本地优先的 CLI 和 MCP 服务器，用于在与 AI 工具共享日志、配置和错误之前对敏感文本进行脱敏处理。
mcp-redact 可以帮助你在将文本粘贴到 Claude Code、Cursor 或其他 AI 工具之前完成一件事：先对密钥和敏感数据进行脱敏。
开发者经常将日志、.env 文件、请求头、堆栈跟踪和配置片段粘贴到 AI 工具中。这些片段可能包含 API 密钥、Bearer 令牌、Cookie、电子邮件和其他敏感值。
mcp-redact 旨在让这一流程更安全：
本地优先
基于确定性正则表达式的脱敏
CLI 和 MCP 共享引擎
可读的占位符，如 [REDACTED_EMAIL]
Related MCP server: phi-redact-mcp
Authorization: Bearer abcdefghijklmnop123456
user_email=user@example.com
callback=https://example.com/callback?token=secret123&lang=en
Cookie: session=abcdef123456; theme=darkAuthorization: Bearer [REDACTED_AUTHORIZATION_HEADER]
user_email=[REDACTED_EMAIL]
callback=https://example.com/callback?token=[REDACTED_SENSITIVE_URL]&lang=en
Cookie: session=[REDACTED_COOKIE_HEADER]; theme=dark要求：
Node.js 20+
pnpm
安装依赖：
pnpm install在示例文件上运行：
pnpm dev -- --file ./examples/sample.log通过标准输入 (stdin) 管道传输文本：
pnpm dev -- < ./examples/sample.log本仓库包含可用于本地测试和演示的示例输入：
examples/sample.log
examples/sample.env
examples/sample.json
examples/sample.yaml
examples/mcp-redact.config.json
所有示例值均为虚构。
pnpm dev -- < ./examples/sample.logpnpm dev -- --file ./examples/sample.logpnpm dev -- --file ./examples/sample.envpnpm dev -- --file ./examples/sample.env --output ./sanitized.envpnpm dev -- --file ./examples/sample.log --format json输出示例：
{
"redactedText": "Authorization: Bearer [REDACTED_AUTHORIZATION_HEADER]\nuser_email=[REDACTED_EMAIL]\ncallback=https://example.com/callback?token=[REDACTED_SENSITIVE_URL]&lang=en\nCookie: session=[REDACTED_COOKIE_HEADER]; theme=dark\n",
"summary": {
"totalMatches": 4,
"byType": {
"authorization_header": 1,
"email": 1,
"sensitive_url": 1,
"cookie_header": 1
}
}
}pnpm dev -- --file ./examples/sample.log --summary-only输出示例：
Total matches: 4
By type:
- authorization_header: 1
- cookie_header: 1
- email: 1
- sensitive_url: 1仅运行个人信息检测器：
pnpm dev -- --file ./examples/sample.log --only personal在运行时禁用某个组：
pnpm dev -- --file ./examples/sample.log --disable httppnpm dev -- --file ./examples/sample.log --config ./examples/mcp-redact.config.json示例配置仅启用了 personal 和 custom 组，禁用了内置的 email 检测器，并添加了一个自定义的 internal-ticket 规则。使用该配置时，sample.log 将保持不变，因为它不包含任何自定义工单值，且电子邮件脱敏已被禁用。
开发模式：
pnpm mcp:dev构建并运行：
pnpm build
pnpm mcp:startredact_text输入：
{
"text": "Authorization: Bearer abcdefghijklmnop123456",
"groups": ["http"],
"configPath": "./examples/mcp-redact.config.json"
}redact_file输入：
{
"filePath": "./examples/sample.log",
"groups": ["http"],
"configPath": "./examples/mcp-redact.config.json"
}两个工具返回相同的结构化格式：
{
"redactedText": "...",
"summary": {
"totalMatches": 4,
"byType": {
"authorization_header": 1,
"email": 1
}
}
}使用适合你环境的服务器命令：
开发环境：pnpm mcp:dev
构建输出：pnpm mcp:start
如果你的 MCP 客户端需要命令加参数，请将其指向本地项目并通过 stdio 运行服务器。该服务器公开了两个工具：redact_text 和 redact_file。
默认配置文件名：
mcp-redact.config.json如果没有提供明确的配置路径，mcp-redact 将尝试从当前工作目录读取该文件。如果默认文件不存在，执行将正常继续。如果你明确传递了一个不存在的配置路径，命令将会失败。
配置示例：
{
"enabledGroups": ["personal", "custom"],
"disabledDetectors": ["email"],
"customRules": [
{
"name": "internal-ticket",
"pattern": "TICKET-[0-9]{6}",
"placeholder": "[REDACTED_TICKET]"
}
]
}enabledGroups：将内置和自定义检测器限制为列出的组
disabledDetectors：按名称禁用检测器，例如 email 或 github-token
customRules：添加基于正则表达式的本地检测器，使用与内置规则相同的管道
secretsBearer 令牌
JWT
GitHub 令牌
OpenAI 风格的 API 密钥
Anthropic 风格的 API 密钥
AWS 访问密钥 ID
键值对密钥，如 password=、token=、secret=、api_key=
私钥块
personal电子邮件
电话号码
IPv4 地址
httpAuthorization 请求头 Bearer 值
Cookie 请求头敏感值
敏感 URL 查询参数值，如 token=
常用命令：
pnpm install
pnpm test
pnpm lint
pnpm typecheck
pnpm build
pnpm mcp:dev更多的令牌和 API 密钥模式
更好的误报抑制
更多真实的日志和配置示例
更多端到端的 MCP 客户端示例
This server cannot be deployed
Detect and redact PII and secrets before text reaches an LLM, with reversible placeholders.
Redact personal data from text before your agent sends it to a model or stores it: names, contact details, ID numbers, financial and health identifiers, card numbers, plus any exact terms you add. Nothing stored, no third-party AI. Tools - redact_text: returns the redacted text and a count of what was removed, by type. Never the removed values. Options: restrict to particular data types, add exact terms to remove, choose the replacement style (a type label such as <PERSON> by default) and set a confidence threshold. - list_entity_types: lists the detectable data types. Free. Data handling - Nothing you send is stored. Text is processed in memory and discarded when the call returns. - No third-party AI. Text is never sent to OpenAI, Anthropic, Google or any other outside model. - Tool arguments are never logged. Only counts are kept: credits used, a timestamp and how many of each type were found. PDFs, including scanned pages, are handled by the REST API with the same key and credits. They aren't offered as an MCP tool because a file doesn't fit in a tool call. Pricing: 1 credit per call plus 1 per 1,000 characters. 10 free credits on sign-up, no card. Credit packs from $5; purchased credits never expire. Failed calls and repeated identical calls are free. Setup and API key: https://eleyed.com/mcp?utm_source=glama&utm_medium=directory&utm_campaign=listing
Stateless PII redaction over MCP/REST. Free ≤1000 words or $0.01/call; file upload supported.
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
