MA
AI & ML

Masquerade MCP Server: PDF Redaction Firewall for LLMs

Redact sensitive data from PDFs with the Masquerade MCP server, a privacy firewall that cleans documents before sending them to Claude.

View on GitHub

Overview

Masquerade is an MCP (Model Context Protocol) server that functions as a privacy firewall for PDF documents. It inspects, sanitizes, and redacts sensitive information from PDFs before those documents are exposed to a model such as Anthropic Claude. By running Masquerade in front of an LLM pipeline, teams can reduce accidental data leakage and enforce redaction policies consistently.

The server accepts PDF input, applies configurable redaction rules (pattern matching, named-entity detection, and optional OCR fallback for scanned pages), and returns a sanitized artifact or a redaction summary. Because it implements an MCP-compatible interface, Masquerade is designed to slot into systems that use external context providers or “tools” for LLM prompts, allowing models to request cleaned documents during prompt construction without direct exposure to raw files.

Features

  • Configurable redaction policies: regex-based, entity categories (PII/PHI), and allowlists
  • PDF parsing with text extraction and overlay redaction; optional OCR for scanned pages
  • MCP-compatible endpoint to integrate with LLM tool workflows (e.g., Claude)
  • Preview and audit outputs: redaction logs and summary metadata for each processed file
  • Multiple output modes: fully redacted PDF, redacted text extract, or a secure link to the artifact
  • Docker-ready deployment and simple local CLI for testing
  • Logging, metrics, and policy debugging endpoints

Installation / Configuration

Requirements: Docker (recommended) or Node.js 18+ (if running locally). Clone the repo and run with Docker Compose, or run using the provided Node server.

Clone repository:

git clone https://github.com/postralai/masquerade.git
cd masquerade

Run with Docker Compose:

# using Docker Compose; will build/run the MCP server
docker-compose up --build -d

Environment variables (example .env):

PORT=8080
CLAUDE_API_KEY=sk-xxxx
REDACTION_POLICY_FILE=./policies/default-policy.json
OCR_ENABLED=true
LOG_LEVEL=info

Run locally with npm:

# install deps and start
cd masquerade
npm install
npm run start

Configuration file (JSON/YAML) controls what to redact. Example policy snippet:

{
  "rules": [
    { "id": "email", "type": "regex", "pattern": "\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b", "action": "redact" },
    { "id": "ssn", "type": "regex", "pattern": "\\b\\d{3}-\\d{2}-\\d{4}\\b", "action": "redact" },
    { "id": "phone", "type": "entity", "entityType": "PHONE_NUMBER", "action": "redact" }
  ],
  "defaults": { "ocr": true, "output": "pdf" }
}

Available Resources

Endoints (typical):

  • POST /mcp/tool — MCP-compatible tool call to request redaction as part of a model workflow
  • POST /redact — simple multipart/form-data endpoint to submit a PDF and get back a redacted artifact
  • GET /status — health and readiness checks
  • GET /audit/{id} — redaction report and metadata for a processed file

Example: POST a PDF and receive a redacted PDF (multipart):

curl -X POST "http://localhost:8080/redact" \
  -F "file=@./customer-invoice.pdf" \
  -F "policy=@./policies/default-policy.json" \
  -o redacted.pdf

Example: MCP-style JSON request (tool invocation)

{
  "tool": "masquerade/redact",
  "input": {
    "blob": { "type": "pdf", "url": "https://example.com/file.pdf" },
    "policy": "default-policy"
  }
}

Responses include either the redacted PDF binary, a URL to a temporary secure artifact, and a JSON audit object describing what was removed or masked:

{
  "artifact_url": "https://local-storage/artefacts/abc123.pdf",
  "summary": { "redacted_patterns": ["email", "ssn"], "pages_processed": 4 },
  "audit_id": "abc123"
}

Use Cases

  • Customer support: Remove customer PII (emails, account numbers, SSNs) from user-submitted PDFs before sending them to Claude for summarization, troubleshooting, or response generation.
  • Legal and compliance: Automatically redact sensitive identifiers from contracts and discovery materials to maintain GDPR/HIPAA compliance while using LLMs to extract clauses or produce summaries.
  • Secure analytics: Sanitize financial or HR PDFs before running content extraction or entity extraction pipelines driven by an LLM, ensuring analytics operate over privacy-safe payloads.
  • Prompt tooling: Provide an MCP tool that an LLM can call during a chain-of-thought or function invocation to request a cleaned version of a document, avoiding direct exposure of raw content to the model.

Tips and Best Practices

  • Start with conservative policies in production (mask broadly) and allowlist specific terms where safe.
  • Enable OCR only for trusted environments: scanned documents require OCR but increase surface area for inadvertent extraction.
  • Keep audit logs separate and encrypted; use short-lived artifact URLs when returning redacted files.
  • Test policies locally against representative sample documents before enabling
Tags:ai-ml