Loading ToolBench
MCP server that acts as a stateful privacy boundary: pseudonymises patient identifiers and PII before they reach an AI agent, keeps the reversal mapping outside the model context, and restores identifiers only at the trusted boundary. Runs locally, nothing leaves your machine.
Redacta MCP demonstrates strong domain-specific design with clear, security-conscious descriptions and well-structured schemas. Tool names are action-oriented (protect, release_to_file, check_output, discard_session). All 8 tools have descriptions exceeding 100 characters with explicit security warnings. Input schemas are present and typed for all tools. However, output schemas are not documented in the visible code, and error handling lacks recovery guidance. The server correctly prioritizes privacy by keeping reversal mappings server-side and warning users about data exposure risks. Legacy tools (redact, reinstate, self_check) are marked as deprecated but still present, adding complexity.
Scan generated text for verbatim reappearance of the original values held in a protected session (tolerant of spacing, dashes and case for identifier-like values) and re-tokenise anything found. Returns which token categories leaked — never the raw values — plus the sanitised text and a general self-check. Scope is verbatim reappearance only: paraphrases and inferred identities are not detected.
Delete a session's private mapping immediately instead of waiting for expiry. Idempotent. After this, no restoration is possible for that session.
Redact patient identifiers and PII, replacing each distinct value with a labelled token ([NHS_NUMBER_1], [PATIENT_NAME_1], ...). The reversal mapping is kept privately inside the Redacta server and is NEVER included in this response — you receive only the protected text, an opaque session_id for later controlled restoration, a count of what was replaced, and a self-check of possible leftovers. Sessions expire automatically.
LEGACY: like protect, but returns the token_map (token -> original value) in the response, which places the reversal key in the client and potentially the model context. Kept for backward compatibility and client-managed workflows. Prefer protect, which keeps the mapping server-side.
LEGACY: reverse a redaction using a token map held by the client (from the legacy redact tool). Restored personal data will appear in this tool result. For session-based restoration that keeps mappings server-side, use release_to_file or release_to_client.
Output schemas not documented in visible code. LLMs cannot plan downstream operations without knowing what fields protect(), release_to_file(), and check_output() return.
Error handling lacks recovery guidance. No indication of what LLM should do if session_id is invalid, text is too large, or categories are malformed.
Legacy tools (redact, reinstate, self_check) marked deprecated but still exposed. Increases cognitive load for LLM tool selection and violates single-responsibility principle.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
WARNING: returns re-identified text directly in the tool result, so restored personal data WILL enter the MCP client and potentially the model context. Only use in trusted environments. This tool is only available because the server operator enabled it (REDACTA_RELEASE=client or both). Prefer release_to_file.
Restore original identifiers into text produced from a protected session, writing the result to a file inside the server's configured release directory (REDACTA_RELEASE_DIR). Returns only a receipt — file path, size, and counts — so restored data never enters the model context. This is the privacy-preserving way to complete the round trip.
LEGACY: scan text for possible PII leftovers — patterns that look like identifiers but were not redacted. Returns a list of findings (value, category, confidence). This is a best-effort heuristic; false positives are expected. Use check_output (with a session) for higher-confidence leak detection.
Parameter 'categories' in protect and redact uses enum but lacks description of what each category includes (e.g., 'clinical' = NHS/NI/DOB/MRN/postcode/SSN/ZIP/email/phone/names). LLM must infer from tool description.
release_to_file and release_to_client lack documentation of what constitutes a valid session_id format or TTL behavior, forcing LLM to infer from protect() description.