Redact MCP — Automatic PII Obfuscation for Claude Code

An MCP server (and Claude Code plugin) that automatically detects and obfuscates sensitive data before Claude ever sees it. Uses regex pattern matching and AI-powered Named Entity Recognition (NER) to catch IPs, hostnames, emails, API keys, person names, organization names, locations, private keys, connection strings, and more.

Built for penetration testers who need Claude's analysis capabilities without exposing client data to a third party.

How It Works

Raw data with real PII ──► Regex + NER detection ──► Claude sees only fake values
                                                              │
Final report for client ◄── Real values restored ◄── /redact:export

The server maintains a bidirectional mapping table. Every sensitive value gets a consistent, deterministic fake replacement that persists across the entire session:

Same real value always maps to the same fake value. obfuscate(text) -> deobfuscate(result) === text is guaranteed.

Install

Quick install via npx (recommended)

claude mcp add @mattzam/redact-mcp -- npx @mattzam/redact-mcp

That's it. Claude Code will launch the server via npx on each session. The NER model (~110MB) downloads automatically on first use and is cached for subsequent runs.

To enable audit logging:

claude mcp add @mattzam/redact-mcp -e REDACT_AUDIT_LOG=true -- npx @mattzam/redact-mcp

As a Claude Code plugin (full features: hooks + skills)

git clone https://github.com/r3352/redact-mcp.git redact
cd redact/server
npm install
npm run build
cd ../..

# Load as a plugin (includes hooks for leak detection + slash commands)
claude --plugin-dir ./redact

The plugin mode adds hooks (automatic leak detection on raw tool output) and skills (/redact:status, /redact:add, /redact:export) on top of the MCP server.

Manual MCP configuration

Add to your Claude Code MCP config (~/.claude/mcp.json or project .mcp.json):

{
  "mcpServers": {
    "redact-server": {
      "command": "npx",
      "args": ["redact-mcp"],
      "env": {
        "REDACT_DATA_DIR": "/path/to/data/directory",
        "REDACT_AUDIT_LOG": "true"
      }
    }
  }
}

Environment Variables

What Gets Detected

Regex Patterns (19 types)

Zero configuration required. Detected automatically:

NER Detection (AI-powered)

When @huggingface/transformers is installed (included by default), the server loads Xenova/bert-base-NER (~110MB ONNX model, downloaded on first use) to detect:

NER catches entities that regex misses — names and organizations outside of JSON context, arbitrary location names, etc. Regex results always take priority when both detect the same span (regex is more precise for structured patterns).

Graceful fallback: If the model fails to load or the package is missing, the server continues in regex-only mode with no errors.

Smart Passthrough

These values are never obfuscated:

• Loopback/reserved: localhost, 127.0.0.1, ::1, 0.0.0.0
• RFC documentation ranges: 192.0.2.x (TEST-NET-1), 198.51.100.x (TEST-NET-2), 203.0.113.x (TEST-NET-3), 2001:db8:: (IPv6 docs)
• Example domains: example.com, example.org, example.net
• Dev domains: github.com, npmjs.com, nodejs.org, googleapis.com, etc.
• Security testing: burpcollaborator.net, oastify.com
• Code patterns: console.log, process.env, package.json, webpack.config, jest.config, tailwind.config, and 30+ other common false positives
• Broadcast MACs: FF:FF:FF:FF:FF:FF, 00:00:00:00:00:00

MCP Tools

The server registers 8 tools via MCP:

redact_proxy_request — The Key Tool

For pentest workflows, this is the critical tool. Claude calls it instead of curl/fetch:

1. Claude provides URL/headers/body (may contain already-obfuscated values)
2. Server deobfuscates the request (restores real hostnames/IPs/tokens)
3. Makes the real HTTP request to the target
4. Obfuscates the entire response (headers + body)
5. Returns sanitized response to Claude

Claude never sees the real response data. All deobfuscation and obfuscation steps are audit-logged.

redact_audit_log — Compliance Audit Trail

When REDACT_AUDIT_LOG=true, every obfuscation and deobfuscation operation is logged to ${REDACT_DATA_DIR}/audit.jsonl. Each entry records:

• Timestamp and operation type (obfuscate, deobfuscate, proxy_request, file_read)
• Full input text (raw data before transformation)
• All detections with type, real value, fake replacement, and source (regex or ner)
• Full output text (transformed result)

This provides a complete audit trail: what went in, what was modified, and what came out.

View entries via the redact_audit_log tool or read audit.jsonl directly:

# Last 5 entries, pretty-printed
tail -5 data/audit.jsonl | python3 -m json.tool

Security note: The audit log contains real sensitive data by design (that's its purpose — proving what was redacted). Protect it accordingly.

Skills (Slash Commands)

Hooks

The plugin uses two hooks (automatic, no user interaction):

• SessionStart — Injects instructions telling Claude to route all data through redact tools
• PostToolUse — Warns if Claude uses raw Bash/Read/Grep/WebFetch and the output contains known sensitive values (leak detection)

How the Pipeline Works

Detection

1. Regex pass — 19 pattern types scanned synchronously via compiled RegExp
2. NER pass — Xenova/bert-base-NER runs in parallel (async), catches person/org/location entities
3. Merge — Results combined; regex matches win on overlapping spans (more precise for structured data)
4. Deduplication — Overlapping NER results that cover the same span as a regex match are dropped

Mapping

1. Each unique real value gets a deterministic fake via counter-based generation
2. Fake values use safe ranges: TEST-NET-2 for IPv4, RFC 3849 for IPv6, example.com for domains, 555 prefix for phones, locally-administered range for MACs
3. Mappings persist to ${REDACT_DATA_DIR}/mappings.json with debounced writes (500ms)
4. Longest-first replacement prevents partial match corruption (e.g., 10.50.1.100 before 10.50.1.10)

Round-trip Guarantee

deobfuscate(obfuscate(text)) === text for all inputs. The bidirectional mapping table ensures lossless restoration.

Architecture