Skip to main content
Glama

obsify

让AI助手处理敏感文件,而原始值永远不会进入模型上下文。

obsify是一个本地、确定性的MCP服务器。前沿模型基于形状(模式、合成孪生、掩码反馈)进行推理,而确定性的本地代码处理实质内容,仅返回掩码后的聚合结果。无LLM调用,运行时无网络:检测基于正则表达式+校验和+字典+Presidio的本地NER。

它内置澳大利亚实体支持(ABN / ACN / TFN,校验和验证)和一个基于标签的路由层,使“助手何时应避免原始数据”成为一个确定性、强制执行的决策,而非主观判断。

诚实范围: run_on_real 在尽力而为的本地沙箱中执行模型编写的代码,并尽力而为地掩码其输出。它不是牢不可破的。在将其指向任何你无法承受泄露风险的内容之前,请阅读SECURITY.md。返回聚合结果。

为什么

将机密文档提供给托管LLM意味着实质内容离开了你的边界。通常的答案是“不使用LLM”或“信任提供商”。obsify采取了第三条路径——计算到数据:将代码带到数据处,而不是将数据带到模型处。

  • 模型看到电子表格的模式,而不是其行。

  • 模型针对合成孪生(伪造的值,真实的结构)进行开发。

  • 模型的分析代码本地运行;仅返回掩码后的聚合输出。

前沿模型的推理能力得以保留。只是它对原始值的查看被移除了。

Related MCP server: MCP DB Results Anonymizer

工具

工具

功能

返回值

scan_pii(path)

扫描文件/文件夹中的PII

类型、位置、计数——绝不包含值

make_synthetic_twin(path, out)

忠实伪造Excel工作簿

模式摘要;孪生写入out(值已伪造,泄露已验证)

run_on_real(code, data_path)

计算到数据:在本地针对真实文件运行你的代码(绑定到DATA_PATH)

仅返回PII掩码、大小限制的stdout/stderr——返回聚合结果

redact_text(text)

将字符串中的PII掩码为<TYPE>令牌

经过编辑的字符串

verify_value_free(text, terms)

失败关闭检查text是否泄露了任何terms(或其变体)

{"value_free": bool}

支持的文档: PDF(文本+表格;复杂表格回退通过obsify[tables]),Excel .xlsx/.xlsm,以及Word .docx(段落+表格)。无法读取或不支持的文件会作为明确的注释/盲点呈现,绝不会静默丢弃。(尚无OCR——扫描/图像页面会被标记为低覆盖率,而非转录。)

已知实体掩码(可选)。 提供一个本地的.obsify.entities列表,包含要隐藏的名称;scan_pii / redact_text 确定性地捕获它们——以及NER遗漏的后缀/缩写变体(BRIGHTWATER HLDGS P/L 代表 Brightwater Holdings Pty Ltd)——作为KNOWN_ENTITY。该列表保持本地,永远不会进入模型上下文。参见docs/known_entities.md。

演示

使用官方的MCP Inspector 针对合成数据实时操作所有五个工具:

python -m obsify.make_corpus --out ./corpus_demo
npx @modelcontextprotocol/inspector obsify-mcp

对./corpus_demo/ledger.xlsx调用scan_pii,确认它仅返回类型/计数/位置——绝不包含值。参见docs/verifying.md。

试试看——合成语料库

生成一个伪造但逼真的语料库(全部合成;ABN/ACN/TFN经过校验和验证),涵盖所有三种格式,然后将工具指向它:

pip install "obsify[demo]"                 # reportlab, for the sample PDFs
python -m obsify.make_corpus --out ./corpus_demo

它会写入一个多工作表Excel分类账(数字误报雷区)、一个PDF聘书(散文+试算平衡表)和一个DOCX审计备忘录(段落+供应商表)。非常适合在不接触真实数据的情况下试用scan_pii / make_synthetic_twin。

安装并作为MCP服务器运行

需要Python 3.11+。obsify通过stdio与MCP通信——客户端将其作为本地子进程启动;没有任何内容远程托管。通过向客户端配置添加一个块,将其注册到任何支持MCP的客户端(Claude Desktop、Claude Code、Cursor、VS Code等)。

推荐——通过uvx零安装:

{ "mcpServers": { "obsify": { "command": "uvx", "args": ["obsify-mcp"] } } }

uvx从PyPI获取obsify并按需运行——无需永久安装。在首次运行时,obsify会下载spaCy NER模型(en_core_web_lg,约560 MB)一次并缓存;这会获取一个公共模型,不发送任何用户数据(设置OBSIFY_AUTO_DOWNLOAD=0可禁止此行为并自行安装模型)。后续运行即时完成且完全离线。

或者安装它(pip / pipx):

pipx install obsify        # isolated, on PATH  (or: pip install obsify)

然后将客户端指向已安装的命令:

{ "mcpServers": { "obsify": { "command": "obsify-mcp" } } }

重启客户端,工具就会出现。可选附加组件:obsify[tables](通过camelot + Ghostscript实现复杂表格PDF回退),obsify[compute](pandas,在run_on_real代码中很方便)。

PATH陷阱(“服务器无法连接”的头号原因): command 必须在客户端看到的PATH上可解析。GUI客户端可能不共享你的venv的PATH。修复方法:使用uvx/pipx(全局可解析),或提供绝对路径——"/path/to/.venv/bin/obsify-mcp"(macOS/Linux)或"C:\\path\\.venv\\Scripts\\obsify-mcp.exe"(Windows)。

从此仓库(在它发布到PyPI之前):

pip install "git+https://github.com/Formative-Sum41/obsify.git"   # gets `obsify-mcp` + `obsify`

路由层——确定性,而非主观判断

“帮助我,但不要读取机密文件”的难点在于决定何时保护。obsify将该决策从模型中移出,放入环境:

  1. .obsify.json ——一个标签清单,对路径进行分类(public / confidential / restricted)。

  2. obsify.guard (作为python -m obsify.guard运行)——一个PreToolUse守卫,阻止直接读取带标签的文件(退出码2),并将助手重定向到scan_pii / make_synthetic_twin / run_on_real。

  3. 一个约定(在CLAUDE.md中),使助手在遇到守卫之前优先使用obsify。

通过一个命令设置:

obsify init [--dir PATH] [--with-claude-md]

obsify init 设计为非破坏性——它只拥有一个文件,并为你提供其余部分的代码片段:

  • .obsify.json ——obsify拥有此文件;init写入它(没有--force则永远不会覆盖)。

  • .claude/settings.json ——你的文件:init 打印要粘贴的PreToolUse钩子块,从不编辑它(它运行代码,因此注册它是你的决定)。

  • CLAUDE.md ——你的文件:约定是选择加入。默认打印;--with-claude-md 会追加一个标记包裹的、幂等的块,绝不会破坏你的内容。

完整约定:docs/obsify_routing.md。

检测如何保持精确

  • 校验和验证的标识符。 ABN/ACN/TFN候选者由正则表达式提出,并由其官方校验和确认,因此随机数永远不会被报告为标识符。

  • 需要上下文的ID。 仅当附近有标签词(“TFN”、“ABN”、“BSB”等)时,裸数字才被接受为ABN/ACN/TFN——这消除了数字分类账上顺序日记账ID的误报洪流。

  • 无字母 / 带数字的NER抑制。 纯数字、金额、日期和字母数字代码不会被标记为名称/组织;真实的名称、电子邮件和地址(包含字母)不受影响。经过验证的无字母PII保持豁免:校验和ID(ABN/ACN/TFN/Medicare)、Luhn卡、有效IP、BSB相邻账户和电话号码(通过上下文或电话号码形状)——而小数点仍标记为金额,而非电话号码。

测量精度

obsify附带一个评分评估工具(eval/——带标签的合成语料库+答案键+针对发布版检测器的评分器,外加一个独立的第三方交叉检查)。合成语料库的总体指标:100%召回率(预期检测项),0个误报(在数字FP折磨表上,带有分组数字守卫),裸上下文门控ID被正确抑制。独立交叉检查与Microsoft presidio-research:EMAIL/IBAN 100%,PERSON 94%。

该工具证明了其价值——它发现了真实的缺陷,这些缺陷随后被修复: 信用卡和电话号码被数字噪声过滤器静默抑制(现在通过校验和验证/电话号码形状豁免),而Medicare、IP、出生日期、澳大利亚护照和驾照没有识别器(现已添加,通过校验和或上下文门控)。完整方法、数字和剩余已记录的差距(SWIFT/BIC,非DOB日期):eval/README.md。

测试

pip install -e ".[dev]"
pytest tests/            # or run any file directly: python tests/test_obsify.py

十二个套件(73个测试),在CI上针对Linux + Windows / Python 3.11 + 3.12运行:

  • mcp-protocol ——通过stdio启动真实服务器并与MCP通信(与Claude等客户端使用的路径相同):确认所有五个工具都注册了有效的模式,并且调用通过JSON-RPC往返——包括scan_pii返回仅形状,端到端。

  • checksums ——锚定到外部发布的ABN/ACN/TFN工作示例(有效和损坏),打破了生成器↔验证器的循环。

  • obsify / twin / redaction ——隐私不变量:仅形状输出、无泄露孪生和失败关闭自检。

  • precision ——误报抑制器在保留真实名称的同时消除数字分类账噪声。

  • routing ——守卫的阻止/允许分类和obsify init的非破坏性契约。

  • corpus ——合成PDF+Excel+DOCX语料库端到端:每种格式的检测、DOCX段落+表格提取以及每种格式的仅形状输出。

  • evaluation ——作为回归门的评分工具(召回率、抑制、FP折磨、差距)。

  • robustness ——优雅降级:损坏/过大/空/嵌套/不支持的输入永远不会崩溃,并且始终作为注释呈现。

  • model / variants ——首次运行模型自动下载逻辑;verify_value_free背后的变体规范化。

有关交互式验证(MCP Inspector)和实时客户端最后一英里检查,请参见docs/verifying.md。

许可证

MIT——参见LICENSE。

Available Tools

5 tools
make_synthetic_twinA

Generate a SYNTHETIC TWIN of a real Excel workbook at path, written to out. Schema (sheets, headers, column types, true row counts) is preserved; every data value is freshly FAKED — no real value is copied. Reason and write your analysis code against the twin; then run it on the real file with run_on_real. Returns the schema summary (safe shape).

ParametersJSON Schema
NameRequiredDescriptionDefault
outYes
pathYes
cap_rowsNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well. It discloses key behavioral traits: schema is preserved, every data value is freshly FAKED, no real value is copied, and it returns a safe schema summary. This gives the agent essential safety and data-handling context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three dense sentences, front-loaded with the core action and then efficient supplementary detail. There is no fluff or redundancy; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core function, the workflow pairing with run_on_real, and the return value (schema summary). It lacks any explanation of cap_rows and its potential effect on 'true row counts,' which would be a notable gap for a tool of moderate complexity. Overall, it is quite complete but not flawless.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain path and out (': path', 'written to out'), but it does not mention cap_rows at all. This leaves one of three parameters semantically opaque, so the compensation is partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource: 'Generate a SYNTHETIC TWIN of a real Excel workbook at `path`, written to `out`.' It clearly differentiates from siblings by framing this as the twin-creation step and explicitly mentions run_on_real as the subsequent step for real-file execution.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit workflow guidance: 'Reason and write your analysis code against the twin; then run it on the real file with run_on_real.' This tells exactly when to use this tool and names the alternative (run_on_real) for the next phase, satisfying the 'when/when-not/alternatives' criterion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

redact_textA

Return text with detected PII replaced by placeholders (e.g. , ). Deterministic; checksum-validated identifiers and context/precision rules apply so bare numbers are not over-masked.

entities is an optional PATH to a local .obsify.entities file of KNOWN names to hide; matches (incl. variants) are masked as . If omitted, a nearby .obsify.entities is auto-used.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
entitiesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does well by disclosing determinism, checksum-validated identifiers, over-masking avoidance, and the entities-file auto-use behavior. Minor gaps remain around error handling or what happens when no PII is detected, but transparency is strong overall.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the core operation, followed by key behavioral constraints and then the optional parameter explanation. Every sentence earns its place without unnecessary verbiage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simple 2-parameter shape and the presence of an output schema, the description is highly complete. It covers the main transformation, important edge-case prevention (bare numbers), and the optional entities file behavior. The description is sufficient for an agent to invoke the tool correctly without needing further clarification.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. It explains that `entities` is a path to a local `.obsify.entities` file, that matched names are masked as `<KNOWN_ENTITY>`, and that a nearby file is auto-used if omitted. This adds substantial meaning beyond the bare schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence clearly states the verb (redact), the resource (text), and the output format (PII replaced by placeholders), making the purpose immediately obvious. It also distinguishes itself from sibling tools like scan_pii and verify_value_free by explicitly conveying the redaction operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context about how the tool behaves and when the optional entities file applies, but it does not explicitly state when to prefer redact_text over sibling tools or when not to use it. There are no alternative tool comparisons or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_on_realA

COMPUTE-TO-DATA: execute your Python code LOCALLY against the real file at data_path (bound to the variable DATA_PATH in your code); the returned output is size-capped and best-effort PII-masked. The data never enters your context; substance never leaves. Return AGGREGATES (counts/sums/summaries) via print() — output masking is defense-in-depth, NOT a guarantee (NER can miss a name in a raw record), so never print raw records or identifiers. The masking field carries this caveat with the result. Network is disabled and a timeout applies.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYes
timeoutNo
data_pathYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and handles it well: output is size-capped, PII masking is best-effort and explicitly not a guarantee, network is disabled, a timeout applies, and execution is local. It also warns that raw records/identifiers should never be printed, adding important safety context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well organized: concept label, action, safety constraints, and usage guidance. Bolded callouts ('Return AGGREGATES...', 'best-effort') make key instructions easy to parse, and no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a code-execution tool with no output schema and no annotations, the description covers the essential operational surface: local execution, data binding, output size, masking caveat, aggregate printing, network isolation, and timeout. It is sufficient for an agent to invoke the tool safely and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds strong semantics for code (Python executed locally) and data_path (bound to DATA_PATH), but timeout is only indirectly covered by 'a timeout applies' and the schema's default, not explained as a configurable parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'COMPUTE-TO-DATA' and clearly states the tool executes Python code locally against a real file at data_path, binding it to DATA_PATH. This is a specific verb+resource pairing and is distinct from siblings like make_synthetic_twin, which implies synthetic data operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description strongly implies when to use it: when you need to compute over real data without pulling raw data into context ('data never enters your context'). It gives actionable guidance to print aggregates and avoid raw records, but it does not explicitly name alternative tools or state when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_piiA

Scan a file or folder for PII and return TYPES + LOCATIONS + COUNTS only — never the detected values. Safe to surface to an LLM: it learns what PII exists and where, without the substance entering context. Recurses into subfolders; skips unreadable files and caps very large sheets, reporting both as notes.

entities is an optional PATH to a local .obsify.entities file (one name per line) of KNOWN names to hide; matches (incl. suffix/abbreviation variants) are reported as KNOWN_ENTITY. If omitted, a nearby .obsify.entities is auto-used. The names are read locally and never returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
entitiesNo
max_cellsNo

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description provides thorough behavioral details: it returns only metadata (not values), skips unreadable files, caps very large sheets, and reads the entities file locally without returning the names. It also explains the automatic fallback for the entities file. This gives a clear picture of side effects and limitations, exceeding the typical level of transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear first paragraph on functionality and a second on the entities parameter. It is concise enough to convey necessary details without fluff, though the entities explanation could be slightly tighter. The information is relevant and not redundant, earning a high score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides a high-level overview of the return value (types, locations, counts) without specifying the exact output format, which is acceptable given no output schema. It covers main behaviors (recursion, skipping, capping) and the entities file. It lacks explicit error handling or return structure details, but for a scan tool, the description sufficiently completes the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds significant meaning for the 'entities' parameter by explaining its purpose, format, and default behavior. It indirectly touches on 'max_cells' by mentioning capping large sheets, but does not explicitly link it to the parameter. The 'path' parameter is self-explanatory given the context. Overall, it compensates for the lack of schema descriptions, though not perfectly for max_cells.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans files or folders for PII and returns only types, locations, and counts, never the values. It also mentions recursion, skipping unreadable files, and capping large sheets, which fully specifies the tool's function. This distinguishes it from sibling tools like redact_text or make_synthetic_twin.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly explain when to use this tool over its siblings. It implies usage for scanning and reporting PII metadata, and the safety note ('Safe to surface to an LLM') hints at a use case, but there is no direct comparison or guidance on choosing between tools. The behavior details (recursion, skipping) could inform usage, but explicit 'use when' instructions are absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_value_freeA

Fail-closed check that text contains NONE of terms (nor their suffix-normalized / distinctive-token variants). Returns {"value_free": bool} with zero detail on what matched — for verifying an artifact before it leaves the perimeter.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
termsYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral clarity. It discloses the fail-closed behavior, the variant-matching behavior, and the deliberately detail-poor return shape. It does not explicitly state there are no side effects, but the read-only check nature is strongly implied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, stating the check first, then the return contract, then the intended target scenario. Every sentence contributes useful information without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter boolean verification tool, the description is nearly complete: it names inputs, behavior, return value, and intended boundary context. It leaves minor edge-case behavior unspecified, but this does not materially hamper selection or invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no parameter descriptions, but the description defines the core semantics: `text` is the artifact being verified and `terms` are the prohibited strings matched directly or through normalized variants. It adds meaningful algorithmic context beyond the bare schema, though it omits edge cases like empty terms behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a fail-closed verification check that `text` contains none of `terms` or their variants, giving a specific verb, resource, and scope. It distinguishes itself from sibling tools by being a boolean verification gate rather than a scanning or redaction operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly identifies the intended use case: verifying an artifact before it leaves the perimeter. It implies this is a pre-release/compliance gate rather than a diagnostic tool, and the zero-detail return further signals it is not for troubleshooting that needs matched context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.2.0
    • First observedmake_synthetic_twin
    • First observedredact_text
    • First observedrun_on_real
    • First observedscan_pii
    • First observedverify_value_free

TDQS

A4.4/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clear, distinct purpose: make_synthetic_twin creates a fake dataset, run_on_real executes code against real data, scan_pii identifies PII locations, redact_text masks PII in text, and verify_value_free checks for forbidden terms. No two tools overlap in what they accomplish.

Naming Consistency4/5

Most tools follow a verb_noun pattern (make_synthetic_twin, scan_pii, redact_text, verify_value_free), but run_on_real breaks the pattern with a prepositional phrase. The style is consistent (all snake_case, verbs first) but the deviation is noticeable.

Tool Count4/5

With 5 tools, the count is well-scoped for a focused PII-handling server. Each tool covers a necessary step in the workflow, and the count is within the typical 3-15 range, though a few additional helpers could be justified (e.g., a check for twin accuracy).

Completeness4/5

The tool surface covers the core lifecycle: protect data (scan, redact, verify) and enable safe analysis (twin, run on real). Minor gaps exist, such as no tool to validate the synthetic twin's fidelity against the real file, and verify_value_free lacks a positive counterpart, but agents can work around these.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Let LLMs analyze sensitive data safely by querying a tokenized, join-preserving copy of the database, with fail-closed PII scanning and provable numeric equivalence.
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Acts as an anonymizing proxy between AI agents and databases, detecting PII and replacing it with realistic fake data so agents never see real data.
    Apache 2.0
  • A
    license
    A
    quality
    B
    maintenance
    Self-hosted governance layer between an AI assistant and your data: allow/deny policy, deterministic PII masking, row caps, and a hash-chained audit log with an Ed25519-signed receipt for every access, verifiable offline.
    4
    481 npm
    3
    MIT