. Its pattern confidence values range from 0.70 for email to 0.95 for SSN.

`scan_code` returns each finding’s file path, line number, severity, issue description, and source snippet. Severity is always `high`. Literal PHI in snippets is masked, while identifier names such as `patient.diagnosis` remain visible because they indicate the source-level issue.

## Limitations and notes

The phi-guard-mcp MCP server uses intentionally limited patterns, so it can miss PHI that does not fit them. The code scanner only detects identifiers and sinks on the same line; it has no parser, type information, or general dataflow analysis. File-extension support means files are read according to their extensions, not that each language is semantically understood.

This tool is a linter for one category of mistake. It does not establish HIPAA compliance, provide a compliance attestation, or prove that data cannot reach an external system. Enabling matched values can put raw PHI into tool results, so that option should be reserved for contexts where exposing those values is acceptable.

_Full upstream README: https://allmcps.com/mcp/phi-guard-mcp/readme_