Loading ToolBench
MCP server that auto-obfuscates sensitive data (IPs, hostnames, emails, API keys, PII) so Claude never sees real client data during pentesting
8 tools with complete input schemas and descriptions. Naming is clear and verb-prefixed (redact_*). Descriptions are detailed (100-200 chars) and explain WHEN to use each tool. However, output schemas are not documented, LLMs cannot predict return structure. Error handling is minimal; no recovery guidance. Parameters lack validation constraints (e.g., no enum for HTTP methods, no min/max for audit log count). Security-focused design is strong (PII obfuscation, proxy pattern), but composition could be tighter, redact_add_mapping and redact_remove_mapping are low-level state mutations that could be combined.
Manually add a specific real→fake mapping. Use this when you know a specific value should be redacted (e.g., a client company name, internal hostname).
View recent audit log entries showing what was redacted and when. Requires REDACT_AUDIT_LOG=true environment variable to be set.
Reverses obfuscation — replaces all fake values back with the original real values. Use this when generating final reports or deliverables for the client.
Takes raw text and returns an obfuscated version with all detected PII replaced by consistent fake values. Uses regex + AI-based NER detection. Use this to sanitize any pasted text, command output, or data before analysis.
Makes a real HTTP request to the target, then obfuscates the entire response before returning it. Use this INSTEAD of curl/fetch for all pentest HTTP requests. The URL, headers, and body are deobfuscated first (in case you're using already-obfuscated values), then the real request is made, and the response is fully sanitized.
Output schemas not documented. LLMs cannot predict return structure (e.g., what fields does redact_obfuscate return? Is it {obfuscated_text, mappings_applied}?). This forces agents to guess and wastes tokens on trial-and-error.
HTTP method parameter in redact_proxy_request lacks enum constraint. Description says 'GET, POST, PUT, DELETE, etc.' but LLMs may hallucinate invalid methods (FETCH, RETRIEVE). Should be enum: [GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS].
redact_audit_log 'count' parameter lacks min/max bounds. Unbounded numeric parameters let LLMs pass absurd values (count=999999) that could timeout or exhaust memory. Should specify min=1, max=1000.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 70 | 2026-07-28+ | v2 |
Reads a file from disk and returns its content with all detected PII obfuscated. Use this INSTEAD of the Read tool for any client data files, config files, or logs that may contain sensitive information.
Remove a mapping by its real value. Use this to undo a false positive detection.
Display all current real→fake mappings, grouped by type. Shows what is currently being redacted.
No error handling guidance. Tools do not document what happens on failure (e.g., file not found, invalid URL, mapping collision). Errors should be categorized as retryable/user-fixable/fatal with recovery hints.
redact_add_mapping and redact_remove_mapping are low-level state mutations. Consider combining into a single 'redact_update_mapping' tool with an 'action' enum (add|remove|replace) to reduce cognitive load and improve composability.