docs-masked
docs-masked
로컬 문서 마스킹: 언어 모델에 보내기 전에 개인정보를 비식별화하고, 응답 후 원래 값으로 복원합니다.
문서는 원본 상태로 기기를 절대 떠나지 않습니다. 개인 데이터는 안정적인 태그(#PERSON_1#, #PHONE_2#, #ADDRESS_1#)로 대체되며, 모델에는 태그가 포함된 텍스트만 전송됩니다. 모델의 응답은 로컬 금고(vault)를 사용하여 원래 값으로 복원됩니다.
документ ──▶ маска ──▶ контроль утечки ──▶ модель ──▶ обратная подстановка
локально локально сеть локально이는 Claude Code의 스킬(skill), 다른 에이전트를 위한 MCP 서버, 그리고 일반적인 명령줄 유틸리티로 사용할 수 있습니다.
작동 방식
1. 마스킹. 문서는 텍스트 조각(문단, 셀, 마크업 노드)으로 분해됩니다. 각 조각에서 개인 데이터를 찾고, 각 값에 안정적인 태그를 할당합니다. 동일한 사람은 문서 전체에서 동일한 태그를 받습니다. 격변화 형태와 이니셜을 포함하여: "Иванов Иван Иванович", "Иванову", "Иванов И.И."는 모두 하나의 #PERSON_1#입니다.
2. 누출 제어. 마스킹된 텍스트는 모든 탐지기와 추가로 편집증적 검사를 다시 거칩니다: 모든 @, 7자리 이상의 숫자 시퀀스, 전화번호처럼 보이는 모든 것. 만약 남아있는 것이 있다면, 전송은 차단됩니다(로그 경고가 아닌 예외 발생).
3. 전송. 외부로는 태그가 있는 텍스트만 전송됩니다. 네트워크로의 유일한 출구는 llm.send() 함수이며, 이 함수는 요청 전에 검사를 수행해야 합니다. 각 전송은 ~/.pii_shield/egress.jsonl 로그에 기록됩니다: 시간, 제공자, 모델, 크기, sha256, 검사 상태. 내용은 기록되지 않습니다.
4. 복원. 모델의 응답은 금고를 통해 처리됩니다: 태그가 원본으로 대체됩니다. 성명의 경우 복원된 주격 형태가 사용됩니다. 문서에서 사람이 "Кузнецову Ивану Петровичу"로만 언급된 경우, 응답에서는 "Кузнецов Иван Петрович"가 됩니다.
Related MCP server: Doc Sanitizer MCP Server
설치
git clone https://github.com/kpshinnik/docs_masked.git ~/.docs_masked/src
cd ~/.docs_masked/src && ./install.sh스크립트가 종속성을 설치하고, 스킬을 ~/.claude/skills/docs-masked에 배치한 후 MCP 구성의 완성된 조각을 출력합니다. 자세한 내용과 옵션은 docs/INSTALL.md를 참조하세요.
에이전트에 연결
방법 | 대상 | 방법 |
스킬 | Claude Code, Claude.ai |
|
MCP 서버 | Cursor, Windsurf, Codex CLI, Continue, Zed, Cline, Claude Desktop |
|
CLI 및 규칙 | 그 외 모든 것 | 터미널 명령어 + |
각 하네스에 대한 단계별 가이드는 docs/HARNESSES.md를 참조하세요.
MCP 서버는 종속성 없이 작성되었습니다: python3만 있으면 됩니다. 여섯 가지 도구를 제공합니다: mask_text, unmask_text, verify_text, scan_document, mask_document, unmask_document.
사용법
docs-masked scan договор.docx # что будет скрыто
docs-masked mask договор.docx # маска + сейф
docs-masked report договор.docx --open # посмотреть глазами
docs-masked ask договор.docx -p "Найди риски по срокам"
docs-masked unmask договор.masked.docx --vault договор.docx.vault.json명령어
명령어 | 설명 |
| 마스킹될 내용을 보여줍니다. 파일은 변경되지 않으며 네트워크도 사용하지 않습니다. |
| 동일한 형식의 비식별화된 복사본과 금고 파일을 생성합니다. |
| 원본을 복원합니다. |
| 개인 데이터가 남아 있지 않은지 확인합니다. |
| 전체 사이클: 마스킹 → 검증 → 모델 → 복원된 응답. |
| HTML 리뷰 페이지: 각 대체 항목을 컨텍스트에 표시하며 값은 가려집니다. |
| 전체 사이클의 자체 테스트를 수행합니다. |
전체 플래그 목록은 skills/docs-masked/references/cli.md를 참조하세요.
인식 대상
모든 격의 성명(러시아어, 라틴 문자, 로마자 표기), 조직, 주소, 이메일, 전화번호, 여권 및 발급 부서 코드, SNILS, INN, OGRN, KPP, BIK, 계좌 번호, 은행 카드, IBAN, OMS 보험증, 운전면허증, 자동차 번호판, IP 주소, @닉네임, 생년월일 및 문서 발급일, 세부 코드(OKTMO, OKPO, KBK), 그리고 사용자 정의 문자열.
식별자는 실제로 검증됩니다: SNILS 체크섬, INN 및 OGRN 검증 숫자, 카드의 Luhn 알고리즘, IBAN의 mod-97. 전체 표는 references/coverage.md를 참조하세요.
형식
형식 | 읽기 | 제자리 쓰기 |
| 예 | 예 |
| 예 | 예 (서식 유지 포함) |
| 예 | 예 |
| 예 | 예 |
| 예 | 예 |
| 예 | 예 |
| 예 |
|
| 예 | 아니요 (macOS 전용, |
DOCX는 document.paragraphs가 아닌 XML을 통해 처리됩니다. 그렇지 않으면 콘텐츠 제어 및 캡션 내의 단락이 손실됩니다. 실제 계약서에서 이로 인해 세부 정보 블록의 전체 열이 사라졌습니다. 테이블에서 열 헤더는 컨텍스트로 사용됩니다: 셀 500100732259는 그 자체로는 무작위 숫자와 구별할 수 없지만, "INN" 열에서는 확실하게 인식됩니다.
Python API
from pii_shield import ask_document
res = ask_document("договор.docx", "Составь резюме и найди риски",
provider="anthropic")
print(res.answer) # имена уже восстановлены각 단계를 수동으로 제어:
from pii_shield import mask_text, assert_clean, unmask_text
r = mask_text(raw) # r.text — с тегами, r.vault — сейф
assert_clean(r.text) # LeakGuardError, если что-то осталось
answer = call_model(r.text) # наружу уходит только маска
final, unknown = unmask_text(answer, r.vault, mode="canonical")자세한 내용은 references/api.md를 참조하세요.
금고
금고는 태그와 원본을 연결하는 유일한 것입니다. 이것이 없으면 복원이 불가능합니다.
문서 옆에
<파일>.vault.json으로 생성되며, 권한은0600입니다.--pass-env플래그(scrypt + Fernet)로 암호화됩니다.정규형, 발견된 모든 변형, 문서 순서대로의 발생 기록을 저장합니다. 기록 덕분에 정확한 복원은 원래 단어 형태를 반환하며 정규형이 아닙니다.
.gitignore에 포함되어 있습니다. 커밋하지 마세요.
정확성 및 한계
이 도구는 안전한 방향으로 오류를 발생하도록 설계되었습니다: 놓치는 것보다는 과도하게 마스킹하는 것이 낫습니다. 알아야 할 사항:
텍스트 레이어가 없는 스캔 PDF는 처리되지 않습니다. OCR이 필요합니다.
이니셜이 없는 동성은 별도의 태그를 받으며, 한 사람으로 병합되지 않습니다.
힌트가 없는 순수 숫자는 식별자로 인식되지 않을 수 있습니다. 하지만 편집증적 검사는 여전히 그러한 텍스트가 외부로 나가는 것을 방지합니다.
임의의 라틴 문자 이름은 슬라브어 어미나 호칭(
Mr.,Dr.)이 없으면 인식되지 않습니다. 두 개의 대문자 단어 쌍을 모두 잡으려 하면 이점보다 해가 더 클 것입니다.
중요한 문서의 경우 docs-masked report를 한 번 시각적으로 확인하는 것이 좋습니다.
개발
python3 -m pytest tests/ -q # тесты
python3 -m pii_shield.cli selftest
python3 samples/make_samples.py # пересоздать тестовые документы깨뜨리면 안 되는 불변 조건은 AGENTS.md에 나열되어 있습니다.
samples/의 모든 것은 합성 데이터입니다. examples/ 디렉토리는 로컬 문서용으로 예약되어 있으며 저장소에 포함되지 않습니다.
라이선스
MIT.
Available Tools
6 toolsmask_documentB
Создать обезличенную копию файла в том же формате и сейф соответствий рядом. Для DOCX/XLSX сохраняется форматирование, для PDF доступно физическое вымарывание (pdf_redact).
| Name | Required | Description | Default |
|---|---|---|---|
| out | No | куда положить копию | |
| path | Yes | ||
| allowlist | No | строки, которые маскировать не нужно | |
| mask_urls | No | скрывать ссылки | |
| tag_style | No | формат тега: #PERSON_1# | [[PERSON_1]] | <PERSON_1> | |
| pdf_redact | No | ||
| vault_path | No | ||
| extra_terms | No | дополнительные строки для маскирования | |
| include_text | No | вернуть замаскированный текст в ответе | |
| mask_all_dates | No | скрывать все даты, не только даты рождения | |
| aggressive_names | No | скрывать одиночные слова, похожие на фамилии |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It explains that the tool creates a copy (non-destructive), preserves formatting for certain types, and has a PDF redaction option. However, it does not describe what the 'safe of matches' is, whether it modifies the original, or any other behavioral aspects like idempotency or authorization requirements. Some transparency but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short at two sentences, with the main action in the first sentence. It avoids clutter but omits important details like the purpose of the 'safe of matches'. It is reasonably concise, though the second sentence could be more integrated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 11 parameters covering many masking options and no output schema, the description is insufficient. It explains basic file copying and format handling but fails to describe the extensive configuration options (allowlist, URL/date masking, name detection) or the structure of the 'safe of matches' output. The agent would need to rely heavily on parameter descriptions, which are incomplete (only 73% coverage).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 73%, so the baseline is 3. The description adds no extra parameter details beyond what the schema already provides. It mentions PDF redaction (pdf_redact) but doesn't elaborate on other parameters like allowlist, out, or vault_path. Thus the description does not enhance parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the primary action: creating an anonymized copy of a file and a safety mapping. It specifies different behaviors for DOCX/XLSX vs PDF, adding context about format support. However, it does not explicitly distinguish from sibling tools like mask_text or unmask_document, though the document focus is implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings such as mask_text for text strings or scan_document for scanning. It lacks any conditions, prerequisites, or recommended use cases, leaving the agent to infer applicability solely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mask_textA
Заменить персональные данные в тексте на устойчивые теги (#PERSON_1#, #PHONE_2#). Вызывай это ДО того, как отправишь чужой текст куда-либо. Возвращает vault_id для обратной подстановки.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| allowlist | No | строки, которые маскировать не нужно | |
| mask_urls | No | скрывать ссылки | |
| tag_style | No | формат тега: #PERSON_1# | [[PERSON_1]] | <PERSON_1> | |
| extra_terms | No | дополнительные строки для маскирования | |
| mask_all_dates | No | скрывать все даты, не только даты рождения | |
| aggressive_names | No | скрывать одиночные слова, похожие на фамилии |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that it returns a vault_id for reverse substitution, but does not explain whether the operation is destructive, reversible beyond substitution, or has any side effects like logging or API rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences: the first explains what the tool does, the second gives critical timing advice. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the parameter richness (7 params, 86% schema coverage) and lack of output schema, the description adequately covers the main purpose and usage timing. It could improve by mentioning return value structure or error states, but it is sufficient for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 86%, so the baseline is 3. The description does not add extra meaning beyond the schema's descriptions (e.g., the allowlist, tag_style formats are already documented). The only added value is the overall workflow context, not parameter-specific details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'replace' and resource 'personal data in text', specifies the output format of stable tags like #PERSON_1#, and distinguishes itself from siblings like unmask_text and mask_document by focusing on text-level masking.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Call this BEFORE sending someone else's text anywhere', providing clear timing guidance. However, it does not explicitly state when not to use it or describe alternative tools like verify_text or mask_document for comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_documentA
Показать, что будет скрыто в файле: количество и типы находок. Файл не изменяется, оригиналы значений не возвращаются. Форматы: .csv, .doc, .docx, .htm, .html, .ini, .json, .log, .markdown, .md, .odt, .pdf, .rst, .rtf, .srt, .tex, .tsv, .txt, .wordml, .xhtml, .xlsm, .xlsx, .yaml, .yml
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| allowlist | No | строки, которые маскировать не нужно | |
| mask_urls | No | скрывать ссылки | |
| tag_style | No | формат тега: #PERSON_1# | [[PERSON_1]] | <PERSON_1> | |
| extra_terms | No | дополнительные строки для маскирования | |
| mask_all_dates | No | скрывать все даты, не только даты рождения | |
| aggressive_names | No | скрывать одиночные слова, похожие на фамилии |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It explicitly states the file is not modified and original values are not returned, which are key behavioral traits for a scan tool. It also lists supported formats, providing additional transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose and key guarantees, followed by a compact list of supported formats. No extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the tool's output nature (counts and types, no original values) but lacks a detailed return structure or error handling expectations. Given no output schema, it could be more explicit, but for a scan tool with 7 params, the provided information is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 86% (6/7 parameters have descriptions), so the schema already explains parameter meanings. The description itself does not add parameter details beyond noting file formats, which corresponds to the 'path' parameter but is already partially covered by the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Показать' - show) and resource ('что будет скрыто в файле'), clearly indicating a preview/scan function that counts and types findings. It distinguishes from siblings like mask_document (which actually modifies the file).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for non-destructive previewing but does not explicitly contrast with mask_document or other sibling tools. It provides clear context (file not modified, original values not returned) but no explicit when-to-use vs alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unmask_documentC
Восстановить оригиналы в ранее замаскированном файле по сейфу.
| Name | Required | Description | Default |
|---|---|---|---|
| out | No | ||
| mode | No | ||
| path | Yes | ||
| vault_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action ('restore originals') without revealing side effects, whether the operation is destructive, authentication requirements, or any rate limits. The description is insufficient for an agent to understand the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, but it is not concise because it is under-specified and in a non-English language, failing to efficiently convey necessary information. It does not earn its place as a useful guide.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 parameters (2 required), no output schema, and no annotations, the description is critically incomplete. It does not explain return values, prerequisites, parameter behavior, or any operational context. The agent cannot determine how to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no meaning to any parameter. The parameter names (out, mode, path, vault_path) are not explained, and the enum mode (sequential/canonical) is left undefined. The description does not compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool restores originals in a previously masked file by vault, which is a specific verb+resource. However, it is in Russian, which may reduce clarity for non-Russian-speaking agents. It distinguishes from siblings like mask_document and unmask_text, but the phrase 'by vault' is ambiguous and does not fully align with the parameter name 'vault_path'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives such as mask_document or unmask_text. There is no mention of prerequisites (e.g., the file must have been previously masked) or context for when unmasking is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unmask_textB
Вернуть оригиналы вместо тегов по сейфу. mode=canonical — для ответа модели (ФИО в именительном падеже), mode=sequential — точное восстановление ранее замаскированного текста.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| text | Yes | ||
| vault_id | Yes | идентификатор из mask_text или путь к файлу сейфа |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions that the tool returns originals from a vault and describes two modes, but it does not disclose whether the operation is read-only, whether it modifies the vault, what happens on invalid vault_id or text, or any side effects. For a tool that likely interacts with a vault, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: two sentences conveying purpose and mode details. The first sentence clearly states the action, and the second elaborates on modes. It is front-loaded and efficient, though it could be slightly more structured (e.g., separating mode descriptions) without losing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, no output schema, and no annotations, the description is incomplete. It explains modes but does not describe the return format, prerequisites (e.g., that text must have been previously masked), error conditions, or the behavior of the text parameter. The lack of output schema information means the agent has no idea what the tool returns. This is insufficient for safe and correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% (only vault_id has a description). The description adds meaning for the mode parameter by explaining the two enum values, but it does not describe the text parameter at all. The vault_id parameter's schema description already covers its purpose. Overall, the description partially compensates for the low schema coverage by clarifying the mode parameter, but the text parameter remains undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Return originals instead of tags from the vault.' The two modes (canonical for model response, sequential for exact restoration) further specify what the tool does. The name and sibling tools (mask_text, unmask_document) help distinguish it as a text-level unmasking operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use each mode (canonical for model response, sequential for exact restoration), but it does not explicitly state when to avoid this tool, nor does it compare it to alternatives like unmask_document or verify_text. The guidance is implicit through the mode descriptions, but lacks explicit exclusions or context for choosing between siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_textC
Проверить, что в тексте не осталось персональных данных. safe_to_send=false означает, что отправлять нельзя.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| allowlist | No | строки, которые маскировать не нужно | |
| mask_urls | No | скрывать ссылки | |
| tag_style | No | формат тега: #PERSON_1# | [[PERSON_1]] | <PERSON_1> | |
| extra_terms | No | дополнительные строки для маскирования | |
| mask_all_dates | No | скрывать все даты, не только даты рождения | |
| aggressive_names | No | скрывать одиночные слова, похожие на фамилии |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It reveals that the tool returns a result where 'safe_to_send=false' means the text cannot be sent, but it omits many critical details: whether the tool has side effects, what the exact output structure is, authentication requirements, or rate limits. The description is too minimal for a tool with 7 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, concise and front-loaded: first sentence states purpose, second explains a key output indicator. No redundant information. For a tool with a single core action, this is appropriately sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters and no output schema, the description is notably incomplete. It does not explain the return value format (e.g., boolean, object with 'safe_to_send'), how parameters like 'mask_urls' or 'tag_style' influence verification, or how this tool relates to the sibling 'scan_document' (both seem to check PII). An agent would lack essential context to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 86% (6 of 7 parameters have descriptions), so baseline is 3. The tool description does not add any commentary on parameters beyond what the schema already provides. For example, it doesn't explain how 'allowlist' or 'aggressive_names' affect the verification logic. The description thus provides no additional value for parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the verb 'Проверить' (check) and resource 'текст' (text), clearly indicating it verifies absence of personal data. It also hints at the output semantics with 'safe_to_send=false'. This differentiates it from siblings like mask_text (which modifies) and scan_document (which likely processes documents). However, it does not explicitly specify the return type (e.g., boolean or object), slightly reducing clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like mask_text or scan_document. There is no mention of prerequisites, typical workflows (e.g., 'call after masking'), or exclusions. The sibling tools suggest different operations, but the description does not help an agent decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.0- First observed
mask_document - First observed
mask_text - First observed
scan_document - First observed
unmask_document - First observed
unmask_text - First observed
verify_text
TDQS
Scored across 6 tools
Each tool targets a distinct operation (mask vs unmask, text vs file) and the descriptions clearly differentiate text vs document variants. No two tools could be confused for the same purpose.
All tool names follow a consistent verb_noun pattern using snake_case: mask_text, unmask_text, verify_text, scan_document, mask_document, unmask_document. The verbs are predictable and the nouns clearly indicate the resource type.
With exactly 6 tools, the server is well-scoped for the domain of personal data masking/unmasking. Each tool serves a necessary role without redundancy, covering both text and document workflows in a focused manner.
The tool surface covers the full lifecycle: mask (text+document), unmask (text+document), verification, and preview. There are no obvious gaps—the server provides everything needed to protect and restore personal data in both free text and structured documents.
Maintenance
Related MCP Connectors
MCP server for detecting and redacting PII (Personally Identifiable Information) in PDF documents.
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
MCP-Native LLM Orchestration Agent
Authenticated LLM MCP Agent
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceMCP server for automatic detection and redaction of PII in text, with anonymization and deanonymization capabilities, all local processing.1-
- AlicenseNot gradedqualityDmaintenanceA local, containerized MCP server that uses a local LLM to sanitize documents by removing or transforming PII before content is sent to public LLM services.MIT
- AlicenseAqualityBmaintenanceAn MCP server that redacts PII/PHI from text before it ever reaches an LLM — self-hosted, fail-closed, and HIPAA-aware.324 PyPIMIT
- AlicenseAqualityDmaintenanceMCP server providing on-prem PII detection and anonymization tools (scan and is_sensitive) for AI agents, ensuring data stays local.4MIT