Ocultar Pii

A local MCP bridge to Ocultar, a PII/PHI masking engine that replaces personal data with reversible tokens before text reaches a cloud model.

What you can do

Mask text or JSON by replacing personal data such as names, emails, IDs, cards, phones and addresses with deterministic tokens, returning a hit report with the detected types and counts. Restore masked tokens to their originals from the local encrypted vault when an auditor token is configured. Manage the persistent entity registry, including seeding canonical names so variants map to the same token. Check the health and status of the local masking engine.

When to use it

Use it when prompts containing personal or health data must pass through a cloud LLM without the raw data leaving your infrastructure, and you want masking and controlled re-identification inside the assistant workflow.

Requirements

Runs as a local process (PyPI package ocultar-claude-mcp via Python, or an MCPB bundle) and needs a locally running Ocultar Refinery reachable at OCULTAR_URL. The refinery itself needs OCU_MASTER_KEY, OCU_SALT and OCU_AUDITOR_TOKEN; the MCP side uses OCULTAR_API_KEY and OCULTAR_AUDITOR_TOKEN, which must match the server's OCU_AUDITOR_TOKEN. Desktop only.