Redact PDF MCP

Redact PDF MCP server

An MCP server that permanently redacts PII from PDFs. Give an agent a PDF, get back a PDF with the sensitive text *removed from the file* — not covered with a black rectangle that anyone can select, copy, or delete.

Most "redaction" MCP servers scrub PII out of prompt text. This one takes a real document and returns a real redacted document.

It also anonymizes. With mode: "pseudonymize" every person, company and address becomes a consistent tag such as [Person 1] instead of a black box, so the document stays readable (e.g. before pasting a contract into ChatGPT or Claude), and you get the tag → original table to restore the names.

claude mcp add redact-pdf -- npx -y redact-pdf-mcp

Then ask: *"Redact the personal data in ~/Documents/contract.pdf"*, or *"Anonymize ~/Documents/contract.pdf with placeholders so I can paste it into an AI"*.

---

Your data

You are sending the document the agent is meant to protect, so this comes first.

• Never used to train AI models — not ours, not Microsoft's, not anyone's. The Azure AI services used for OCR and PII detection run with content logging disabled, so document content is not retained or used for model improvement.
• Processed in the EU and Switzerland on Microsoft Azure.
• Encrypted with TLS 1.2+ in transit and AES-256 at rest.
• The original is deleted after processing under the default ephemeral retention. The redacted output is kept for your account's retention window (14 days by default, configurable) and can be purged at any time with DELETE /v1/jobs/{job_id}.
• Certified infrastructure. Azure holds SOC 2 Type II, ISO 27001, ISO 27017 and ISO 27018 certifications and is HIPAA-eligible under Microsoft's BAA. Redact PDF AI itself is not independently audited for these frameworks; it is built so legal, medical and finance teams can use it inside their own compliance posture.
• The MCP server sends no telemetry of its own — see what the server does locally.

Details: redact-pdf.ai/security · privacy policy

Why not let the agent redact it itself?

An agent can find names in text. It cannot make a PDF safe on its own:

• A black box is not a redaction. Drawing a rectangle over text leaves the text layer underneath; anyone can select, copy or extract it. This server rasterizes each page and drops the text layer and metadata, so there is nothing left to recover.
• Scans have no text to search. Contracts, IDs and statements are often images. OCR runs first, in 100+ languages, then PII detection runs over what it read.
• Detection is a model, not a regex. Names, addresses and organizations do not follow a pattern. The detector is purpose-built for PII, and your always-redact and never-redact lists cover the rest.

Examples

Prompts that work as-is once the server is installed:

• *"Redact the personal data in ~/Documents/lease.pdf before I send it to the agency."*
• *"Redact names, emails and IBANs in every PDF in ~/Downloads/statements, keep our company name visible."* — the agent passes pii_excluded_terms for the company name and fans out with redact_pdf.
• *"Here is a screenshot of a customer ticket. Remove the phone number and address, then give me a PDF I can attach."* — images go in directly, no conversion.
• *"Try the redact-pdf demo on ~/Documents/contract.pdf so I can see what it does."* — keyless, first page only.

Try it with no API key

The server ships a keyless tool, try_demo. Give it a file and it redacts the first page for real — no key, no account — and tells the agent what it found:

You: Use the redact-pdf server's try_demo tool on ~/Documents/contract.pdf.

Claude: Redacted the first page of contract.pdf (4 pages). Personal data removed

on that page: Person, Email. Here is the redacted page (link valid 14 days). To redact

all 4 pages, a free account gets the first document (up to 5 pages) done in full, no card.

Call it with no file and it runs a built-in synthetic sample instead, which is the zero-configuration connectivity check. Same thing from a terminal, no install:

curl https://www.redact-pdf.ai/v1/demo

curl -F file=@contract.pdf https://www.redact-pdf.ai/v1/demo/redact

What it does

• Permanent, irreversible redaction. The underlying text is deleted, not masked. It cannot be recovered by copy-paste, text extraction, or "remove object" in a PDF editor.
• PDFs and images. Pass a PDF, JPEG or PNG. Photos and screenshots do not need converting first; the output is a redacted PDF either way.
• Scanned documents. OCR handles image-only PDFs and photos of documents.
• 100+ languages for entity detection.
• Eight entity types: Person, Email, PhoneNumber, Address, Organization, Date, IBAN, CreditCard — plus your own always-redact and never-redact term lists.
• EU/Swiss processing, never used for AI training — see Your data.
• Pseudonymize instead of black boxes. mode: "pseudonymize" replaces each entity with a consistent tag ([Person 1], [Org 1], [Address 1]...), identical on every page and for every variant of a name, so the document stays readable for a colleague or another AI. The text is still removed, not covered, and redact_pdf_and_wait also returns the tag → original table (CSV).
• Human review when it matters. retention: "studio" keeps the detected masks so a person can check and adjust them before export.

Install

Claude Code

claude mcp add redact-pdf --env REDACT_PDF_API_KEY=your_key -- npx -y redact-pdf-mcp

Claude Desktop

claude_desktop_config.json:

{

"mcpServers": { "redact-pdf": { "command": "npx", "args": ["-y", "redact-pdf-mcp"], "env": { "REDACT_PDF_API_KEY": "your_key" } } } }

Cursor

.cursor/mcp.json:

{

"mcpServers": { "redact-pdf": { "command": "npx", "args": ["-y", "redact-pdf-mcp"], "env": { "REDACT_PDF_API_KEY": "your_key" } } } }

VS Code

code --add-mcp '{"name":"redact-pdf","command":"npx","args":["-y","redact-pdf-mcp"],"env":{"REDACT_PDF_API_KEY":"your_key"}}'

Get an API key at redact-pdf.ai/sign-up. A free account gets its first document (up to 5 pages) redacted in full, no card. Without a key, try_demo still works; everything else will tell the agent to ask you for one.

A client that can't pass the key in the environment (Cowork drops a plugin MCP server whose config references a plugin setting, so the Claude plugin passes none) can save it instead: give the agent the key and it calls set_api_key, which checks the key against the API and, when the client supports MCP elicitation, asks you to approve the account (email and the key's last four characters). A confirmed key is written to ~/.config/redact-pdf-mcp/key (or $XDG_CONFIG_HOME/redact-pdf-mcp/key), readable by your user only, and is never replaced without the same confirmation. A client without elicitation gets the key for that session only, in memory, never over a key that still works, and every tool result names the account. That keeps a key planted in a processed document from silently redirecting your files. The tool never returns the key. You can also write the file yourself once (see the plugin README for the one-line command). REDACT_PDF_API_KEY takes priority when it is set; an empty value, or an unsubstituted placeholder such as ${user_config.api_key}, counts as unset.

Tools

Redaction rules, on either redact tool:

Anonymize → let the AI work → put the names back

The local server closes the loop without the model ever seeing a name:

1. redact_pdf_and_wait with mode: "pseudonymize" returns the redacted PDF, the correspondence table on disk, and document_text: the document as text, every name replaced by its tag. The agent works from that text.
2. The agent writes its answer (summary, memo, letter) to a .md, .txt or .docx file, keeping the tags as written.
3. restore_names with that file and the correspondence_path writes -restored. with the real names, and returns only the path and counts.

The agent must not open the original document first, nor the correspondence CSV or the restored file afterwards: any of those reads puts the personal data back into the conversation. The server instructions and tool descriptions say so explicitly.

Remote server

The package also ships a streamable-HTTP server for hosted use, where the API key travels per request instead of in the environment:

npx redact-pdf-mcp-http     # listens on :8080/mcp

POST /mcp

X-API-Key: your_key (or: Authorization: Bearer your_key)

It is stateless — no sessions, no stored keys, nothing kept between requests — so each request gets its own short-lived server instance and one caller's ke