io.github.omitly/omitly-mcp

Report Omitly's current licence or trial state on this machine — free, takes no arguments, and reads no document. Use it to answer 'am I licensed?', to see how many trial days are left, or to confirm a licence the user just saved has been picked up. Re-resolved on EVERY call, so buy → save the licence file → call again works without restarting this server. Reports which resolution step supplied the licence (OMITLY_LICENSE_FILE, the activated desktop licence, or the import inbox ~/.omitly/omitly.license), the tier, the vendor-signed licensee name, whether the licence is bound to this one machine, and whether this build can make licensed-provenance claims at all. It deliberately NEVER returns the device fingerprint (a stable machine identifier) or the licence file's contents — 'device-bound' is reported as a yes/no. Requires a configured native engine (OMITLY_ENGINE_DIR/OMITLY_REDACT_BIN): the wasm free tier has no licence concept, so there is nothing to report without one.

Audit an ALREADY-redacted PDF and report whether sensitive text still survives underneath the redaction — the 'did my black boxes actually remove the data?' check. Most tools redact by drawing a rectangle over text while leaving the characters in the file, where they stay selectable and extractable. This re-extracts the text on-device and flags any emails, SSNs, phone or card numbers that are still present, each with a MASKED preview — the raw value never leaves the machine. It checks the page text layer, text surviving UNDER redaction marks, incremental-update prior revisions (the classic 'redacted then saved, original still in the file' failure), document metadata, AcroForm field values and embedded attachments, and returns a coverage report so a clean result is scoped to what was inspected. A non-empty result means the redaction leaked. Nothing is uploaded. (Pattern-based: names/addresses, image-only text, and the surfaces listed as not-inspected aren't covered; absence of hits isn't proof of completeness.) Free tier (no native engine): reports are EVALUATION-marked — for evaluation, not production reliance — and limited to a monthly number of free checks, counted locally; past the cap this tool returns a structured 'free-cap' refusal. A configured licensed engine is not capped.

Generate a clean PDF from Markdown (or raw HTML) on-device, rendered through a real browser engine so it looks printed — not like a script's best guess. Give it Markdown inline via `source` (or a file via `sourcePath`) and an `outputPath`; it writes the PDF and returns the path. Use this instead of writing a one-off reportlab/LaTeX/pandoc script. Nothing is uploaded.

Extract a PDF's text, page by page, for reading or summarizing — PII-MASKED BY DEFAULT, so detected emails, SSNs, phone/card numbers and Australian identifiers (TFN/ABN/ACN/Medicare/CRN/IHI/BSB) never flood your context window as raw values. Each page returns its (masked, unless you opt out) text plus 'spans': the CHAR offset (not byte offset — matters for any non-ASCII text) of every detected PII value with its kind, so you can still reason about WHERE something was found even though the value itself reads as a masked preview (e.g. '•••-••-6789'). Pass 'masked: false' ONLY when you deliberately need the raw text for genuine content review and understand the raw PII values will then appear verbatim in this response and in your context — that is the explicit, documented opt-in this tool requires; the default is always masked. A page whose content stream could not be read (corrupt or size-capped) reports 'contentDecoded: false' with empty text rather than being silently skipped or counted as blank. Does NOT render pages to images — text only. Free tier, no licence required; works zero-install via the bundled wasm engine, same as find_sensitive_regions/locate_text/check_redaction/verify_redaction — a configured native engine (OMITLY_ENGINE_DIR) is preferred when available (also enables the 'regions' filter, wasm-only ignores it and scans every pattern) but not required. The file is never uploaded: extraction runs entirely on-device.

Scan a PDF on-device and return candidate regions that look like PII — emails, US SSNs, phone numbers, card numbers, and Australian identifiers (TFN, ABN, ACN, Medicare, Centrelink CRN, IHI, BSB; kinds 'tfn'/'abn'/'acn'/'medicare'/'crn'/'ihi'/'bsb') — each with the page and exact coordinates (in PDF points) the redaction engine needs. Use this FIRST so you select regions by entity ('redact every TFN') and pass the returned coordinates straight to redact_pdf, instead of guessing geometry from a rendered page. Numeric kinds are check-digit validated where a published algorithm exists (CRN has none — its matches are format-only). Candidates are best-effort pattern matches for review — not a completeness guarantee and not a compliance assessment; the file is never uploaded — detection runs locally. Each candidate carries a MASKED preview (e.g. '•••-••-6789'), never the raw value: the secret stays on the machine. You don't need the plaintext to redact — drive it by page + coordinates. (A human reviewer has the file open locally for full context.) Free tier (no native engine): results are EVALUATION-marked and limited to a monthly number of free checks, counted locally — past the cap this tool returns a structured 'free-cap' refusal. A configured licensed engine is not capped.

Locate exact text strings in a PDF and return each occurrence's page and coordinates (in PDF points). Use this for what pattern-matching can't catch — names, addresses, account references — by doing the entity recognition YOURSELF and passing the literal strings here; the engine resolves where they sit so you never guess geometry from a rendered page. Feed the returned regions straight to redact_pdf. Case-insensitive; a string the PDF splits across text operators may not match as one run. Each hit returns a masked preview, not the raw text. Nothing is uploaded.

Find and redact PII in a PDF in ONE on-device step: scan, keep only the requested entity kinds (email/ssn/phone/card plus the Australian tfn/abn/acn/medicare/crn/ihi/bsb — omit `kinds` to redact every kind detected), remove them, verify, and return what was redacted plus the audit log. This is the 'just scrub the obvious PII' shortcut; when you need to review before removing, call find_sensitive_regions first. Same caveat as the detector: matches are best-effort pattern matching, not a completeness guarantee and not a compliance assessment. Nothing is uploaded.

Permanently redact regions of a PDF on-device using Omitly. Removes the underlying text and image data (not a black box over it), verifies nothing survives in each region, and returns a signed audit log. The file is never uploaded — redaction happens locally.

Recipient trust-verification: for someone who RECEIVED a PDF from someone else and wants to confirm it's an authentic, unaltered Omitly output — free tier, no licence required. Confirms the embedded audit report and Ed25519 tamper-evidence seal are valid and unaltered since sealing, and reports the seal's own attested verdict — this does not independently re-scan the document for residual PII. For that self-check (typically run by the person who just redacted, not a recipient), use `verify_redaction` instead. The seal proves INTEGRITY, NOT IDENTITY: the signing key is per-install and travels with the file, so a valid seal means 'unchanged since sealed by the holder of this key', never 'produced by Omitly' — compare `sealFingerprint` out-of-band against the fingerprint the sender published if origin matters. Currently requires a configured native engine (OMITLY_ENGINE_DIR/OMITLY_REDACT_BIN) — there is no wasm seal-verification path yet (tracked in issue #113), so a recipient running only `npx omitly-mcp` with no engine installed cannot use this tool until that lands. A `seal_unsupported_version` verdict means this verifier is too old to check the seal at all — that is neither a pass nor a fail; update the verifier rather than trusting or rejecting the file on that basis.

Re-scan an already-redacted PDF on-device and confirm nothing recoverable remains. With a configured native engine and this file's own `<path>.audit.json` sidecar (written by redact_pdf/redact_by_entity), this re-checks exactly the regions that were redacted — the strongest form of this check. Without a native engine (or without that sidecar — e.g. the file wasn't redacted by this tool), it falls back to a general on-device re-scan of the whole file and reports whether anything is still detectable — a good-faith re-check, not a claim of the same rigor as the sidecar-based path. This is a self-check for the person who just redacted, typically the one holding the sidecar file — a third-party recipient who only has the delivered PDF should use `verify_document` instead, which checks the embedded audit report and seal rather than re-scanning region bytes.

Verify a PDF's embedded Omitly audit report and trailing Ed25519 tamper-evidence seal — on-device, nothing uploaded. Distinct from `verify_redaction`: that tool re-checks whether redacted regions are still empty; this tool cryptographically checks whether the delivered bytes have changed since they were sealed. The seal proves INTEGRITY, NOT IDENTITY: the signing key is per-install and travels with the file, so a valid seal means 'unchanged since sealed by the holder of this key', never 'produced by Omitly'. Compare `sealFingerprint` out-of-band against the fingerprint the sender published if origin matters. Requires a configured native engine — there is no wasm seal-verification path, so this always needs OMITLY_ENGINE_DIR/OMITLY_REDACT_BIN. A `seal_unsupported_version` verdict means this verifier is too old to check the seal at all — that is neither a pass nor a fail; update the verifier rather than trusting or rejecting the file on that basis.