ScrubGuard

Local-first MCP server that scrubs or reversibly tokenizes PII and leaked secrets in text and JSON before it reaches an LLM.

What you can do

• Scrub or reversibly tokenize PII (emails, SSNs, Luhn-verified credit cards, IBANs, phones, IPv4) and leaked API keys or secrets in text
• Restore tokenized placeholders such as [EMAIL_1] in LLM responses using the vault map returned by the scrub step
• Recursively scrub PII and sensitive keys (password, secret, api_key, ssn) inside JSON objects or arrays while preserving schema types

When to use it

Useful when you want to send prompts, logs or JSON payloads to a model without exposing personal data or credentials, and still map the model's answer back to the original values. It fits workflows that need a reversible redaction step rather than permanent masking.

Requirements

Runs as a local stdio process installed from the npm package, so Node.js is needed. No account is required: without SCRUBGUARD_API_KEY it scrubs locally with no network calls. Setting SCRUBGUARD_API_KEY enables the optional hosted Pro API, which requires network access.