MaskFlow PII proxy

io.github.maskflowPublished by GitHub account maskflowv0.1.2Updated Oct 24, 2026

Mask PII in outbound MCP tool-call arguments, unmask the results. Indian identifiers included.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local proxy that masks PII in an assistant's outbound MCP tool-call arguments and restores the originals in the results.

What you can do
MaskFlow PII proxy sits between an agent and any MCP server, masking personally identifiable information in outbound tools/call argument values before they reach the backend tool and unmasking the placeholders in the returned results. Placeholders stay consistent for the whole agent run, and the token-to-value map is kept in memory per connection. Detection covers generic PII plus Indian identifiers such as Aadhaar, PAN, GSTIN, UPI, IFSC and ABHA. It can wrap a stdio backend command or an HTTP backend URL, and tools/list, prompts and resources pass through unchanged.
When to use it
Use it when an assistant sends user data such as names, emails, phone numbers or government identifiers to third-party MCP servers and you want the real values stopped at the boundary. It is a drop-in shim, so it fits agents that already talk to an MCP backend over stdio or HTTP.
Requirements
Local Python runtime; install the maskflow-mcp package from PyPI or run it with uvx. A backend MCP server is required, given as a command line or a URL, or read from a Claude-Desktop-style config file. The first detection run downloads a small spaCy model unless --patterns-only is used. Backend credentials are forwarded explicitly with --pass-env.
Before you install
It is a proxy for sensitive data, so verify that masking covers the fields you care about before relying on it. By default raw PII that a tool adds to its own result passes through untouched; enable --mask-tool-results to mask that too. Resource content masking is off by default. Forwarding a backend credential with --pass-env exposes that variable to the wrapped process.

Installation

In SourceWeft

  1. Open MaskFlow PII proxy in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

maskflow-mcp

A Model Context Protocol proxy that wraps any MCP server and keeps PII out of your agent's tool traffic. It masks PII in outbound tools/call arguments before they reach the backend tool, and restores the originals in the results, with placeholders that stay consistent for the whole agent run.

Agents routinely pass user PII (names, emails, PAN, Aadhaar, phone numbers) straight into third-party MCP servers as tool arguments. This proxy is a drop-in shim that stops the real values at the boundary. It runs MaskFlow's detection engine, so the Indian identifiers (Aadhaar, PAN, GSTIN, UPI, IFSC, ABHA, Indian names / addresses) are covered alongside the generic PII.

MIT, no gates, no telemetry.

Install

bash
pip install maskflow-mcp# or, no install:uvx maskflow-mcp stdio --backend "npx -y @modelcontextprotocol/server-github"

Pulls fastmcp (the 2.x line, which does not bundle LLM vendor SDKs). The first detection run downloads a small spaCy model; pass --patterns-only to skip it.

Use it

stdio (Claude Desktop, most agents)

Point the agent at maskflow-mcp and give it the real server as --backend:

jsonc
// claude_desktop_config.json{  "mcpServers": {    "github": {      "command": "maskflow-mcp",      "args": ["stdio", "--backend", "npx -y @modelcontextprotocol/server-github",               "--pass-env", "GITHUB_TOKEN"]    }  }}

Or wrap a server already defined in a config file:

bash
maskflow-mcp stdio --config ./claude_desktop_config.json --backend-name github

HTTP

bash
maskflow-mcp http --backend https://example.com/mcp --host 127.0.0.1 --port 9000

Options

FlagDefaultMeaning
--backend–Backend command line, or a URL
--config / --backend-name–Read the backend from a Claude-Desktop-style JSON file
--pass-env VAR–Forward an env var to a stdio backend (repeatable)
--min-confidence0.5Detection threshold
--patterns-onlyoffSkip the spaCy NER pass (faster; drops bare-name / address detection)
--mask-tool-resultsoffAlso mask PII the tool introduced in its result, not just unmask placeholders it echoed
--session-ttl3600Lifetime of a per-connection session

What is masked

tools/call arguments are walked (string and numeric values only, keys never) and masked through the connection's session. The result's text and structured content is unmasked, restoring placeholders the tool echoed. By default raw PII that the tool adds to a result passes through untouched; --mask-tool-results masks that too, so the agent never sees it.

tools/list, prompts/*, and resources/* pass through unchanged (resource content masking is not on by default).

PII safety

The token-to-value map lives in memory per connection and is never logged. Only masked values cross the wire to the backend. See docs/mcp.md in the MaskFlow repo for the design.

Source: packages/maskflow-mcp/README.md at commit dc6297e

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts