--- title: "Philter MCP" description: "Philter MCP is an open source Model Context Protocol server exposing PII and PHI redaction to Claude Desktop, Claude Code, Cursor, and other MCP clients." url: "https://philterd.ai/philter-mcp/" --- Open source MCP server # Philter MCP Philter MCP exposes Philter's PII and PHI redaction as Model Context Protocol tools that Claude Desktop, Claude Code, Cursor, and other MCP-aware clients can call from inside an agent's tool loop. [View on GitHub](https://github.com/philterd/philter-mcp) [Star: 2](https://github.com/philterd/philter-mcp) One block of config. Redaction tools in your agent's loop. ``` // claude_desktop_config.json { "mcpServers": { "philter": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "PHILTER_BASE_URL", "-e", "PHILTER_API_KEY", "-e", "PHILTER_VERIFY_SSL", "-v", "/path/to/files:/data:ro", "philterd/philter-mcp" ], "env": { "PHILTER_BASE_URL": "https://localhost:8080", "PHILTER_API_KEY": "", "PHILTER_VERIFY_SSL": "false" } } } } # Then, in chat: # "Use redact_file on /data/ticket-1042.txt, then summarize it" ``` Experimental Philter MCP is an early-stage project in [Philterd Labs](https://philterd.ai/labs/). It is open source and working, but the tool definitions and configuration can still change, and it is not covered by the support terms that apply to the established toolkit. [Talk to us](https://philterd.ai/philter-mcp/#) before building on it in production. [Release Notes →](https://github.com/philterd/philter-mcp/releases) [GitHub →](https://github.com/philterd/philter-mcp) ## How Philter MCP works with your agent and Philter Philter MCP sits between an MCP client and your self-hosted Philter instance. The agent calls a redaction tool, Philter MCP forwards it to Philter, and only redacted text and a report come back. Agent MCP client Claude Desktop, Claude Code, Cursor, and other MCP-aware clients call a redaction tool from inside the tool loop. Philter MCP MCP tool server Exposes Philter's redaction as tools your MCP client can call, and forwards each call to your Philter instance. Philter Self-hosted redaction API Detects and redacts PII and PHI inside your own environment, then returns the result. Redacted text and a report (filter types, character positions, confidence, and replacement tokens) flow back to the agent. The redaction tools' report never repeats the original matched values, and `redact_file` reads a file the agent has not seen, so its contents reach the model only in redacted form. ## Redaction inside the agent loop ### Six redaction tools over MCP `redact_text` and `redact_file` redact PII and PHI and return a report. `explain_redactions` is a dry run for policy debugging. `list_policies`, `get_policy`, and `status` let an agent inspect the connected Philter instance. ### Privacy by design The redaction tools never return the original matched values. The report contains filter types, character positions, confidence, and the replacement token, but not the matched text. Only `explain_redactions`, for policy debugging, returns matched values, and only when called with `include_text`. Text passed to `redact_text` has already been seen by the model, so use `redact_file` to keep a file's raw contents out of the model's context. ### Works with the clients you already use Any MCP-aware client can call it: Claude Desktop, Claude Code, Cursor, Continue, Goose, and others. Configuration is a short JSON block, or a single `claude mcp add` command for Claude Code. ### Self-hosted, like the rest of Philter Philter MCP is a thin client in front of your own [Philter](https://philterd.ai/philter/) instance (written against Philter 3.4.2; Philter 4.0 support is in progress). Philter runs within your environment, so detection and redaction happen there. ### Policy-driven and consistent Uses the same [Phileas](https://philterd.ai/phileas/) policies as the rest of the toolkit. Tool calls accept optional `policy` and `context` arguments so consistent pseudonymization and format-preserving behavior hold across requests. ### One command to run Run the published `philterd/philter-mcp` Docker image, or install from source with `pip install git+https://github.com/philterd/philter-mcp`. Point `PHILTER_BASE_URL` at your Philter instance and the tools appear in your client. ## The tools it exposes Philter MCP registers six tools. The redaction tools return a report of filter types, character positions, confidence, and replacement tokens, never the original matched values. | Tool | What it does | | --- | --- | | `redact_text` | Redact PII and PHI in a string and return the redacted text plus a report, without the original values. | | `redact_file` | Redact a UTF-8 text file (logs, CSV exports, tickets, transcripts) and return the redacted content and a report. The file on disk is not modified. | | `explain_redactions` | Dry run for debugging a policy: show what Philter would redact and why, without changing the text. | | `list_policies` | List the redaction policies available on the connected Philter instance. | | `get_policy` | Return the JSON definition of a single policy. | | `status` | Return the status and health of the connected Philter instance. | ## Frequently asked questions If something here isn’t covered, [get in touch](https://philterd.ai/philter-mcp/#) and we’ll answer. What is Philter MCP? An open source MCP (Model Context Protocol) server that exposes Philter's PII and PHI redaction as tools any MCP-aware client can call, including Claude Desktop, Claude Code, Cursor, Continue, and Goose. It wraps a running Philter instance (written against Philter 3.4.2; Philter 4.0 support is in progress), so detection and redaction run inside your own environment. How does Philter MCP work with Philter? Philter MCP is a thin client over your own Philter instance. Each tool call forwards the text to Philter's redaction API and returns the result, so Philter does the detection and redaction while the MCP server just exposes it as tools your client can call. Point `PHILTER_BASE_URL` at your instance and redaction runs inside your environment, before the redacted result returns to your agent. How is this different from the Philter AI Proxy? The [Philter AI Proxy](https://philterd.ai/philter-ai-proxy/) sits in front of production LLM traffic and redacts prompts at the network layer. Philter MCP is the client-side counterpart for development and agent workflows: it gives a developer or an agent redaction tools to call directly inside the tool loop. Many teams run both. What do I need to run it? A running Philter instance reachable from where the server runs, and an MCP-aware client. Philter MCP is written against Philter 3.4.2; Philter 4.0 support is in progress. Run the published `philterd/philter-mcp` Docker image, or install from source with `pip install git+https://github.com/philterd/philter-mcp`, then point `PHILTER_BASE_URL` at your Philter instance. Which clients are supported? Any MCP-aware client. That includes Claude Desktop, Claude Code, Cursor, Continue, and Goose. Configuration is a short JSON block, or a single `claude mcp add` command for Claude Code. Is Philter MCP open source? Yes. Philter MCP is open source under the Apache License, Version 2.0. Check out the code, file issues, and contribute on [GitHub](https://github.com/philterd/philter-mcp). ## Related products - [Philter: Each MCP tool call forwards text to your self-hosted Philter, which does the redaction.](https://philterd.ai/philter/) - [Philter AI Proxy: Guard production LLM traffic at the network layer while MCP covers agent and dev workflows.](https://philterd.ai/philter-ai-proxy/) - [Phileas: Embed the same redaction engine directly when you want in-process control instead of tool calls.](https://philterd.ai/phileas/) ## Ready to use Philter MCP? Three ways to get going: deploy the open source yourself, spin it up from a cloud marketplace, or work with our team directly. Pick the path that fits. [See your options](https://philterd.ai/pricing/)