MCP Presidio
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP PresidioRedact any names, emails, and phone numbers from this customer feedback."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
β οΈ SECURITY & PRIVACY WARNING β οΈ
PLEASE READ CAREFULLY BEFORE USE
Using this MCP server to detect PII involves sending text data to the Presidio engine. While the processing happens locally within the container or python process, using this tool via an LLM Agent (like Claude, ChatGPT, etc.) implies that the text to be analyzed is being shared with that LLM.
RISKS:
PII Leakage: If you ask an LLM to "check this text for PII" or "anonymize this", you are sending the potentially sensitive text to the LLM provider first so they can construct the tool call.
Context Retention: The PII may be retained in the LLM's chat history, training data, or logs.
Transmitted Context: PII will be part of the prompt context transmitted over the network.
RECOMMENDED USE:
Local LLMs: Use with locally hosted LLMs where data does not leave your infrastructure.
Private/Enterprise Agents: Use in approved enterprise environments with strict data privacy agreements.
Non-LLM Integration: Use the underlying libraries directly in your code without an LLM intermediary if strict privacy is required.
ALTERNATIVE ARCHITECTURES: Consider using Presidio as a filter before the LLM. Tools like LiteLLM can integrate Presidio to sanitize input before it reaches the LLM provider, preventing PII from ever leaving your control. This MCP server is designed for agentic workflows where the LLM decides to check for PII, which inherently carries the risks mentioned above.
MCP Presidio
A Model Context Protocol (MCP) server that provides comprehensive PII (Personally Identifiable Information) detection and anonymization capabilities using Microsoft Presidio. This server enables LLMs to safely handle sensitive data by detecting and anonymizing PII in text and structured data.
Features
Core Capabilities
PII Detection: Identify 25+ types of PII including names, emails, phone numbers, credit cards, SSNs, addresses, and more
Text Anonymization: Multiple anonymization strategies (replace, redact, hash, mask, encrypt)
Structured Data Support: Analyze and anonymize JSON/dictionary data recursively
Batch Processing: Process multiple texts efficiently in batch operations
Custom Recognizers: Add domain-specific PII patterns with regex
Multi-language Support: Detect PII in multiple languages
Validation Tools: Test and validate detection accuracy with metrics
Available MCP Tools
analyze_text - Detect PII entities in text with confidence scores
anonymize_text - Anonymize PII using various operators
get_supported_entities - List all supported PII entity types
add_custom_recognizer - Add custom PII detection patterns
batch_analyze - Analyze multiple texts for PII
batch_anonymize - Anonymize multiple texts
get_anonymization_operators - List available anonymization methods
analyze_structured_data - Detect PII in JSON/structured data
anonymize_structured_data - Anonymize PII in structured data
validate_detection - Validate detection accuracy with metrics
Related MCP server: pii-anonymizer
Installation
Choose your preferred installation method:
π³ Docker - Self-contained, reproducible environment (recommended for production)
π Python - Direct installation with interactive setup
π¦ Manual - Full control over the installation process
For detailed Docker deployment instructions, see DOCKER.md.
Prerequisites
For Python Installation:
Python 3.10 or higher
pip or uv package manager
For Docker Installation:
Docker 20.10 or higher
Docker Compose (optional, for easier management)
Docker Installation (Recommended for Production)
Docker provides a self-contained, reproducible environment with all dependencies pre-installed.
Quick Start with Docker
# Clone the repository
git clone https://github.com/cmalpass/mcp-presidio.git
cd mcp-presidio
# Build the Docker image
docker build -t mcp-presidio .
# Run the container with stdio (default)
docker run -i mcp-presidioUsing Docker Compose
# Clone the repository
git clone https://github.com/cmalpass/mcp-presidio.git
cd mcp-presidio
# Build and start the container
docker-compose up -d
# View logs
docker-compose logs -f
# Stop the container
docker-compose downConfiguring Claude Desktop with Docker
To use the Docker container with Claude Desktop, update your claude_desktop_config.json:
{
"mcpServers": {
"presidio": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"mcp-presidio:latest"
],
"env": {}
}
}
}Or if using a pre-built image from a registry:
{
"mcpServers": {
"presidio": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/cmalpass/mcp-presidio:latest"
],
"env": {}
}
}
}Docker Image Details
The Docker image includes:
Python 3.11 slim base
All required dependencies (mcp, presidio-analyzer, presidio-anonymizer, spacy)
Pre-installed English language model (en_core_web_lg)
Security-hardened with non-root user
Multi-stage build for minimal image size (~500MB)
Advanced Docker Usage
Interactive Shell for Debugging:
docker run -it mcp-presidio bashCustom Language Models: To include additional language models, modify the Dockerfile:
# Add after the English model installation
RUN python -m spacy download es_core_news_lg # Spanish
RUN python -m spacy download fr_core_news_lg # French
RUN python -m spacy download de_core_news_lg # GermanThen rebuild the image:
docker build -t mcp-presidio:multilang .Volume Mounting for Custom Configurations:
docker run -i -v $(pwd)/config:/app/config:ro mcp-presidioPython Installation (Quick Install)
Use the interactive installation script that handles dependencies and language models:
Unix/Linux/macOS:
# Clone the repository
git clone https://github.com/cmalpass/mcp-presidio.git
cd mcp-presidio
# Run the installation script
./install.sh
# or
python install.pyWindows:
# Clone the repository
git clone https://github.com/cmalpass/mcp-presidio.git
cd mcp-presidio
# Run the installation script
install.bat
# or
python install.pyThe script will:
Check Python version compatibility
Install base dependencies (mcp, presidio-analyzer, presidio-anonymizer, spacy)
Prompt for language model installation (English, Spanish, French, German, etc.)
Optionally install development dependencies
Verify the installation
Test basic functionality
Python Installation (Manual)
If you prefer manual installation:
# Clone the repository
git clone https://github.com/cmalpass/mcp-presidio.git
cd mcp-presidio
# Install the package
pip install -e .
# Download required spaCy language model (for English)
python -m spacy download en_core_web_lgFor other languages, download the appropriate spaCy model:
# Spanish
python -m spacy download es_core_news_lg
# French
python -m spacy download fr_core_news_lg
# German
python -m spacy download de_core_news_lgUsage
Running the Server
The server runs using stdio transport, suitable for MCP clients:
mcp-presidioOr run directly with Python:
python -m mcp_presidio.serverConfiguring with Claude Desktop
Add to your Claude Desktop configuration (claude_desktop_config.json):
{
"mcpServers": {
"presidio": {
"command": "python",
"args": ["-m", "mcp_presidio.server"],
"env": {}
}
}
}Or if installed as a script:
{
"mcpServers": {
"presidio": {
"command": "mcp-presidio",
"args": [],
"env": {}
}
}
}Example Usage in LLM Conversations
Detecting PII:
User: Can you check this text for PII? "My name is John Smith and my email is john@example.com"
LLM: I'll analyze that text for PII using the analyze_text tool.
[Tool calls analyze_text with the text]
Result: Found 2 PII entities:
- PERSON: "John Smith" (confidence: 0.85)
- EMAIL_ADDRESS: "john@example.com" (confidence: 1.0)Anonymizing Text:
User: Can you anonymize this customer feedback? "I'm Jane Doe, call me at 555-123-4567"
LLM: I'll anonymize the PII in that text.
[Tool calls anonymize_text]
Result: "I'm <PERSON>, call me at <PHONE_NUMBER>"Working with Structured Data:
User: Check this JSON for PII: {"user": "bob@email.com", "phone": "555-0100"}
LLM: I'll analyze the structured data.
[Tool calls analyze_structured_data]
Result: Found PII in 2 fields:
- .user: EMAIL_ADDRESS
- .phone: PHONE_NUMBERSupported PII Entity Types
The server supports 25+ PII entity types including:
Personal: PERSON, DATE_TIME
Contact: EMAIL_ADDRESS, PHONE_NUMBER, URL
Financial: CREDIT_CARD, IBAN_CODE, US_BANK_NUMBER, CRYPTO
Government IDs: US_SSN, US_PASSPORT, US_DRIVER_LICENSE, UK_NHS
International IDs: SG_NRIC_FIN, IN_PAN, IN_AADHAAR, AU_ABN, AU_TFN, AU_MEDICARE
Location: LOCATION, IP_ADDRESS
Medical: MEDICAL_LICENSE
Other: And many more country-specific identifiers
Use the get_supported_entities tool to see all available types for your language.
Anonymization Operators
The server supports multiple anonymization strategies:
replace - Replace PII with placeholder text (e.g.,
<EMAIL_ADDRESS>)redact - Remove PII entirely from text
hash - Replace with cryptographic hash (SHA-256)
mask - Mask characters (e.g.,
***-**-1234)encrypt - Encrypt PII with AES encryption
keep - Keep PII as-is (for selective anonymization)
Advanced Features
Custom Recognizers
Add domain-specific PII patterns:
# Example: Detect custom employee IDs
add_custom_recognizer(
name="employee_id_recognizer",
entity_type="EMPLOYEE_ID",
patterns=[
{"name": "emp_pattern", "regex": "EMP-\\d{6}", "score": 0.9}
],
context=["employee", "staff", "worker"]
)Batch Processing
Process multiple documents efficiently:
# Analyze multiple texts
batch_analyze(
texts=["Text 1...", "Text 2...", "Text 3..."],
entities=["PERSON", "EMAIL_ADDRESS"],
score_threshold=0.5
)Language Support
Specify different languages:
analyze_text(
text="Me llamo MarΓa GarcΓa",
language="es"
)Validation and Testing
Validate detection accuracy:
validate_detection(
text="John lives at 123 Main St",
expected_entities=[
{"entity_type": "PERSON", "start": 0, "end": 4},
{"entity_type": "LOCATION", "start": 14, "end": 27}
]
)
# Returns precision, recall, and F1 scoreArchitecture
This MCP server integrates:
MCP FastMCP: Provides the MCP protocol implementation
Presidio Analyzer: Detects PII using NLP and pattern matching
Presidio Anonymizer: Anonymizes detected PII with various operators
spaCy: Powers the NLP engine for accurate entity recognition
Security Considerations
All processing happens locally - no data is sent to external services
The server uses stdio transport for secure communication with MCP clients
Multiple anonymization strategies available for different privacy requirements
Supports compliance requirements (GDPR, HIPAA, CCPA)
Docker deployment provides additional isolation and security through containerization
Container runs as non-root user for enhanced security
Development
Running Tests
# Install dev dependencies
pip install -e ".[dev]"
# Run tests
pytest tests/Project Structure
mcp-presidio/
βββ src/
β βββ mcp_presidio/
β βββ __init__.py
β βββ server.py # Main MCP server implementation
βββ tests/ # Test suite
βββ Dockerfile # Docker container definition
βββ docker-compose.yml # Docker Compose configuration
βββ docker-entrypoint.sh # Container entrypoint script
βββ .dockerignore # Docker build exclusions
βββ pyproject.toml # Project configuration
βββ README.md # This file
βββ DOCKER.md # Detailed Docker deployment guide
βββ .gitignoreLicense
MIT License - see LICENSE file for details
Contributing
Contributions are welcome! Please feel free to submit issues or pull requests.
Acknowledgments
Microsoft Presidio - The underlying PII detection engine
Model Context Protocol - The protocol specification
spaCy - NLP library for entity recognition
Support
For issues, questions, or contributions, please visit the GitHub repository.
Available Tools
10 toolsadd_custom_recognizerA
Add a custom PII recognizer with regex patterns.
Args:
name: Unique name for this recognizer
entity_type: The entity type this recognizer detects
patterns: List of pattern dicts with 'name', 'regex', and 'score' (0.0-1.0)
Example: [{"name": "weak", "regex": "\d{3}", "score": 0.3}]
context: Optional context words that increase confidence
supported_language: Language code (default: "en")
Returns:
JSON string confirming the recognizer was added
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| entity_type | Yes | ||
| patterns | Yes | ||
| context | No | ||
| supported_language | No | en |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the tool adds a recognizer (implying a write operation) and specifies the return format, but lacks details on permissions, side effects, error handling, or rate limits. It adds basic behavioral context but misses critical operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core purpose, followed by a clear breakdown of arguments and returns. Every sentence adds essential information without redundancy, making it efficient and easy to parse for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, write operation) and no annotations, the description does well by explaining parameters and return values. However, it lacks guidance on usage versus siblings and some behavioral details like error cases. The presence of an output schema reduces the need to detail returns, but overall completeness is strong with minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate fully. It provides detailed semantics for all 5 parameters, including examples for 'patterns', optionality for 'context', defaults for 'supported_language', and clarifies data types and constraints (e.g., score range 0.0-1.0), adding significant value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Add a custom PII recognizer') and resource ('with regex patterns'), distinguishing it from sibling tools like analyze_text or get_supported_entities. It precisely communicates the tool's function without being tautological.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like get_supported_entities or validate_detection. It lacks context about prerequisites, typical use cases, or exclusions, leaving the agent to infer usage from the purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_structured_dataC
Analyze structured data (JSON/dict) for PII.
Args:
data: JSON string representing structured data
language: Language code (default: "en")
entities: List of entity types to detect (default: all)
score_threshold: Minimum confidence score (default: 0.0)
Returns:
JSON string with PII findings organized by data structure path
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| language | No | en | |
| entities | No | ||
| score_threshold | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the tool analyzes for PII and returns findings, but lacks critical behavioral details: it doesn't specify what 'analyze' entails (e.g., detection only, no modification), required permissions, rate limits, error handling, or performance characteristics. The description is minimal and misses key operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the purpose, followed by a structured list of args and returns. Every sentence adds value, with no redundancy. It could be slightly more concise by integrating the args/returns into prose, but it's efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters with 0% schema coverage and no annotations, the description is moderately complete: it covers the purpose and parameters at a high level. However, with an output schema present, it needn't explain return values in detail, but it still lacks behavioral context (e.g., safety, limits) and usage guidelines, making it adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists all four parameters with brief explanations (e.g., 'JSON string representing structured data'), adding basic meaning beyond the schema's titles. However, it doesn't elaborate on formats (e.g., JSON structure), entity type options, or threshold implications, leaving gaps in understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Analyze structured data (JSON/dict) for PII.' It specifies the verb ('analyze'), resource ('structured data'), and target ('PII'). However, it doesn't explicitly differentiate from siblings like 'analyze_text' or 'batch_analyze' beyond the 'structured data' qualifier, which is implied but not contrasted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention siblings like 'analyze_text' (for text vs. structured data) or 'batch_analyze' (for batch processing), nor does it specify prerequisites, exclusions, or optimal use cases. Usage is implied by the tool name but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_textA
Analyze text to detect PII entities.
Args:
text: The text to analyze for PII
language: Language code (default: "en")
entities: List of entity types to detect (default: all). Examples: PERSON, EMAIL_ADDRESS,
PHONE_NUMBER, CREDIT_CARD, LOCATION, DATE_TIME, etc.
score_threshold: Minimum confidence score (0.0-1.0) for detection (default: 0.0)
return_decision_process: Include detailed decision process in results (default: False)
Returns:
JSON string with detected PII entities including type, location, and confidence score
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| language | No | en | |
| entities | No | ||
| score_threshold | No | ||
| return_decision_process | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses key behavioral traits: it performs PII detection (not anonymization), returns JSON with specific fields, and includes optional detailed decision process. However, it doesn't cover rate limits, authentication needs, or error handling, leaving gaps for a mutation-like analysis tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (Args, Returns), front-loaded purpose statement, and every sentence adds value. No redundant informationβeach parameter explanation is necessary given the 0% schema coverage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters with 0% schema coverage and no annotations, the description does an excellent job explaining inputs and output format. However, as an analysis tool with potential side effects (e.g., data processing), it could benefit from more behavioral context like performance characteristics or error cases. The output schema existence reduces but doesn't eliminate this need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate fully. It provides detailed semantics for all 5 parameters: explains 'text' purpose, 'language' default and format, 'entities' examples and default, 'score_threshold' range and default, and 'return_decision_process' effect. This adds substantial value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verb ('analyze') and resource ('text to detect PII entities'), distinguishing it from siblings like 'anonymize_text' or 'analyze_structured_data'. It explicitly mentions what the tool does beyond just the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through parameter explanations (e.g., 'entities: List of entity types to detect'), but lacks explicit guidance on when to use this tool versus alternatives like 'batch_analyze' or 'validate_detection'. No when-not-to-use scenarios or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
anonymize_structured_dataC
Anonymize PII in structured data (JSON/dict).
Args:
data: JSON string representing structured data
language: Language code (default: "en")
operator: Anonymization operator (default: "replace")
entities: List of entity types to anonymize (default: all)
score_threshold: Minimum confidence score (default: 0.0)
Returns:
JSON string with anonymized structured data
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| language | No | en | |
| operator | No | replace | |
| entities | No | ||
| score_threshold | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions that the tool anonymizes PII, but doesn't explain what happens during anonymization (e.g., whether data is modified in-place, if original data is preserved, error handling, or performance considerations). For a mutation tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and well-structured: it starts with a clear purpose statement, followed by an 'Args' section listing parameters with defaults, and ends with a 'Returns' section. Each sentence earns its place, but it could be more front-loaded by emphasizing the tool's role relative to siblings upfront.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, mutation operation, no annotations) and the presence of an output schema (which covers return values), the description is moderately complete. It explains parameters and returns, but lacks behavioral context (e.g., how anonymization works) and usage guidelines, making it adequate but with clear gaps for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists all 5 parameters with brief explanations (e.g., 'JSON string representing structured data' for 'data'), which adds meaning beyond the bare schema. However, it doesn't provide details on allowed values (e.g., valid 'language' codes, 'operator' options, or 'entities' types), leaving gaps in parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Anonymize PII in structured data (JSON/dict).' It specifies the verb ('anonymize'), resource ('structured data'), and format ('JSON/dict'), which is specific and actionable. However, it doesn't explicitly differentiate from sibling tools like 'anonymize_text' or 'batch_anonymize', which handle similar anonymization tasks but for different data types or in batch mode.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'anonymize_text' (for text data) or 'batch_anonymize' (for batch processing), nor does it specify prerequisites, exclusions, or typical use cases. This leaves the agent without context for tool selection among similar anonymization options.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
anonymize_textA
Anonymize PII in text using various operators.
Args:
text: The text to anonymize
language: Language code (default: "en")
operator: Anonymization operator - "replace", "redact", "hash", "mask", "encrypt" (default: "replace")
entities: List of entity types to anonymize (default: all)
score_threshold: Minimum confidence score for detection (default: 0.0)
operator_params: Additional parameters for the operator (e.g., {"new_value": "ANONYMIZED"})
Returns:
JSON string with anonymized text and list of anonymized entities
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| language | No | en | |
| operator | No | replace | |
| entities | No | ||
| score_threshold | No | ||
| operator_params | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the tool 'anonymizes' text but doesn't clarify whether this is a read-only operation, what permissions are needed, if it's destructive to the input, rate limits, or error handling. The return format is mentioned but lacks detail on structure or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a brief purpose statement followed by a bullet-point style breakdown of args and returns. Every sentence adds value without redundancy, and it's front-loaded with the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (6 parameters, no annotations, but has an output schema), the description is reasonably complete. It covers all parameters and mentions the return format. However, it lacks behavioral context and usage guidelines, which are important for a tool that modifies sensitive data (PII). The output schema existence reduces the need to detail return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides clear explanations for all 6 parameters, including defaults and examples (e.g., operator options like 'replace', 'redact', and operator_params example). This adds significant meaning beyond the bare schema, though it could elaborate more on entity types or score_threshold implications.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Anonymize PII in text') and resource ('text'), distinguishing it from sibling tools like 'anonymize_structured_data' which handles structured data instead of text. The verb 'anonymize' is precise and differentiates from analysis tools in the same server.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'anonymize_structured_data' or 'batch_anonymize'. The description mentions what the tool does but offers no context about appropriate use cases, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
batch_analyzeB
Analyze multiple texts in batch for PII detection.
Args:
texts: List of texts to analyze
language: Language code (default: "en")
entities: List of entity types to detect (default: all)
score_threshold: Minimum confidence score (default: 0.0)
Returns:
JSON string with results for each text indexed by position
| Name | Required | Description | Default |
|---|---|---|---|
| texts | Yes | ||
| language | No | en | |
| entities | No | ||
| score_threshold | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the tool analyzes for PII detection and returns JSON results, but lacks details on permissions, rate limits, error handling, or what 'analyze' entails (e.g., detection only, no modification). For a batch processing tool with zero annotation coverage, this is insufficient to inform safe and effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the purpose clearly, followed by structured sections for 'Args' and 'Returns' that are easy to parse. Every sentence adds value without redundancy, making it efficient and well-organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (batch analysis with 4 parameters), no annotations, and an output schema present (implied by 'Returns' note), the description is reasonably complete. It covers purpose, parameters, and return format, but lacks behavioral context like error handling or performance considerations, which would be beneficial for a batch tool. The output schema reduces the need to detail return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant meaning beyond the input schema, which has 0% description coverage. It explains each parameter's purpose: 'texts' as 'List of texts to analyze', 'language' as 'Language code', 'entities' as 'List of entity types to detect', and 'score_threshold' as 'Minimum confidence score', including defaults. This compensates well for the schema's lack of descriptions, though it doesn't detail entity types or language code formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Analyze multiple texts in batch for PII detection.' It specifies the verb ('analyze'), resource ('multiple texts'), and domain ('PII detection'), which is specific and informative. However, it doesn't explicitly differentiate from sibling tools like 'analyze_text' or 'batch_anonymize', which would require mentioning batch vs single or analysis vs anonymization.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'analyze_text' (for single texts) or 'batch_anonymize' (for batch anonymization), nor does it specify prerequisites, exclusions, or optimal use cases. Usage is implied by the name and purpose but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
batch_anonymizeB
Anonymize multiple texts in batch.
Args:
texts: List of texts to anonymize
language: Language code (default: "en")
operator: Anonymization operator (default: "replace")
entities: List of entity types to anonymize (default: all)
score_threshold: Minimum confidence score (default: 0.0)
Returns:
JSON string with anonymized results for each text
| Name | Required | Description | Default |
|---|---|---|---|
| texts | Yes | ||
| language | No | en | |
| operator | No | replace | |
| entities | No | ||
| score_threshold | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool returns a 'JSON string with anonymized results for each text,' which gives basic output info, but lacks critical details: it doesn't specify what 'anonymize' entails (e.g., redaction, masking, pseudonymization), whether it's a read-only or mutating operation, potential rate limits, error handling, or privacy implications. For a tool with no annotations and 5 parameters, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized: it starts with a clear purpose statement, followed by a bullet-point list of parameters and returns. Each sentence earns its place by conveying essential information without redundancy. It could be slightly more front-loaded by integrating parameter defaults into the initial statement, but overall it's efficient and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (5 parameters, no annotations, but has an output schema), the description is moderately complete. It covers parameters and output format, but lacks behavioral context (e.g., how anonymization works, side effects) and usage guidelines. The output schema existence reduces the need to detail return values, but without annotations, the description should do more to explain the tool's operational traits and constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description lists all 5 parameters with brief explanations, adding meaning beyond the input schema, which has 0% description coverage. For example, it clarifies that 'entities' defaults to 'all' and 'score_threshold' is a 'minimum confidence score,' which the schema only titles generically. However, it doesn't elaborate on allowed values (e.g., what 'operator' options exist) or provide examples, preventing a perfect score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Anonymize multiple texts in batch.' It specifies the verb ('anonymize'), resource ('multiple texts'), and scope ('in batch'), which distinguishes it from sibling tools like 'anonymize_text' (likely single-text) and 'anonymize_structured_data' (different resource type). However, it doesn't explicitly contrast with 'batch_analyze' or other batch operations, keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'anonymize_text' for single texts, 'anonymize_structured_data' for non-text data, or 'batch_analyze' for analysis versus anonymization. Without such context, an agent must infer usage from tool names alone, which is insufficient for clear decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_anonymization_operatorsB
Get list of available anonymization operators and their descriptions.
Returns:
JSON string with operator names, descriptions, and example parameters
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns a JSON string with operator names, descriptions, and example parameters, which is useful behavioral context. However, it lacks details on potential limitations (e.g., rate limits, authentication needs, or whether the list is static or dynamic), leaving gaps in transparency for a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with two sentences: one stating the purpose and another detailing the return format. Each sentence earns its place by providing essential information without waste. It could be slightly improved by front-loading the return details more explicitly, but it's efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no annotations, but with an output schema), the description is reasonably complete. It explains what the tool does and the format of the return value, which compensates for the lack of annotations. However, it could benefit from more context on usage scenarios or limitations to fully address the tool's role among siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the schema description coverage is 100%, so there's no need for parameter details in the description. The description correctly omits parameter information, focusing instead on the return value. A baseline of 4 is appropriate as it avoids redundancy and adds value by explaining the output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get list of available anonymization operators and their descriptions.' This specifies the verb ('Get') and resource ('anonymization operators'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'get_supported_entities' or 'validate_detection', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With sibling tools like 'get_supported_entities' and 'validate_detection' that might overlap in functionality (e.g., retrieving information about anonymization components), there's no indication of when this specific tool is appropriate or what distinguishes it from others in the server.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_supported_entitiesA
Get list of all supported PII entity types for a language.
Args:
language: Language code (default: "en")
Returns:
JSON string with list of supported entity types and their descriptions
| Name | Required | Description | Default |
|---|---|---|---|
| language | No | en |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns a JSON string with a list of supported entity types and descriptions, which adds useful context about the output format. However, it doesn't mention behavioral traits like error handling, rate limits, or authentication needs, leaving gaps for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: it starts with the core purpose, followed by structured sections for Args and Returns. Every sentence earns its place by providing necessary information without redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter, no annotations, but has an output schema), the description is fairly complete. It explains the purpose, parameter semantics, and return format. Since an output schema exists, it doesn't need to detail return values further. However, it could improve by addressing potential errors or usage scenarios relative to siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema by specifying that the 'language' parameter is a language code with a default of 'en', which clarifies its purpose. Since there is only one parameter and schema description coverage is 0%, the description compensates well by providing essential semantics, though it could detail format constraints (e.g., ISO codes).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get list of all supported PII entity types for a language.' It specifies the verb ('Get'), resource ('supported PII entity types'), and scope ('for a language'), which is specific and actionable. However, it doesn't explicitly distinguish this from sibling tools like 'analyze_text' or 'get_anonymization_operators', which might also involve entity types, so it misses full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by mentioning the language parameter and its default, suggesting it's for retrieving entity types based on language. However, it doesn't provide explicit guidance on when to use this tool versus alternatives (e.g., 'analyze_text' for detection or 'get_anonymization_operators' for operators). The context is clear but lacks exclusions or named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_detectionA
Validate PII detection against expected results (useful for testing).
Args:
text: The text to analyze
expected_entities: List of expected entities with 'entity_type', 'start', 'end'
language: Language code (default: "en")
Returns:
JSON string with validation results including precision, recall, and F1 score
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| expected_entities | Yes | ||
| language | No | en |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the tool's testing-oriented behavior and the return format ('JSON string with validation results including precision, recall, and F1 score'), which is valuable. However, it doesn't mention potential side effects, error conditions, performance characteristics, or authentication needs, leaving gaps for a tool with 3 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: the first sentence states the purpose, followed by clear 'Args:' and 'Returns:' sections. Every sentence earns its place by explaining parameters and output without redundancy. It's appropriately sized for a 3-parameter tool with testing focus.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 parameters with 0% schema coverage and an output schema present, the description does a good job: it explains all parameters and the return value. However, as a validation/testing tool with no annotations, it could benefit from more behavioral context (e.g., error handling, what happens if validation fails). The output schema reduces the need to detail return values, but some gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaningful semantics: 'text' is 'The text to analyze', 'expected_entities' is a 'List of expected entities with 'entity_type', 'start', 'end'', and 'language' has a default 'en'. This clarifies purpose and structure beyond the bare schema, though it doesn't detail formats (e.g., what 'entity_type' values are).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Validate PII detection against expected results (useful for testing).' It specifies the verb ('validate') and resource ('PII detection'), and the parenthetical clarifies it's for testing. However, it doesn't explicitly differentiate from siblings like 'analyze_text' or 'batch_analyze' beyond the validation/testing aspect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context with '(useful for testing)', suggesting it's for validation/testing scenarios rather than production analysis. However, it doesn't provide explicit guidance on when to use this vs. alternatives like 'analyze_text' for detection without validation, or mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.0- First observed
add_custom_recognizer - First observed
analyze_structured_data - First observed
analyze_text - First observed
anonymize_structured_data - First observed
anonymize_text - First observed
batch_analyze - First observed
batch_anonymize - First observed
get_anonymization_operators - First observed
get_supported_entities - First observed
validate_detection
TDQS
Scored across 10 tools
Every tool has a clearly distinct purpose with no ambiguity. The tools are well-organized into categories: custom recognizer management (add_custom_recognizer), analysis (analyze_text, analyze_structured_data, batch_analyze), anonymization (anonymize_text, anonymize_structured_data, batch_anonymize), metadata retrieval (get_supported_entities, get_anonymization_operators), and validation (validate_detection). Each tool serves a unique function within the PII processing workflow.
The tool names follow a highly consistent verb_noun pattern throughout. All tools use snake_case with clear action-object naming: add_custom_recognizer, analyze_text, anonymize_structured_data, batch_analyze, get_supported_entities, validate_detection. The naming convention is perfectly uniform across all 10 tools, making them predictable and easy to understand.
With 10 tools, this server is well-scoped for PII detection and anonymization. Each tool earns its place by covering essential operations: analysis (single, structured, batch), anonymization (single, structured, batch), configuration (custom recognizers), metadata (entities, operators), and validation. The count is appropriate for the domain without being overwhelming or insufficient.
The tool surface provides complete coverage for PII processing workflows. It includes all necessary CRUD-like operations: adding custom recognizers, analyzing text/structured data (individually and in batch), anonymizing with various operators (individually and in batch), retrieving metadata about supported entities and operators, and validating detection accuracy. There are no obvious gaps that would hinder agent workflows.
Maintenance
Related MCP Connectors
MCP server for detecting and redacting PII (Personally Identifiable Information) in PDF documents.
Stateless PII redaction over MCP/REST. Free β€1000 words or $0.01/call; file upload supported.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
AI governance MCP server for EU AI Act compliance and jurisdiction verification
Related MCP Servers
- AlicenseAqualityCmaintenanceAI-powered sensitive info detection and masking MCP server supporting 14+ types with regex, checksum, and optional LLM semantic detection, enabling flexible masking strategies like mask, replace, hash, and redact.6MIT
- FlicenseNot gradedqualityDmaintenanceMCP server for automatic detection and redaction of PII in text, with anonymization and deanonymization capabilities, all local processing.1-
- AlicenseNot gradedqualityDmaintenanceA local, containerized MCP server that uses a local LLM to sanitize documents by removing or transforming PII before content is sent to public LLM services.MIT
- AlicenseAqualityAmaintenanceAn MCP server that redacts PII/PHI from text before it ever reaches an LLM β self-hosted, fail-closed, and HIPAA-aware.3MIT