Balmas Mcp

com.balmasaiPublished by balmasai.comv0.3.0Updated Oct 24, 2026

Agents read cleaned copies of your files: PII replaced with local consistent tokens. Read-only.

The publisher's own server: Persqo

VerifiedSTDIODesktop onlyFiles & StorageSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant read allowlisted local files as locally anonymized copies, with a restore tool to map tokens back to real values.

What you can do
The server exposes read-only tools over folders you allowlist: list_files returns names, sizes and types without contents, read_clean_file returns file text after local anonymization, and restore_text maps tokens in the assistant's output back to the original values for the session. Names, ID numbers, phones, emails, companies, amounts and secrets such as API keys, JWTs and private-key blocks are replaced with consistent tokens like PERSON_001 or SECRET_001 before content is returned. Detection runs in the local process using deterministic patterns, lexicons and checksums, in Hebrew and English. Supported inputs include txt, csv, md, docx, xlsx, pptx and text-layer pdf.
When to use it
Use it when an assistant needs to read documents that contain personal or sensitive data and you want it to see redacted copies rather than raw files. It is meant to replace direct filesystem access for that agent, not to sit alongside it. Useful for email, HR, legal or finance document review where minimization matters.
Requirements
Runs locally over stdio, typically via npx from the npm package balmas-mcp. Requires a free account and an API key supplied as the BALMAS_API_KEY environment variable, plus at least one allowlisted folder passed as a positional argument. An optional --level flag selects standard, strict or maximum. Each file read counts against a monthly document quota.
Before you install
The API key BALMAS_API_KEY is a secret and is sent to the provider; file contents, paths and the replacement map are stated to stay local, while metering counters leave the machine. Reads consume a monthly quota. Detection is deterministic and may miss sensitive values, so review output where stakes are high. It only helps if the agent reads files through it instead of having raw filesystem access. Scanned PDFs without a text layer are not supported.

Installation

In SourceWeft

  1. Open Balmas Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

balmas-mcp

Your AI agent reads everything. This gateway hands it redacted copies instead.

[npm] [license]

[balmas-mcp demo: the agent reads a contract and sees PERSON_001 instead of real names]

Why

AI agents are getting file access — and they over-read. Israel's Privacy Protection Authority put it bluntly in its guidance on AI agents: an email-sorting agent can analyze 15 years of correspondence for a 2-year task, infer your health and finances along the way, and leak what it learned. Their recommendation: strict permission minimization — read-only, dedicated folders, minimum necessary data.

balmas-mcp turns that advice into code, and goes one step further: it minimizes not just which files the agent reads, but what's inside them.

How it works

  1. You allowlist folders. The agent can't reach anything else — enforced with realpath checks, not honor rules.
  2. Every read is anonymized locally. Names, ID numbers, phones, emails, companies and amounts become consistent tokens (PERSON_001, ID_001) before the content is returned. Secrets too: API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Slack…), JWTs, private-key blocks, password: values and .env credentials become SECRET_001 at every level — and are never written back by restore_text. The same person is PERSON_001 in every file, so the agent's reasoning stays coherent. Detection runs in this process — deterministic patterns, lexicons and checksums (Israeli ID included). Hebrew and English.
  3. The answer comes back real. restore_text maps the tokens in the agent's final output back to the original values — locally.

Read-only by design: the server exposes no write tools at all.

Quickstart

  1. Create a free account at balmasai.com/signup (10 documents/month free).
  2. Create an API key (bk_...) at balmasai.com/app/team.
  3. Add to your MCP client config (Claude Desktop shown; Cursor and others are the same idea):
json
{  "mcpServers": {    "balmas": {      "command": "npx",      "args": ["-y", "balmas-mcp", "/Users/me/Documents/work", "--level", "strict"],      "env": { "BALMAS_API_KEY": "bk_..." }    }  }}

Options: allowed folders as positional args (required, one or more) · --level standard|strict|maximum (default strict).

Tools

ToolWhat the agent gets
list_filesNames, sizes, types inside allowed folders — never contents
read_clean_fileThe file's text after local anonymization
restore_textReal values back into its output (session tokens only)

Supported inputs: txt csv md docx xlsx pptx pdf (text layer).

Privacy model

Leaves your machine?
File contentsNever
File names / pathsNever
The replacement mapNever
Metering counters (file type + item counts)Yes — that's all

Each file read counts as one document against your account's monthly quota (free 10 / PRO 200 / TEAM 1,000). Full processing happens in this local process.

Honest limits

  • The gateway helps only when the agent reads files through it — grant it instead of raw filesystem access, not alongside.
  • Detection is deterministic: excellent, not clairvoyant. Review output where the stakes demand it.
  • Scanned PDFs (no text layer) need the OCR flow at balmasai.com/clean.

Built by BALMAS AI — sensitive data stops here. Docs: balmasai.com/mcp

Source: README.md at commit 29e7c36

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.3.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Persqo integrations

Persqo

com.persqoOfficial publisher

Persqo runs AI personas through your live or preview website in a real browser and returns scored reports, replays and ready-to-paste fix prompts.

Streamable HTTPWeb executableAuth
Browser AutomationCredential requiredNov 8, 2026