{
  "markdown": "# Redact PDF MCP server\n\n**An MCP server that permanently redacts PII from PDFs.** Give an agent a PDF, get back a\nPDF with the sensitive text *removed from the file* — not covered with a black rectangle\nthat anyone can select, copy, or delete.\n\nMost \"redaction\" MCP servers scrub PII out of prompt text. This one takes a real document\nand returns a real redacted document.\n\n[![npm](https://img.shields.io/npm/v/redact-pdf-mcp?color=cb3837&logo=npm)](https://www.npmjs.com/package/redact-pdf-mcp)\n[![MCP registry](https://img.shields.io/badge/MCP%20registry-io.github.dambuchs%2Fredact--pdf--mcp-blue)](https://registry.modelcontextprotocol.io)\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](./LICENSE)\n\n<a href=\"https://glama.ai/mcp/servers/dambuchs/redact-pdf-mcp\"><img width=\"380\" height=\"200\" src=\"https://glama.ai/mcp/servers/dambuchs/redact-pdf-mcp/badges/card.svg\" alt=\"redact-pdf-mcp MCP server\" /></a>\n\n```bash\nclaude mcp add redact-pdf -- npx -y redact-pdf-mcp\n```\n\nThen ask: *\"Redact the personal data in ~/Documents/contract.pdf\"*.\n\n---\n\n## Try it with no API key\n\nThe server ships a keyless tool, `try_demo`, so you can verify the whole path — client,\nserver, API — before signing up for anything:\n\n> **You:** Use the redact-pdf server's try_demo tool.\n>\n> **Claude:** The demo redacted a synthetic sample and removed 5 entities: Person\n> (`Jane Sample`), Email (`jane.sample@example.com`), PhoneNumber (`+1 415 555 0142`),\n> Organization (`Globex Demo Inc.`), Date (`2026-03-14`).\n\nSame thing from a terminal, no install:\n\n```bash\ncurl https://www.redact-pdf.ai/v1/demo\n```\n\n## What it does\n\n- **Permanent, irreversible redaction.** The underlying text is deleted, not masked. It\n  cannot be recovered by copy-paste, text extraction, or \"remove object\" in a PDF editor.\n- **PDFs and images.** Pass a PDF, JPEG or PNG. Photos and screenshots do not need converting\n  first; the output is a redacted PDF either way.\n- **Scanned documents.** OCR handles image-only PDFs and photos of documents.\n- **100+ languages** for entity detection.\n- **Eight entity types**: Person, Email, PhoneNumber, Address, Organization, Date, IBAN,\n  CreditCard — plus your own always-redact and never-redact term lists.\n- **EU/Swiss processing.**\n- **Human review when it matters.** `retention: \"studio\"` keeps the detected masks so a\n  person can check and adjust them before export.\n\n## Install\n\n### Claude Code\n\n```bash\nclaude mcp add redact-pdf --env REDACT_PDF_API_KEY=your_key -- npx -y redact-pdf-mcp\n```\n\n### Claude Desktop\n\n`claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"redact-pdf\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"redact-pdf-mcp\"],\n      \"env\": { \"REDACT_PDF_API_KEY\": \"your_key\" }\n    }\n  }\n}\n```\n\n### Cursor\n\n`.cursor/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"redact-pdf\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"redact-pdf-mcp\"],\n      \"env\": { \"REDACT_PDF_API_KEY\": \"your_key\" }\n    }\n  }\n}\n```\n\n### VS Code\n\n```bash\ncode --add-mcp '{\"name\":\"redact-pdf\",\"command\":\"npx\",\"args\":[\"-y\",\"redact-pdf-mcp\"],\"env\":{\"REDACT_PDF_API_KEY\":\"your_key\"}}'\n```\n\nGet an API key at [redact-pdf.ai/sign-up](https://www.redact-pdf.ai/sign-up). Without one,\n`try_demo` still works; everything else will tell the agent to ask you for a key.\n\n## Tools\n\n| Tool | What it does |\n| --- | --- |\n| `redact_pdf_and_wait` | **Start here.** Upload, redact, wait, return the finished PDF. One call. |\n| `redact_pdf` | Start a job and return immediately, for redacting several documents in parallel. |\n| `get_job_status` | Poll a job: `uploaded` → `analyzing` → `redacting` → `redacted` \\| `error`. |\n| `download_redacted` | Fetch the redacted output for one document. |\n| `try_demo` | Keyless. Verify the server works with zero configuration. |\n| `get_account_status` | Check the API key is valid and see the account, before a big batch. |\n\nRedaction rules, on either redact tool:\n\n| Argument | Effect |\n| --- | --- |\n| `pii_categories` | Restrict to specific entity types. Omit for account defaults. |\n| `pii_included_terms` | Always redact these, even if not detected as PII (codenames, case numbers). |\n| `pii_excluded_terms` | Never redact these, even if detected (your own company name). |\n| `retention` | `ephemeral` (default) deletes the original after processing. `studio` keeps masks for human review. |\n\n## Remote server\n\nThe package also ships a streamable-HTTP server for hosted use, where the API key travels\nper request instead of in the environment:\n\n```bash\nnpx redact-pdf-mcp-http     # listens on :8080/mcp\n```\n\n```\nPOST /mcp\nX-API-Key: your_key          (or: Authorization: Bearer your_key)\n```\n\nIt is **stateless** — no sessions, no stored keys, nothing kept between requests — so each\nrequest gets its own short-lived server instance and one caller's key can never leak into\nanother's tool call.\n\nThe handshake, `tools/list`, and `try_demo` work without a key, so a client can connect and\nverify the server before anyone signs up; every other tool returns `401` with a\n`WWW-Authenticate` challenge.\n\nDocuments are supplied as `file_base64` (the remote server has no access to your\nfilesystem).\n\nFetching a document by URL is **off by default** on the remote server. The address check\nis real — URLs resolving to loopback, private, or link-local addresses are refused, and\nevery redirect hop is re-checked — but the socket resolves the hostname a second time\nafter that check, so a DNS-rebinding attacker with a short TTL can still have the server\nvalidate one address and connect to another. Closing that requires pinning the connection\nto the validated address, which is not implemented yet, so an internet-reachable server\ndoes not offer the surface at all.\n\nSet `REDACT_PDF_ENABLE_URL_INPUT=1` to accept `file_url`, and only where you have your own\negress controls (a network policy or allowlisting proxy) in front of the server.\n`REDACT_PDF_ALLOW_PRIVATE_URLS=1` additionally permits private addresses, for a\nself-hosted instance fetching from internal storage.\n\nstdio mode is unaffected: it runs on your own machine, where fetching a URL carries no\nprivilege you do not already have.\n\n| Variable | Default | Purpose |\n| --- | --- | --- |\n| `REDACT_PDF_API_KEY` | — | API key (stdio mode only; remote takes it per request). |\n| `REDACT_PDF_BASE_URL` | `https://www.redact-pdf.ai` | Point at a different API host. |\n| `PORT` | `8080` | HTTP server port. |\n| `REDACT_PDF_MCP_PATH` | `/mcp` | HTTP endpoint path. |\n| `REDACT_PDF_ENABLE_URL_INPUT` | unset | Accept `file_url` on the remote server. Off by default — see the DNS-rebinding note above. |\n| `REDACT_PDF_ALLOW_PRIVATE_URLS` | unset | Self-hosted only: permit `file_url` to reach private addresses. Never set this on a publicly reachable server. |\n\n## Privacy\n\n- **No telemetry.** The server makes exactly the API calls its tools describe, and nothing\n  else. No analytics, no error reporting, no phone-home.\n- **Stateless.** No database, no cache, no disk writes except the redacted PDF you asked\n  for, at the path you asked for.\n- **Your originals stay yours.** In stdio mode the input file is read and never modified.\n  Under the default `ephemeral` retention the API deletes the original after processing.\n- **Idempotent by default.** The idempotency key is derived from the file bytes and the\n  redaction settings, so an agent that retries the same call gets the *same* job back\n  instead of redacting — and billing — twice. That cache lasts 24 hours; pass an explicit\n  `idempotency_key` when you genuinely want a second, separate redaction of the same file.\n- **Never overwrites.** In stdio mode the redacted PDF is written atomically and the tool\n  refuses to clobber an existing file.\n\n## Limits\n\n- 50 MB per PDF, 10 MB per image, 100 files per job.\n- PDF, JPEG and PNG in; always a PDF out. Convert other formats (DOCX, TIFF, HEIC) to PDF first.\n- On the remote server, base64 inflates a document by about a third, so prefer `file_url`\n  for anything large.\n- Passing an empty `pii_categories` list is rejected: to the API an empty list means\n  \"redact nothing\", which would return an untouched file reported as redacted. Omit the\n  argument to use your account defaults.\n- Billed per page against your plan quota and credit packs. A `quota_exceeded` error means\n  top up — the tools tell the agent not to retry it.\n\n## Development\n\n```bash\nnpm install\nnpm run build\nnpm test                 # offline unit + tool tests\nnpm run test:integration # hits the live keyless demo endpoint; no key needed\n```\n\n## Links\n\n- API docs: [redact-pdf.ai/developers](https://www.redact-pdf.ai/developers)\n- OpenAPI spec: [redact-pdf.ai/openapi.yaml](https://www.redact-pdf.ai/openapi.yaml)\n- LLM index: [redact-pdf.ai/llms.txt](https://www.redact-pdf.ai/llms.txt)\n\nSupport questions about redaction quality, billing, or your account go to\ninfo@redact-pdf.ai — GitHub issues here are for the MCP server itself.\n\nMIT licensed.\n",
  "bytes": 8944,
  "sha": "e49cebb58d112db8a018db2a54be3262533efd480e4893ae9edd7a4e31ea1d69",
  "repo_slug": "dambuchs/redact-pdf-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_dambuchs_redact_pdf_mcp_28ac61fb/readme"
}