Phi Guard MCP

What phi-guard-mcp MCP server does

The phi-guard-mcp MCP server helps identify likely protected health information in text and source code. It is intended for codebases where patient-related values might be inserted into LLM prompts, written to logs, sent to analytics, or passed to error-reporting functions.

The server exposes two MCP tools:

• scan_code walks a directory and reports source lines where a sensitive-looking identifier appears alongside a configured risky sink.

The implementation is local-first. It does not make network calls or upload source code. Results still pass to the MCP client that launched the process, so a hosted assistant may place those results in a model context.

How it works

redact_suggest uses a fixed set of narrow patterns for SSNs, medical record numbers, dates of birth, names following “Patient,” phone numbers, and email addresses. Each match includes a type, confidence score, and character offsets into the original text. By default, matched values and the original unredacted text are omitted. An includeMatchedValues option can expose them for local command-line use or testing.

scan_code performs lexical, line-based matching rather than parsing code or resolving types. It recognizes the sensitive identifiers patient, diagnosis, dob, ssn, mrn, birthdate, and medicalrecord, without regard to case when bounded by non-letters. It checks those identifiers against LLM provider names, console methods, logger patterns, analytics calls, and error-reporting calls.

The scanner reads TypeScript, JavaScript, Python, and Go files based on their extensions. It skips common generated or dependency directories, including node_modules, dist, build, coverage, out, .next, and .turbo, along with dotfiles and dot-directories. Full-line // and # comments are ignored.

Setup and configuration

Node.js 22 or newer is required. The package can be started without cloning the repository:

npx -y phi-guard-mcp

For a source checkout, clone the repository and run npm ci; the prepare step builds the dist output. MCP clients start the server as a local stdio process. A typical configuration uses npx as the command with -y and phi-guard-mcp as arguments. A local checkout can instead use node with an absolute path to dist/index.js.

After changing the build or configuration, restart the client or reconnect the MCP server so the running stdio process is replaced.

Tools and capabilities

redact_suggest returns a redacted string using labels such as [SSN], [MRN], [DOB], [NAME], [PHONE], and [EMAIL], along with detected match metadata. Its pattern confidence values range from 0.70 for email to 0.95 for SSN.

scan_code returns each finding’s file path, line number, severity, issue description, and source snippet. Severity is always high. Literal PHI in snippets is masked, while identifier names such as patient.diagnosis remain visible because they indicate the source-level issue.

Limitations and notes

The phi-guard-mcp MCP server uses intentionally limited patterns, so it can miss PHI that does not fit them. The code scanner only detects identifiers and sinks on the same line; it has no parser, type information, or general dataflow analysis. File-extension support means files are read according to their extensions, not that each language is semantically understood.

This tool is a linter for one category of mistake. It does not establish HIPAA compliance, provide a compliance attestation, or prove that data cannot reach an external system. Enabling matched values can put raw PHI into tool results, so that option should be reserved for contexts where exposing those values is acceptable.