How do I use privacy-gateway-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@privacy-gateway-mcp Draft a reply to this email, redacting any personal or financial details first." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

privacy-gateway-mcp

by jogustainsson

Overview Schema Source Related Servers Score Discussions Admin

Python

Local

privacy-gateway-mcp

An MCP server that sits between an assistant and a cloud LLM and enforces a simple rule: no raw sensitive data leaves the process.

Before any text is sent out, the gateway:

Redacts sensitive entities (emails, phones, national IDs, cards, money, API keys) into reversible placeholders — ana@acme.cl → [EMAIL_1].
Runs a deterministic egress policy that can ALLOW, require HUMAN APPROVAL, or BLOCK the call. The LLM never gets to overrule it.
Re-hydrates the provider's reply, so the caller sees real values while the cloud only ever saw placeholders.
Writes every decision to an append-only audit log.

This is a small, generic illustration of a pattern I run in a private production system: a multi-agent setup where business rules live in code, not in the prompt, and any action that touches data or money needs explicit confirmation. No business logic or real data is included here.

Why this exists

LLM assistants are great at drafting replies to an email or summarizing a contract — but doing so usually means shipping the raw text (names, phone numbers, amounts) to a third-party API. Two things must be true before that's acceptable:

The cloud must not see real entities. Redaction is bidirectional so the answer is still useful.
The decision to send can't be the model's. Whether a payload leaves — and whether a human signs off first — is a hard rule enforced in code. The model proposes; the gateway decides.

That "deterministic layer over the LLM" plus "confirm before it leaves" is the whole point.

Related MCP server: Redaction & Compliance MCP Server

Architecture

                 ┌──────────────────────── privacy gateway ────────────────────────┐
   text ───▶ redact (reversible)  ─▶  egress policy ─┬─ BLOCKED        ─▶ ✋ nothing leaves
                                                     ├─ NEEDS_APPROVAL ─▶ 🎫 token, nothing leaves
                                                     └─ ALLOWED        ─▶ send redacted ─▶ cloud LLM
                                                                                            │
   caller ◀──────────────── rehydrate ◀──────────────────────────────── redacted reply ◀──┘
                 └── every path is written to an append-only audit log ──┘

Module	Responsibility
`anonymizer.py`	Bidirectional entity redaction (span-based, consistent placeholders)
`policy.py`	Deterministic egress rules — `BLOCKED > NEEDS_APPROVAL > ALLOWED`
`confirm.py`	Single-use, TTL-bound human-approval tokens
`audit.py`	Append-only decision log (counts + reasons, never raw values)
`providers.py`	Pluggable cloud provider (`EchoProvider` stub by default, offline)
`gateway.py`	Orchestration — pure, synchronous, framework-free (fully unit-tested)
`server.py`	Thin MCP wrapper exposing the tools + resource

The core (gateway.py and below) has no MCP dependency, so the guardrails are tested in isolation and the MCP layer stays thin.

MCP tools

Tool	What it does
`redact_preview(text)`	Dry run: shows what would be redacted and how the policy would rule. No send, no token.
`ask_cloud_llm(text)`	Guarded egress. Returns `sent` (with the re-hydrated reply), `blocked`, or `needs_approval` (with a `confirmation_token`).
`confirm_send(token)`	Releases a payload the policy flagged for approval. Token is single-use and time-limited.
`get_audit_log()`	The append-only decision trail. Also exposed as the resource `audit://log`.

The policy (defaults)

Signal	Outcome
Text contains an API key/token or a card number	BLOCKED — never routed to the cloud, even redacted
A sensitive entity survives redaction	BLOCKED (fail-closed)
Text contains a monetary amount	NEEDS_APPROVAL
More than 5 entities redacted, or prompt > 4000 chars	NEEDS_APPROVAL
Otherwise	ALLOWED

All thresholds live in PolicyConfig — they are code, not prompt.

Run it

python -m venv .venv && source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -e .
python -m privacy_gateway_mcp.server                # stdio transport

{
  "mcpServers": {
    "privacy-gateway": {
      "command": "python",
      "args": ["-m", "privacy_gateway_mcp.server"]
    }
  }
}

Test

pip install -e ".[dev]"
pytest -q

The suite covers the pieces that matter: redaction round-trips to identity, secrets/cards are blocked, money needs approval, block beats approval, approval tokens are single-use and expire, and — end to end — the real entity never reaches the provider while the caller still gets it back re-hydrated.

Extending it

Real provider — implement CloudProvider.complete; a commented Anthropic sketch is in providers.py. Text is already redacted before it reaches the provider.
Better detection — the regex detectors are dependency-free on purpose (runs on bare metal, no model download). Swapping in an NER model (spaCy / Microsoft Presidio) is a single method on Anonymizer.detect.
Policy — add categories or thresholds in PolicyConfig; the engine picks them up.

License

MIT — see LICENSE.

Available Tools

4 tools

ask_cloud_llmA

Send text to the cloud LLM through the privacy gateway.

The text is redacted first; then the deterministic policy decides. Possible status values: sent (redacted text was dispatched and the reply re-hydrated), blocked (a hard rule refused it), or needs_approval (call confirm_send with the returned confirmation_token).

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It covers the redaction-first behavior, the policy decision, and the possible statuses (sent, blocked, needs_approval) along with the re-hydration behavior. It does not describe every edge case or auth requirement, but for a one-parameter send operation it reveals the consequential behavior well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded, and free of filler. Every sentence contributes behavior: sending, redaction, policy decision, and status handling. The formatting of status values and the confirm_send pointer is efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one parameter, no output schema, and no annotations, the description does enough by explaining the three possible statuses and the follow-up path via confirm_send. It lacks explicit return-shape details, but that is mitigated by the status enumeration. It is slightly incomplete in not mentioning when redact_preview would be a better first step, but it remains sufficiently usable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required parameter, text, and schema description coverage is 0%, so the description must add meaning. It does tell the agent that the text is sent and redacted first, which gives some semantic context beyond 'Text'. However, it does not describe constraints like length, encoding, or what kind of text is acceptable, leaving room for ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Send text to the cloud LLM through the privacy gateway') and clearly distinguishes the tool from the siblings: it is the actual send path, not redact_preview, not confirm_send, and not get_audit_log. It also names the key statuses that characterize what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear situational context: the text is redacted first, then a deterministic policy decides the outcome. It points the agent to confirm_send for the needs_approval case, which helps route to a sibling. It does not explicitly discuss when redact_preview should be used or when not to call this tool, but the main alternative is at least mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

confirm_sendA

Approve and release a payload the policy flagged for human approval. The token is single-use and time-limited.

ParametersJSON Schema

Name	Required	Description	Default
`token`	Yes

TDQS

A4.1/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It does add a critical behavioral constraint: 'The token is single-use and time-limited.' However, it does not explain what happens after approval, whether the release is irreversible, or what errors occur with an expired/used token. This is some useful disclosure but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences contain only relevant information: the primary action and the critical token constraint. The description is front-loaded with the verb and object, has no filler, and every sentence contributes. It is appropriately concise for a simple one-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, no output schema, and no annotations, the description covers the core purpose and the most important token behavior. It is missing details like where to obtain the token, what happens if the token is invalid, and whether the release can be undone. The definition is workable but leaves several operational questions unanswered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate for the lone 'token' parameter. It does so by explaining that the token is single-use and time-limited, which is essential semantic meaning beyond the schema's type string. It does not specify where the token comes from or its format, but for a single simple parameter this is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Approve and release'), a clear resource ('a payload'), and a precise scope ('the policy flagged for human approval'). This clearly distinguishes it from all sibling tools, which are about redacting, auditing, and LLM queries. It never resorts to tautology or restating the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'a payload the policy flagged for human approval' clearly indicates when to use the tool: only for payloads that are waiting on human approval. It does not explicitly enumerate alternatives or exclusions, but the sibling tools are unrelated enough that no ambiguity exists. The context is clear and enough for an agent to select it correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_audit_logA

Return the append-only log of every egress decision made this session.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A4.1/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It discloses that the log is 'append-only' and scoped to the current session, which are useful behavioral traits. However, it does not explicitly confirm the tool is read-only, mention ordering, or describe any other operational caveats. The description is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that conveys the essential purpose and scope without any filler. Every word earns its place, and the key concept ('append-only log') leads the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with an output schema present, the description is complete. It tells the agent exactly what is returned (log of all egress decisions this session), and the output schema covers return value details. No additional calling information is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so per the baseline rule this dimension receives a 4. There is no ambiguity about arguments, and the description needs to explain nothing beyond what the input schema already makes obvious.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return') and resource ('append-only log of every egress decision made this session'). It clearly defines the tool's scope and distinguishes it from sibling tools like redact_preview, confirm_send, and ask_cloud_llm, which are action-oriented rather than log-retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by specifying 'this session' and 'egress decision', which tells an agent this tool is for auditing session activity. However, it does not explicitly state when to use this tool versus alternatives, nor does it mention any exclusions. The usage is clear by inference, not by explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

redact_previewA

Show what would be redacted and how the egress policy would rule — without sending anything or issuing an approval token.

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the safety burden and does disclose the critical non-mutating behavior: it sends nothing and issues no approval token. It also explains that it only shows the redaction and policy ruling, which is the key behavioral trait an agent needs to know. It does not discuss return structure or error cases, but for a simple preview operation the essential side-effect behavior is covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence with no filler; the core action is front-loaded, and the important caveat about side effects is placed at the end. Every clause contributes meaning without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one required string parameter and no output schema, the description states the input purpose, the operation, and the side-effect exclusions. It lacks explicit return structure details, but for a preview tool these are inferred from the description 'Show what would be redacted and how the egress policy would rule'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not expand on the 'text' parameter beyond implying it is the content to preview. The parameter name and type are self-explanatory, so an agent can likely use it correctly, but the description adds no detail about format, length, or interpretation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Show') with a concrete resource: what would be redacted and how the egress policy would rule. It also draws a clear boundary from confirm_send by stating it does not send or issue an approval token, so an agent can tell this preview tool apart from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'without sending anything or issuing an approval token' establishes when this tool should be used: as a safe preview before an actual send/approve action. It does not explicitly name alternative tools, but the context is clear enough for an agent to infer it should be called instead of confirm_send.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

4 tool updatesv0.1.0Sep 7, 2026
- First observedask_cloud_llm
- First observedconfirm_send
- First observedget_audit_log
- First observedredact_preview

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.4/5.0

Disambiguation5/5

Each tool serves a distinct purpose: previewing redactions, confirming sends, auditing decisions, and making requests. No overlap or ambiguity.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern (redact_preview, confirm_send, get_audit_log, ask_cloud_llm), making them predictable and easy to use.

Tool Count5/5

Four tools cover the essential workflow of a privacy gateway without unnecessary bloat or missing critical operations.

Completeness5/5

The set covers the full lifecycle: preview (redact_preview), action (ask_cloud_llm), approval (confirm_send), and audit (get_audit_log). No obvious gaps.

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

boundaryai
ai.boundaryai
Deterministic runtime safety for AI agents: scan PII, gate tool actions, verify LLM output.
Security AI & Machine Learning Agent Orchestration
2
sigma-gate A
io.github.spektre-labs
Deterministic trust gate for AI output: leaked-secret, prompt-injection & PII in one call.
Security AI & Machine Learning
2
agentlock
io.github.Olum289
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Security Agent Orchestration
2
Data Compliance Classifier MCP A
io.github.OjasKord
Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.
Legal & Compliance AI & Machine Learning Security
32

Related MCP Servers

zentric-protocol-mcpofficial
Security AI & Machine Learning
ZentricProtocol
F
license
Not graded
quality
D
maintenance
Security middleware for LLM apps and AI agent pipelines. Detects prompt injection attacks (22 signatures, 7 languages) and anonymizes PII (17 entity types). Deterministic, sub-25ms, GDPR Art.30 compliant.
Updated 3 months ago (2026-06-09 23:13 UTC)
-
Redaction & Compliance MCP
Security Monitoring
sunkencity999
A
license
Not graded
quality
D
maintenance
Provides a pre-flight/post-flight firewall for LLM calls with comprehensive detection, classification, policy enforcement, reversible redaction, output safety, and immutable audit logging.
Updated 10 months ago (2025-10-29 23:48 UTC)
1
MIT
classifinder-mcpofficial
Security AI & Machine Learning
ClassiFinder
A
license
A
quality
B
maintenance
Enables AI agents to scan text for leaked secrets and prompt injection markers, and redact them before reaching an LLM.
Updated 20 days ago (2026-08-19 00:52 UTC)
2
1
MIT
redact-mcp
Security Penetration Testing Legal & Compliance
r3352
F
license
Not graded
quality
C
maintenance
Automatically detects and obfuscates sensitive data (PII, secrets, etc.) before Claude processes it, with lossless restoration for client deliverables.
Updated 6 months ago (2026-03-23 13:52 UTC)
6
-

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jogustainsson/privacy-gateway-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

privacy-gateway-mcp

Why this exists

Architecture

MCP tools

The policy (defaults)

Run it

Test

Extending it

License

Available Tools

TDQS

TDQS

Output Schema

TDQS

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

zentric-protocol-mcpofficial

Redaction & Compliance MCP

classifinder-mcpofficial

redact-mcp

Latest Blog Posts

MCP directory API