@veladon/mcp-pii-redactor

Model Context Protocol server that redacts PII, PHI, credentials, and financial data from outbound prompts before they leave your agent. Deterministic, local, auditable — built for CISOs preparing for EU AI Act Article 26 (August 2, 2026) and ISO 42001.

Why this exists

EU AI Act Article 26 kicks in August 2, 2026. It requires maintained records of AI system use — meaning if an employee pastes customer PII into ChatGPT and there's no record, you fail the audit. ISO 42001 (A.6.2.3), NIST AI RMF (MAP-4.1), SOC 2 (CC6.2 + AI addenda), HIPAA, and PCI-DSS all ask versions of the same question: what did you send to a public LLM, and how did you control it?

At the mid-market tier (500–2,500 employees), existing enterprise DLP tools like Harmonic Security, Prompt Security, Lakera Guard, Netskope GenAI, and Microsoft Purview AI Hub are either priced for 10,000+ employee orgs or require dedicated security engineers to deploy. Most mid-market companies ship an acceptable-use policy and hope. That will not survive the first EU AI Act audit.

@veladon/mcp-pii-redactor is the free, open-source starting point: a drop-in MCP server that your Claude Code / Cursor / Continue / any MCP-compatible agent calls before sending prompts to a public LLM. It redacts PII / PHI / credentials inline, writes a hash-only audit log to ~/.veladon/audit.jsonl, and never phones home.

The upstream paid product (veladon.grindworks.ai) adds browser-side enforcement across ChatGPT / Claude / Gemini web UIs, 500+ rules, SOC 2 / EU AI Act / ISO 42001 evidence export, and an admin console. This MCP server is how you start today.

Install

npm install -g @veladon/mcp-pii-redactor
# or run ephemerally:
npx @veladon/mcp-pii-redactor

Wire it into Claude Code

Add to your ~/.claude/config.json (or project .claude/mcp.json):

{
  "mcpServers": {
    "veladon-redactor": {
      "command": "npx",
      "args": ["-y", "@veladon/mcp-pii-redactor"]
    }
  }
}

Then in your agent, call the redact_prompt tool before sending any user content to an LLM.

Wire it into Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "veladon-redactor": {
      "command": "npx",
      "args": ["-y", "@veladon/mcp-pii-redactor"]
    }
  }
}

Tools exposed

| Tool | What it does | |---|---| | redact_prompt(text, rule_ids?) | Redact + write audit log. Returns redacted text, spans with SHA-256 digests (never plaintext), and a category summary. | | preview_redaction(text, rule_ids?) | Dry-run without writing audit log. For UI preview. | | list_rules() | List all 16 built-in rules with IDs, regex, category, confidence. | | get_audit_log_path() | Where is the audit log on disk? | | get_session_info() | Server version, session ID, enabled rule count. |

What it catches (built-in rules)

Credentials (high confidence):

• AWS access keys + secrets
• OpenAI sk-… keys
• Anthropic sk-ant-… keys
• GitHub PATs (ghp_, gho_, etc.)
• Slack tokens (xoxb-…)
• JWT tokens
• PEM private key blocks

Identity:

• Email addresses
• US Social Security Numbers (with invalid-range exclusion)
• US phone numbers (NANP)
• IPv4 addresses

Financial:

• Credit card numbers (Visa / MC / Amex / Discover / JCB BIN prefixes)
• IBAN numbers

Health (opt-in):

• US Medical Record Number patterns
• ICD-10 codes (off by default; false-positive rate high)

Location:

• US ZIP+4

See src/rules.ts for exact regex + replacement tokens. Read them. Modify them. We optimize for "you can audit it" over "we know best."

Audit log format

Every redact_prompt call appends one JSONL line to ~/.veladon/audit.jsonl:

{"ts":"2026-04-17T09:45:12.345Z","session_id":"a1b2c3d4e5f60708","event":"redact_prompt","input_len":412,"output_len":388,"input_digest":"8f2a7c1e9b4d5a62","spans":[{"ruleId":"pii.email","category":"identity","matchDigest":"d7a4f1e09c6b3520"}]}

No plaintext is ever logged. Only lengths and SHA-256 digests (truncated to 16 hex chars). This is intentional: the audit log must not become a new liability for the CISO.

EU AI Act Article 26 evidence

The log satisfies Article 26(1)'s "maintain records of AI system use" requirement by proving (a) that redaction ran on every prompt, (b) which rule fired, and (c) a tamper-evident digest of the original input. It does not retain the original input.

Rotate it on your own schedule: mv ~/.veladon/audit.jsonl ~/.veladon/audit-$(date +%F).jsonl.

ISO 42001 A.6.2.3 mapping

The "AI Data Handling" control maps directly: redaction is the handling, the log is the evidence of the handling. Point your ISO 42001 auditor at this log.

Configure custom rules

Point VELADON_RULES at a JSON file with your org-specific patterns:

[
  {
    "id": "custom.internal_project_codename",
    "name": "Internal project codenames",
    "pattern": "Project (Aurora|Magellan|Starlight)",
    "flags": "gi",
    "replacement": "Project [REDACTED:CODENAME]",
    "category": "custom",
    "confidence": "high"
  }
]

(Custom rule loading is on the v0.2 roadmap; v0.1 ships with built-ins only.)

Environment variables

| Var | Default | Purpose | |---|---|---| | VELADON_LOG_DIR | ~/.veladon/ | Directory for audit log | | VELADON_LOG_PATH | {LOG_DIR}/audit.jsonl | Full audit log path override | | VELADON_RULES | unset | Path to custom rules JSON (roadmap) |

What it does NOT do (v0.1 scope)

• No browser-side enforcement. If a user pastes PII into chat.openai.com directly, this MCP server doesn't see it. For browser coverage, see the full product at veladon.grindworks.ai.
• No ML classifier. Built-in rules are regex only. Custom ML classifiers are in the paid product roadmap.
• No centralized admin console. The audit log lives on each user's machine. For fleet-wide rollout, see the paid product.
• No guaranteed zero false positives. Regex is best-effort. Test before trusting. Contribute rule improvements via PR.

Design principles

1. Local only. Zero network calls in v0.1. Read the source — you'll find no fetch, http, or axios.
2. Deterministic. Same input + same rules → same output. A CISO can reproduce your substitutions.
3. Audit-first. Every redaction emits a log line. No plaintext. Ever.
4. Trust by construction. Apache-2.0 source. Published tarball matches commit. No obfuscation.

Contributing

Issues and PRs welcome. The target audience is CISOs + Compliance Officers at 500–2,500 employee regulated mid-market companies. If you're one of them, we want to hear what rules are missing for your regulatory context.

License

Apache-2.0. Use commercially, modify freely, but attribution is appreciated in ISO 42001 evidence packs.

Upgrade path

When you're ready for browser-side enforcement + fleet rollout + admin console + audit export wizards:

→ veladon.grindworks.ai

We're running a design-partner program for the paid tier. Early access if you email [email protected] and say "veladon-mcp user" in the subject — we'll get back within 48 hours.

Built by Grindworks Studio — a venture studio shipping NA B2B infrastructure products in the AI Agent era.