Open source MCP server
Philter MCP exposes Philter's PII and PHI redaction as Model Context Protocol tools that Claude Desktop, Claude Code, Cursor, and other MCP-aware clients can call from inside an agent's tool loop.
Philter MCP sits between an MCP client and your self-hosted Philter instance. The agent calls a redaction tool, Philter MCP forwards it to Philter, and only redacted text and a report come back.
Claude Desktop, Claude Code, Cursor, and other MCP-aware clients call a redaction tool from inside the tool loop.
Exposes Philter's redaction as tools your MCP client can call, and forwards each call to your Philter instance.
Detects and redacts PII and PHI inside your own environment, then returns the result.
Redacted text and a report (filter types, character positions, confidence, and replacement tokens) flow back to the agent. The redaction tools' report never repeats the original matched values, and redact_file reads a file the agent has not seen, so its contents reach the model only in redacted form.
redact_text and redact_file redact PII and PHI and return a report. explain_redactions is a dry run for policy debugging. list_policies, get_policy, and status let an agent inspect the connected Philter instance.
The redaction tools never return the original matched values. The report contains filter types, character positions, confidence, and the replacement token, but not the matched text. Only explain_redactions, for policy debugging, returns matched values, and only when called with include_text. Text passed to redact_text has already been seen by the model, so use redact_file to keep a file's raw contents out of the model's context.
Any MCP-aware client can call it: Claude Desktop, Claude Code, Cursor, Continue, Goose, and others. Configuration is a short JSON block, or a single claude mcp add command for Claude Code.
Philter MCP is a thin client in front of your own Philter instance (written against Philter 3.4.2; Philter 4.0 support is in progress). Philter runs within your environment, so detection and redaction happen there.
Uses the same Phileas policies as the rest of the toolkit. Tool calls accept optional policy and context arguments so consistent pseudonymization and format-preserving behavior hold across requests.
Run the published philterd/philter-mcp Docker image, or install from source with pip install git+https://github.com/philterd/philter-mcp. Point PHILTER_BASE_URL at your Philter instance and the tools appear in your client.
Philter MCP registers six tools. The redaction tools return a report of filter types, character positions, confidence, and replacement tokens, never the original matched values.
| Tool | What it does |
|---|---|
redact_text | Redact PII and PHI in a string and return the redacted text plus a report, without the original values. |
redact_file | Redact a UTF-8 text file (logs, CSV exports, tickets, transcripts) and return the redacted content and a report. The file on disk is not modified. |
explain_redactions | Dry run for debugging a policy: show what Philter would redact and why, without changing the text. |
list_policies | List the redaction policies available on the connected Philter instance. |
get_policy | Return the JSON definition of a single policy. |
status | Return the status and health of the connected Philter instance. |
If something here isn’t covered, get in touch and we’ll answer.
PHILTER_BASE_URL at your instance and redaction runs inside your environment, before the redacted result returns to your agent.philterd/philter-mcp Docker image, or install from source with pip install git+https://github.com/philterd/philter-mcp, then point PHILTER_BASE_URL at your Philter instance.claude mcp add command for Claude Code.Three ways to get going: deploy the open source yourself, spin it up from a cloud marketplace, or work with our team directly. Pick the path that fits.