Redacta Mcp
io.github.nickjlambPublished by GitHub account nickjlambv2.1.1Updated Oct 24, 2026
Keep patient identifiers out of AI agent context — a local privacy boundary for healthcare agents.
Overview
A local MCP server that pseudonymises patient identifiers in clinical text before it reaches an AI agent, returning cleaned text and a redaction report.
- What you can do
- Redact clinical and medical documents, replacing patient identifiers such as names, NHS numbers, dates of birth, postcodes, phone numbers and emails with labelled tokens while keeping clinical meaning intact, with an optional stricter HIPAA Safe Harbor pass covering all dates, ages and further identifiers, plus a self-check pass for anything missed. Re-identify text by restoring original values from a token map produced by an earlier redaction, so a document can be redacted, processed elsewhere and restored locally. Produce a redaction report alongside the cleaned text for review.
- When to use it
- Useful when a healthcare or clinical workflow sends documents to an AI assistant and identifiable patient data must not enter the agent's context, or when a redact, process and re-identify round trip is needed locally.
- Requirements
- Runs as a local process on the user's machine via npm (npx redacta-mcp); desktop only, no web executable. No authentication, environment variables or headers are declared. The bundled pattern matching uses only the Python standard library and no network.
Installation
In SourceWeft
- Open Redacta Mcp in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
Redacta
[CI] [DOI] [engine] [npm downloads] [redacta-mcp] [PyPI] [App Store] [Anthropic MCP Directory] [Glama MCP server] [Listed on mcpservers.org] [self-hosted]
Pseudonymise medical and clinical documents before they're processed by AI or
shared. Redacta replaces patient identifiers with labelled tokens —
[PATIENT_NAME_1], [NHS_NUMBER_1], [DATE_OF_BIRTH_1], … — while leaving the
clinical meaning intact, and returns a redaction report alongside the cleaned
text.
It started as an Agent Skill and is now one engine shipped across eight surfaces — an iOS app, agent skill, MCP server, a self-hosted HTTP service with a Kubernetes deployment, two libraries, a CLI, and a FigJam whiteboard plugin.
Running this in production? Redacta offers a small number of fixed-price design-partner integrations for teams shipping AI agents on clinical or patient data — deployment in your environment, one real workflow integrated, and a data-flow document written for your DPO. Details →
One engine, many surfaces
The detection logic lives in one place — the TypeScript engine
(@pharmatools/redacta, in npm-package/), which the MCP server and the
FigJam plugin consume, and which the iOS app runs on-device via JavaScriptCore.
The Python package mirrors it for pip users; the agent skill adds LLM reasoning
for free-text names on top of the deterministic patterns.
How it works
[The Redacta privacy boundary: a clinical document is redacted inside your boundary — deterministic patterns plus reasoning plus a self-check — producing tokenised text and a token map. Only the tokenised text crosses to the AI tool; the token map never leaves. The processed output comes back and reinstate restores the original identifiers locally. Raw identifiers never cross the boundary.]Two layers:
- Patterns (deterministic). A bundled script (
scripts/redact_structured.py, Python standard library only, no network) matches fixed-format identifiers: NHS numbers (Modulus-11 validated), UK National Insurance numbers, dates of birth, UK postcodes, phone numbers, emails, and hospital/MRN numbers. US SSN and ZIP codes are also handled. - Reasoning (judgement). The skill then has the agent handle what patterns can't: patient names (told apart from the clinicians treating them), relatives and carers, postal addresses, and identifying ages.
- Self-check. A final pass re-reads the output for any identifier that slipped through before the report is written.
It also works in reverse. Re-identification (scripts/reinstate.py) takes the
token map from an earlier redaction and restores the original values — so you can
redact a document, run it through another AI tool, and put the real details back
locally. Redact → process → re-identify is a complete round trip, and identifiers
only ever exist on your machine.
Safe Harbor mode. Ask for HIPAA Safe Harbor (or "US de-identification") and Redacta applies a stricter pass: all dates (not just the date of birth), all specific ages, and the remaining HIPAA identifiers — fax, certificate/licence, device serial, VIN, and health-plan beneficiary numbers.
Self-hosting on Kubernetes
Organisations that can't let identifiable text leave their environment can
run Redacta inside their own infrastructure: a small HTTP service
(gateway-service/) deployable into an existing
Kubernetes cluster with plain YAML — two stateless replicas behind a
Service for redact/reinstate, an optional single-replica session boundary
for the protect → release loop, health probes, resource limits, restrictive
security defaults, and no-PHI logging. Text is pseudonymised before it
reaches any external AI service, and the processing boundary stays under
your control. Walkthrough (local kind cluster included):
gateway-service/k8s/README.md ·
concepts: docs/KUBERNETES.md.
Deploying somewhere a DPO will ask questions? There's a one-page security &
data-protection summary at
pharmatools.ai/redacta-security.
Install
Claude Code
Then invoke it with /redacta, or let it trigger automatically when you ask to
redact or de-identify clinical text.
Claude apps / API
Zip the repository folder and upload it as a skill.
Contents
Run the tests:
A note on limits
Redacta is a strong first line of defence, not a guarantee. It won't catch every possible identifier and isn't a substitute for formal data-protection processes. Always review the redaction report before sharing text.
License
MIT-0 (MIT No Attribution). Built by PharmaTools.AI.
Source: README.md at commit 895ee84
Tools
0Version history
2- v2.1.1LatestOct 6, 2026
- v2.1.0Sep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts