@sladd-no/mcp

MCP server for Sladd — detect and redact Norwegian PII before documents leave your agent pipeline.

Sladd finds and removes Norwegian personally identifiable information — fodselsnummer (national IDs, checksum-validated), names, addresses, phone numbers, bank accounts, health information (GDPR Article 9), DUF numbers and more — in plain text and PDFs. This package exposes that capability to any MCP-compatible agent (Claude Desktop, Claude Code, Cursor, VS Code, custom agents) as two tools:

| Tool | What it does | |---|---| | detect_pii | Scan text or a PDF → structured list of findings (type, offsets, confidence, recommended action) | | redact_document | Text → redacted_text with labels/pseudonyms. PDF → new PDF with findings irreversibly removed under black boxes, plus a verification block proving everything detected is gone |

Use it as a guard: redact first, then let the content continue through the agent flow.

Setup in 30 seconds (Claude Desktop)

Add this to claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "sladd": {
      "command": "npx",
      "args": ["-y", "@sladd-no/mcp"],
      "env": { "SLADD_API_KEY": "sk_sladd_..." }
    }
  }
}

On Windows, if npx is not found, use "command": "cmd", "args": ["/c", "npx", "-y", "@sladd-no/mcp"].

Restart Claude Desktop. Then try: "Check vedtak.pdf on my desktop for Norwegian PII, and give me a redacted copy."

Claude Code:

claude mcp add sladd --env SLADD_API_KEY=sk_sladd_... -- npx -y @sladd-no/mcp

Need a key? API keys (sk_sladd_...) are issued at sladd.no/api.

Remote endpoint (no install)

For clients that support Streamable HTTP with custom headers (Claude Code, Cursor, VS Code, programmatic agents):

URL:    https://sladd.no/mcp
Header: Authorization: Bearer sk_sladd_...

claude mcp add --transport http sladd https://sladd.no/mcp --header "Authorization: Bearer sk_sladd_..."

Note: claude.ai web connectors require OAuth and are not supported yet. The remote endpoint accepts base64 PDFs up to ~3 MB per request; for larger files use the local install (file_path input has a 20 MB limit).

How PDFs flow (local install)

The local server accepts a file_path — the agent never has to base64 a document through its context window:

1. The server reads the PDF from disk and sends it to the Sladd API over HTTPS.
2. The API detects, redacts (rasterized black boxes — underlying text deleted), re-scans its own output, and returns the verified PDF.
3. The server writes <name> [sladd].pdf next to the input (never overwriting anything) and returns the path + verification report.

The document content never enters the model's context — only the findings and the report do.

Privacy

The hosted API processes documents in memory only: never written to disk, never queued, never logged. Usage metering records metadata only (document/page counts, mode) — never content, findings text, or filenames. See sladd.no/personvern. For full data control, the same engine is available as a self-hosted Docker image and CLI.

Limits

• Max 20 MB and 100 pages per document (remote endpoint: ~3 MB effective for base64 PDFs)
• 60 requests per minute per key
• mode: "deep" (NER layer, higher recall) is rolling out — until active it returns mode_unavailable; use the default fast

License

Proprietary. © Sladd — sladd.no. Contact: sladd.no/om.