io.github.dambuchs/redact-pdf-mcp
NPM · REDACT-PDF-MCP · SCANNED SEP 20
Permanently redact PII from PDFs and scans. EU/Swiss-hosted, never used to train AI models.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability61
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2463 tokens (~410/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management70
- Stability observed for 21 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.dambuchs/redact-pdf-mcp server?
io.github.dambuchs/redact-pdf-mcp runs locally as an npm package, launched with npx -y redact-pdf-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · redact-pdf-mcp
claude mcp add dambuchs-redact-pdf-mcp -- npx -y redact-pdf-mcp
{
"mcpServers": {
"dambuchs-redact-pdf-mcp": {
"command": "npx",
"args": [
"-y",
"redact-pdf-mcp"
]
}
}
} {
"servers": {
"dambuchs-redact-pdf-mcp": {
"command": "npx",
"args": [
"-y",
"redact-pdf-mcp"
]
}
}
} codex mcp add dambuchs-redact-pdf-mcp -- npx -y redact-pdf-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dambuchs-redact-pdf-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"redact-pdf-mcp"
],
"enabled": true
}
}
} openclaw mcp add dambuchs-redact-pdf-mcp --command npx --arg -y --arg redact-pdf-mcp
mcp_servers:
dambuchs-redact-pdf-mcp:
command: "npx"
args: ["-y", "redact-pdf-mcp"] {
"McpServers": {
"dambuchs-redact-pdf-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"redact-pdf-mcp"
]
}
}
} assistant mcp add dambuchs-redact-pdf-mcp -t stdio -c npx -a -y redact-pdf-mcp
{
"mcpServers": {
"dambuchs-redact-pdf-mcp": {
"command": "npx",
"args": [
"-y",
"redact-pdf-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.60 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.2.0 → 0.2.1 functional
- 17 Sept 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.57 → unverified ▼ security
- Schema quality: 311 → 397 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.1.1 → 0.2.0 functional
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/redact-pdf-mcp@0.2.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
download_redacted Download a redacted PDF ~160
Download the finished redacted PDF for one document, using the document id from redact_pdf or get_job_status. Only works once that document reports status "redacted". Under the default "ephemeral" retention the original is already gone; the redacted output is kept for the account's retention window (14 days by default) and then deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document id, from the documents list of redact_pdf or get_job_status. |
| output_path | string | – | Where to write the redacted PDF on this machine. Defaults to the input path with a "-redacted" suffix, next to the original. Output is always a PDF, so an image input produces a .pdf file. The origin… |
No output schema declared.
No examples provided.
get_account_status Check API key and account ~89
Check that the configured API key is valid and see which account it belongs to. Call this before a large batch to fail fast on a bad or missing key, rather than after uploading. Redaction is billed per page against the account's plan quota and credit packs. If a redaction call fails with "out of pages", that is a quota problem the user must resolve — do not retry it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_job_status Check redaction job status ~132
Check a redaction job's progress. Statuses: "uploaded" (queued) -> "analyzing" (detecting PII) -> "redacting" -> "redacted" (done, ready to download) or "error". Only "redacted" and "error" are final; anything else means the work is still in flight, so wait a few seconds before checking again rather than polling in a tight loop. Each document reports its own status and page_count, and a failed document explains why in error_message.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | The job_id returned by redact_pdf. |
No output schema declared.
No examples provided.
redact_pdf Start a redaction job (does not wait) ~563
Start a redaction job and return immediately without waiting. Permanent, irreversible redaction: the sensitive text is deleted from the file, not hidden behind a black rectangle, so it cannot be recovered by copy-paste, "remove object", or text extraction. Handles scanned documents via OCR and detects PII in 100+ languages. Documents are processed on Microsoft Azure in the EU and Switzerland, encrypted in transit and at rest, never used to train AI models, and the original is deleted after processing. Accepts PDF, JPEG and PNG. Pass a photo or screenshot directly; do NOT convert it to a PDF first, that is handled for you and the output comes back as a redacted PDF either way. Prefer redact_pdf_and_wait unless you specifically need to fire off several documents in parallel, or the document is large enough that you would rather poll on your own schedule. Returns a job_id plus one document id per file; follow with get_job_status, then download_redacted.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the file on this machine. PDF, JPEG and PNG are all accepted — pass an image directly rather than converting it first. This server runs locally, so it reads the file directly; never… |
| idempotency_key | string | – | Optional. By default a key is derived from the file bytes and settings, so repeating an identical call returns the SAME job instead of redacting (and billing) twice. Pass a distinct value here only w… |
| pii_categories | array | – | Which entity types to redact. OMIT this to use the account defaults, which is usually what the user wants — do not pass an empty list, which would mean "redact nothing" and return an unredacted file.… |
| pii_excluded_terms | array | – | Terms that must NEVER be redacted even if detected as PII — typically your own company name, a public contact address, or the recipient the document is addressed to. |
| pii_included_terms | array | – | Terms that must ALWAYS be redacted even when the model would not treat them as PII — project codenames, internal references, a specific case number. Matched whole-word and case-insensitive. Wins over… |
| retention | string | – | "ephemeral" (default) deletes the original after processing and keeps the output only briefly. "studio" keeps the original and the detected masks so a human can review and adjust them at redact-pdf.a… |
No output schema declared.
No examples provided.
redact_pdf_and_wait Redact a PDF (upload, wait, return the redacted file) ~824
Redact a PDF, photo or screenshot and wait for the finished file. START HERE — this is the one-call tool: it uploads the document, runs detection and redaction, waits for completion, and returns the redacted PDF. Permanent, irreversible redaction: the sensitive text is deleted from the file, not hidden behind a black rectangle, so it cannot be recovered by copy-paste, "remove object", or text extraction. Handles scanned documents via OCR and detects PII in 100+ languages. Documents are processed on Microsoft Azure in the EU and Switzerland, encrypted in transit and at rest, never used to train AI models, and the original is deleted after processing. Accepts PDF, JPEG and PNG. Pass a photo or screenshot directly; do NOT convert it to a PDF first, that is handled for you and the output comes back as a redacted PDF either way. Use it whenever someone wants PII, personal data, names, emails, phone numbers, addresses, bank details or card numbers removed from a document before sharing, filing, publishing or sending it to a third party — including GDPR/HIPAA/FOIA workflows. Scanned pages, phone photos of documents and screenshots all work. Typical redaction takes 10-60 seconds; this tool blocks until then. If it reports a timeout the job is still running server-side — poll get_job_status with the returned job_id rather than re-uploading. Requires an API key. If none is configured, call try_demo with the user's file first — it redacts the first page with no key — then ask the user for a key. A free account gets its first document (up to 5 pages) redacted in full with no card, so the key costs nothing to obtain.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the file on this machine. PDF, JPEG and PNG are all accepted — pass an image directly rather than converting it first. This server runs locally, so it reads the file directly; never… |
| idempotency_key | string | – | Optional. By default a key is derived from the file bytes and settings, so repeating an identical call returns the SAME job instead of redacting (and billing) twice. Pass a distinct value here only w… |
| output_path | string | – | Where to write the redacted PDF on this machine. Defaults to the input path with a "-redacted" suffix, next to the original. Output is always a PDF, so an image input produces a .pdf file. The origin… |
| pii_categories | array | – | Which entity types to redact. OMIT this to use the account defaults, which is usually what the user wants — do not pass an empty list, which would mean "redact nothing" and return an unredacted file.… |
| pii_excluded_terms | array | – | Terms that must NEVER be redacted even if detected as PII — typically your own company name, a public contact address, or the recipient the document is addressed to. |
| pii_included_terms | array | – | Terms that must ALWAYS be redacted even when the model would not treat them as PII — project codenames, internal references, a specific case number. Matched whole-word and case-insensitive. Wins over… |
| retention | string | – | "ephemeral" (default) deletes the original after processing and keeps the output only briefly. "studio" keeps the original and the detected masks so a human can review and adjust them at redact-pdf.a… |
| timeout_seconds | integer | – | How long to wait for completion, in seconds (default 300, max 900). On timeout the job keeps running server-side and can be resumed with get_job_status. |
No output schema declared.
No examples provided.
try_demo Try redaction with no API key (first page of a real file, or a sample) ~546
Try redaction with no API key. Two modes: 1. With a file: redacts the FIRST PAGE of the user's own PDF, photo or screenshot (5 MB max) and returns which categories of personal data were found on it, plus a link to the redacted page that stays valid for 14 days. Nothing is stored beyond that page and the original is deleted after processing. Use this to show a user real output on their own document before they sign up. Only the first page is redacted; for the whole document use redact_pdf_and_wait with a key. 2. Without a file: runs the built-in synthetic-PII sample to confirm connectivity. Never touches user data. Both cost nothing. When the user wants the rest of the document, tell them a free account gets its first document (up to 5 pages) redacted in full with no card, then ask for the key.
| Name | Type | Req | Description |
|---|---|---|---|
| file_base64 | string | – | The document encoded as base64. PDF, JPEG and PNG are all accepted. Use file_url instead when you have one — base64 is much larger to pass around. |
| file_path | string | – | Absolute path to the file on this machine. PDF, JPEG and PNG are all accepted — pass an image directly rather than converting it first. This server runs locally, so it reads the file directly; never… |
| file_url | string | – | Public http(s) URL of the file to redact. PDF, JPEG and PNG are all accepted — no need to convert an image first. The server downloads it, redacts it, and does not keep it. |
| filename | string | – | Filename for the document, including its extension (e.g. "contract.pdf", "receipt.png"). Determines how the file is interpreted. |
| pii_categories | array | – | Which entity types to redact. OMIT this to use the account defaults, which is usually what the user wants — do not pass an empty list, which would mean "redact nothing" and return an unredacted file.… |
| pii_excluded_terms | array | – | Terms that must NEVER be redacted even if detected as PII — typically your own company name, a public contact address, or the recipient the document is addressed to. |
| pii_included_terms | array | – | Terms that must ALWAYS be redacted even when the model would not treat them as PII — project codenames, internal references, a specific case number. Matched whole-word and case-insensitive. Wins over… |
No output schema declared.
No examples provided.
What is the io.github.dambuchs/redact-pdf-mcp server?
io.github.dambuchs/redact-pdf-mcp is listed in the public MCP registry as io.github.dambuchs/redact-pdf-mcp. Permanently redact PII from PDFs and scans. EU/Swiss-hosted, never used to train AI models. This page covers its npm package (redact-pdf-mcp).
Is the io.github.dambuchs/redact-pdf-mcp server safe to use?
io.github.dambuchs/redact-pdf-mcp scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.dambuchs/redact-pdf-mcp server expose?
io.github.dambuchs/redact-pdf-mcp exposes 6 tools: redact_pdf_and_wait, redact_pdf, get_job_status, download_redacted, try_demo, get_account_status. Their descriptions and schemas cost roughly 2,314 tokens of context every time the server is loaded.
Is the io.github.dambuchs/redact-pdf-mcp server still maintained?
io.github.dambuchs/redact-pdf-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.dambuchs/redact-pdf-mcp server under?
io.github.dambuchs/redact-pdf-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.