What can you do with this server?

This server provides MCP tools for AI agents and firewalls to scan text for PII, secrets, and harmful content, redact sensitive information, and get policy recommendations. It offers: * promptshield.scan_text: Scan any text string (prompts, outputs, logs) for PII (e.g., emails), secrets (e.g., API keys), and harmful content, returning findings with risk levels, confidence scores, and character spans. * promptshield.scan_messages: Scan chat-style messages while preserving roles and indexes, useful for inspecting conversations before sending to models or tools. * promptshield.redact_text: Scan and return a redacted version of text with sensitive spans replaced (e.g., [PII], [SECRET]), along with a list of findings. * promptshield.evaluate_policy: Map findings to an action recommendation (allow, warn, redact, block) for consistent enforcement decisions.

How do I use PromptShield MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PromptShield MCP Scan this text for PII: 'email@test.com'" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

PromptShield MCP

by Zero-Harm-AI

Overview Schema Source Related Servers Discussions Admin

Python

Local

Zero Harm AI MCP

Zero Harm AI MCP is a Model Context Protocol server that lets AI agents and runtime firewalls call Zero Harm AI safety checks for text, chat messages, prompts, tool inputs, and generated outputs.

The server is a thin adapter over zero-harm-ai-detectors. It should not duplicate detector logic from the detector package or from the Zero Harm AI GitHub Action.

Goals

Expose PII, secret, and harmful-content detection through MCP tools.
Return structured findings that agents and firewalls can enforce.
Support local/self-hosted operation for sensitive data.
Keep logs privacy-safe by default.
Provide stable tool contracts that can be used by coding agents, chat agents, and firewall.

Related MCP server: AIM-Guard-MCP

Non-Goals

Reimplementing zero-harm-ai-detectors.
Acting as a hosted service by default.
Making policy enforcement decisions that belong to a firewall or calling agent.
Replacing the Zero Harm AI GitHub Action.

Relationship To Other Projects

zero-harm-ai-detectors
  Shared detector engine for PII, secrets, and harmful content.

zero-harm-ai-gh-action
  GitHub Action and CI-oriented scanner for pull requests.

zero-harm-ai-mcp
  MCP server adapter that exposes detector functionality to AI agents.

zero-harm-ai-firewall (future)
  Runtime enforcement layer. It can call zero-harm-ai-mcp or use
  zero-harm-ai-detectors directly.

Installation

Install from PyPI:

pip install zero-harm-ai-mcp

For local development:

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
pytest
ruff check .

MCP Client Configuration

{
  "mcpServers": {
    "zero-harm-ai": {
      "command": "zero-harm-ai-mcp",
      "args": []
    }
  }
}

MCP Tools

`zero_harm.scan_text`

Scan one text string for PII, secrets, and harmful content.

Use this for prompt inputs, generated outputs, tool arguments, logs, and arbitrary text.

`zero_harm.scan_messages`

Scan chat-style messages while preserving message roles and indexes.

Use this when an agent wants to inspect a conversation before sending it to a model or tool.

`zero_harm.redact_text`

Return a redacted version of text plus findings.

Use this when the caller wants to continue safely after removing sensitive spans.

`zero_harm.evaluate_policy`

Map detector findings to an action recommendation.

Use this when a caller wants a normalized decision such as allow, warn, redact, or block.

Working Examples

These examples are generated from the current local server implementation.

`zero_harm.scan_text`

Input:

{
  "text": "Contact alice@example.com before sharing the token.",
  "targets": ["pii", "secret", "harmful"],
  "redact": true
}

Output:

{
  "schema_version": "1.0.0",
  "risk_level": "medium",
  "recommended_action": "redact",
  "categories": [
    "pii"
  ],
  "summary": {
    "total_findings": 1,
    "pii": 1,
    "secret": 0,
    "harmful": 0
  },
  "findings": [
    {
      "type": "email",
      "category": "pii",
      "severity": "medium",
      "confidence": 0.99,
      "span": {
        "start": 8,
        "end": 25
      },
      "redacted": "[PII]",
      "message_index": null,
      "message_role": null,
      "evidence_available": false
    }
  ],
  "redacted_text": "Contact [PII] before sharing the token."
}

`zero_harm.scan_messages`

Input:

{
  "messages": [
    {
      "role": "system",
      "content": "You are a helpful assistant."
    },
    {
      "role": "user",
      "content": "My email is alice@example.com."
    }
  ],
  "targets": ["pii", "secret", "harmful"],
  "redact": true
}

Output:

{
  "schema_version": "1.0.0",
  "risk_level": "medium",
  "recommended_action": "redact",
  "categories": [
    "pii"
  ],
  "summary": {
    "total_findings": 1,
    "pii": 1,
    "secret": 0,
    "harmful": 0
  },
  "findings": [
    {
      "type": "email",
      "category": "pii",
      "severity": "medium",
      "confidence": 0.99,
      "span": {
        "start": 12,
        "end": 29
      },
      "redacted": "[PII]",
      "message_index": 1,
      "message_role": "user",
      "evidence_available": false
    }
  ],
  "redacted_text": "[{\"role\": \"system\", \"content\": \"You are a helpful assistant.\"}, {\"role\": \"user\", \"content\": \"My email is [PII].\"}]"
}

`zero_harm.redact_text`

Input:

{
  "text": "aws_access_key_id = AKIAIOSFODNN7EXAMPLE",
  "targets": ["pii", "secret", "harmful"]
}

Output:

{
  "schema_version": "1.0.0",
  "risk_level": "high",
  "recommended_action": "block",
  "categories": [
    "secret"
  ],
  "summary": {
    "total_findings": 1,
    "pii": 0,
    "secret": 1,
    "harmful": 0
  },
  "findings": [
    {
      "type": "api_key",
      "category": "secret",
      "severity": "high",
      "confidence": 0.95,
      "span": {
        "start": 20,
        "end": 40
      },
      "redacted": "[SECRET]",
      "message_index": null,
      "message_role": null,
      "evidence_available": false
    }
  ],
  "redacted_text": "aws_access_key_id = [SECRET]"
}

`zero_harm.evaluate_policy`

Input:

{
  "text": "Contact alice@example.com before sharing the token.",
  "targets": ["pii", "secret", "harmful"],
  "redact": false
}

Output:

{
  "schema_version": "1.0.0",
  "risk_level": "medium",
  "recommended_action": "warn",
  "categories": [
    "pii"
  ],
  "summary": {
    "total_findings": 1,
    "pii": 1,
    "secret": 0,
    "harmful": 0
  }
}

Privacy Requirements

Do not log raw input text by default.
Do not log detected secret values by default.
Include a config option for audit logs that stores only counts, categories, severities, and request metadata.
Avoid sending data to external services unless explicitly configured.
Keep the default transport local-first.

Development

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
pytest
ruff check .

Release

Build and validate distribution artifacts:

python -m build
twine check dist/*

See RELEASE.md for the full PyPI release flow.

Available Tools

4 tools

promptshield.evaluate_policyC

Return a normalized action recommendation for the supplied text.

Inputs: payload (required).

promptshield.redact_textC

Scan and redact sensitive spans from text.

Inputs: payload (required).

promptshield.scan_messagesC

Scan chat messages while preserving role and message indexes.

Inputs: payload (required).

promptshield.scan_textC

Scan text for PII, secrets, and harmful content.

Inputs: payload (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.1/5.0

Scored 2026-07-15 18:40 across 4 tools

Disambiguation5/5

Each tool targets a distinct operation (evaluate policy, redact, scan text, scan messages) with clear descriptions, making them easily distinguishable.

Naming Consistency5/5

All tools follow a consistent 'promptshield.<verb>_<object>' pattern with lowercase underscores, using verbs like evaluate, redact, and scan.

Tool Count5/5

Four tools is appropriate for a content safety server, covering key tasks without being too many or too few.

Completeness5/5

The set covers evaluation, scanning, and redaction for both general text and chat messages, providing a complete surface for common content security needs.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Agent SafeA
io.github.wowcool
Email safety MCP server. Detects phishing, prompt injection, CEO fraud for AI agents.
Security Autonomous Agents
2
https://agentsafe.locationledger.com/mcp
Imperium MCP Security — Prompt-Injection, Jailbreak & Tool Poisoning FirewallA
dev.agentdiet
Real-time MCP & A2A prompt-injection, jailbreak, and tool-schema poisoning firewall for AI agents.
Security AI & Machine Learning Agent Orchestration
21
https://mcp-security.agentdiet.dev/mcp
PromptGuardA
co.promptguard
Scan prompts for injection attacks, redact PII, and audit LLM SDK usage from any MCP client
Security AI & Machine Learning
131
https://api.promptguard.co/mcp
mcpC
com.wix
A Model Context Protocol server for Wix AI tools
Developer Tools Content Management Systems App Automation
215
https://mcp.wix.com/mcp

Related MCP Servers

Guardrail MCP Server
Security Autonomous Agents
tuesdays-dev
F
license
Not graded
quality
D
maintenance
A minimal Model Context Protocol server that provides a safety guardrail tool to check if provided context is free from code injection or harmful content.
Updated a year ago (2025-05-30 17:00 UTC)
-
AIM-Guard-MCP
Security Autonomous Agents
AIM-Intelligence
A
license
C
quality
D
maintenance
A Model Context Protocol (MCP) server that provides AI-powered security analysis and safety instruction tools. This server helps protect AI agents by providing security guidelines, content analysis, and cautionary instructions when interacting with various MCPs and external services.
Updated a year ago (2025-10-13 09:38 UTC)
6
24 npm
23
ISC
agent-safety-mcp
Security Monitoring Autonomous Agents
LuciferForge
A
license
A
quality
D
maintenance
Unified MCP safety server that detects prompt injection (75 patterns), scans LLM outputs for leaked secrets/PII, enforces API cost budgets, and creates signed audit trails. Zero ML dependencies, pure Python.
Updated 8 months ago (2026-03-14 14:53 UTC)
17
1
MIT
guardrails-mcp-server
Security AI & Machine Learning
ExpertVagabond
A
license
Not graded
quality
C
maintenance
MCP server for AI agent security guardrails. Provides input validation, prompt injection detection, PII redaction, output filtering, policy enforcement, rate limiting, and comprehensive audit logging.
Updated 2 months ago (2026-09-08 02:24 UTC)
66 npm
1
MIT

Zero Harm AI MCP

Goals

Non-Goals

Relationship To Other Projects

Installation

MCP Client Configuration

MCP Tools

zero_harm.scan_text

zero_harm.scan_messages

zero_harm.redact_text

zero_harm.evaluate_policy

Working Examples

zero_harm.scan_text

zero_harm.scan_messages

zero_harm.redact_text

zero_harm.evaluate_policy

Privacy Requirements

Development

Release

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Guardrail MCP Server

AIM-Guard-MCP

agent-safety-mcp

guardrails-mcp-server

`zero_harm.scan_text`

`zero_harm.scan_messages`

`zero_harm.redact_text`

`zero_harm.evaluate_policy`

`zero_harm.scan_text`

`zero_harm.scan_messages`

`zero_harm.redact_text`

`zero_harm.evaluate_policy`