Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@balmas-mcp Read the latest contract in my work folder and restore real names in the summary."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Your AI agent reads everything. This gateway hands it redacted copies instead.
AI agents are getting file access — and they over-read. Israel's Privacy Protection Authority put it bluntly in its guidance on AI agents: an email-sorting agent can analyze 15 years of correspondence for a 2-year task, infer your health and finances along the way, and leak what it learned. Their recommendation: strict permission minimization — read-only, dedicated folders, minimum necessary data.
balmas-mcp turns that advice into code, and goes one step further: it minimizes not just which files the agent reads, but what's inside them.
Related MCP server: Redacted Context MCP
You allowlist folders. The agent can't reach anything else — enforced with realpath checks, not honor rules.
Every read is anonymized locally. Names, ID numbers, phones, emails,
companies and amounts become consistent tokens (PERSON_001, ID_001)
before the content is returned. Secrets too: API keys (OpenAI,
Anthropic, GitHub, AWS, Stripe, Slack…), JWTs, private-key blocks,
password: values and .env credentials become SECRET_001 at every
level — and are never written back by restore_text. The same person is PERSON_001 in every
file, so the agent's reasoning stays coherent. Detection runs in this
process — deterministic patterns, lexicons and checksums (Israeli ID
included). Hebrew and English.
The answer comes back real. restore_text maps the tokens in the
agent's final output back to the original values — locally.
Read-only by design: the server exposes no write tools at all.
Create a free account at balmasai.com/signup (10 documents/month free).
Create an API key (bk_...) at balmasai.com/app/team.
Add to your MCP client config (Claude Desktop shown; Cursor and others are the same idea):
{
"mcpServers": {
"balmas": {
"command": "npx",
"args": ["-y", "balmas-mcp", "/Users/me/Documents/work", "--level", "strict"],
"env": { "BALMAS_API_KEY": "bk_..." }
}
}
}Options: allowed folders as positional args (required, one or more) ·
--level standard|strict|maximum (default strict).
Tool | What the agent gets |
| Names, sizes, types inside allowed folders — never contents |
| The file's text after local anonymization |
| Real values back into its output (session tokens only) |
Supported inputs: txt csv md docx xlsx pptx pdf (text layer).
Leaves your machine? | |
File contents | Never |
File names / paths | Never |
The replacement map | Never |
Metering counters (file type + item counts) | Yes — that's all |
Each file read counts as one document against your account's monthly quota (free 10 / PRO 200 / TEAM 1,000). Full processing happens in this local process.
The gateway helps only when the agent reads files through it — grant it instead of raw filesystem access, not alongside.
Detection is deterministic: excellent, not clairvoyant. Review output where the stakes demand it.
Scanned PDFs (no text layer) need the OCR flow at balmasai.com/clean.
Built by BALMAS AI — sensitive data stops here. Docs: balmasai.com/mcp
This server cannot be deployed
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Securely search and manage workspace context files for AI agents and teams.
Detect and redact PII and secrets before text reaches an LLM, with reversible placeholders.
Check a document for hidden text before your agent reads it. PDF, Office, RTF, HTML.
