redact

Redact MCP — Automatic PII Obfuscation for Claude Code

An MCP server (and Claude Code plugin) that automatically detects and obfuscates sensitive data before Claude ever sees it. Uses regex pattern matching and AI-powered Named Entity Recognition (NER) to catch IPs, hostnames, emails, API keys, person names, organization names, locations, private keys, connection strings, and more.

Built for penetration testers who need Claude's analysis capabilities without exposing client data to a third party.

How It Works

Raw data with real PII ──► Regex + NER detection ──► Claude sees only fake values
                                                              │
Final report for client ◄── Real values restored ◄── /redact:export

The server maintains a bidirectional mapping table. Every sensitive value gets a consistent, deterministic fake replacement that persists across the entire session:

Real Value	Obfuscated As	Detection
10.50.1.100	198.51.100.1	regex
api.clientcorp.com	target-1.example.com	regex
[email protected]	[email protected]	regex
AKIA3EXAMPLE...	[REDACTED_AWS_KEY_1]	regex
James Wilson	Person_A Person_B	NER
Microsoft	Org_A	NER
Seattle	City_A	NER
`[REDACTED:DB Connection String]	[REDACTED_CONN_STRING_1]	regex
-----BEGIN RSA PRIVATE KEY...	[REDACTED_PRIVATE_KEY_1]	regex

Same real value always maps to the same fake value. obfuscate(text) -> deobfuscate(result) === text is guaranteed.

Install

Quick install via npx (recommended)

claude mcp add @mattzam/redact-mcp -- npx @mattzam/redact-mcp

That's it. Claude Code will launch the server via npx on each session. The NER model (~110MB) downloads automatically on first use and is cached for subsequent runs.

To enable audit logging:

claude mcp add @mattzam/redact-mcp -e REDACT_AUDIT_LOG=true -- npx @mattzam/redact-mcp

As a Claude Code plugin (full features: hooks + skills)

git clone https://github.com/r3352/redact-mcp.git redact
cd redact/server
npm install
npm run build
cd ../..

# Load as a plugin (includes hooks for leak detection + slash commands)
claude --plugin-dir ./redact

The plugin mode adds hooks (automatic leak detection on raw tool output) and skills (/redact:status, /redact:add, /redact:export) on top of the MCP server.

Manual MCP configuration

Add to your Claude Code MCP config (~/.claude/mcp.json or project .mcp.json):

{
  "mcpServers": {
    "redact-server": {
      "command": "npx",
      "args": ["redact-mcp"],
      "env": {
        "REDACT_DATA_DIR": "/path/to/data/directory",
        "REDACT_AUDIT_LOG": "true"
      }
    }
  }
}

Environment Variables

Variable	Default	Description
REDACT_DATA_DIR	./data	Directory for mapping state and audit logs
REDACT_AUDIT_LOG	false	Set to true to enable JSONL audit logging

What Gets Detected

Regex Patterns (19 types)

Zero configuration required. Detected automatically:

Category	Types
Network	IPv4 (private + public), IPv6, hostnames with valid TLDs, MAC addresses
Identity	Emails, person names (JSON context), phone numbers (US + international), SSNs
Secrets	AWS access keys, JWTs, Bearer tokens, API keys (context-aware), generic secrets (password=, secret=), private keys (PEM format), connection strings (postgres/mysql/redis/mongodb/amqp/mssql URIs)
Financial	Credit card numbers (Luhn-validated)
Physical	Street addresses (123 Main Street, 456 Oak Ave, etc.)

NER Detection (AI-powered)

When @huggingface/transformers is installed (included by default), the server loads Xenova/bert-base-NER (~110MB ONNX model, downloaded on first use) to detect:

Entity Type	Example	Obfuscated As
Person names	James Wilson	Person_A Person_B
Organizations	Microsoft, Acme Corp	Org_A, Org_B
Locations	Seattle, New York	City_A, City_B

NER catches entities that regex misses — names and organizations outside of JSON context, arbitrary location names, etc. Regex results always take priority when both detect the same span (regex is more precise for structured patterns).

Graceful fallback: If the model fails to load or the package is missing, the server continues in regex-only mode with no errors.

Smart Passthrough

These values are never obfuscated: