# Strac MCP DLP

Checks text and files for PII, PHI, PCI data, and secrets before an AI agent receives them. Useful for sanitising prompts, tickets, and documents.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: strac-io
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/strac-io/strac-mcp-dlp
- Updated: 2026-09-03
- HTML: https://affpapa.org/en/nevibecode/mcp/strac-mcp-dlp

## What it does

Strac MCP DLP exposes Strac’s data-loss prevention checks through MCP. `redact_text` returns sanitised text with detected categories, while `detect_sensitive_data` scans without altering the input. File tools inspect images, PDFs, scans, configuration files, and source code; `redact_file` writes a separate cleaned copy and leaves the original intact.

The package is a thin API client, so detection and redaction run on Strac’s side. Redaction can use `REDACTED`, `BLANK`, `MASK_SEVEN_X`, or `TOKEN_LINK_PLAINTEXT`. `detokenize` resolves vault tokens for authorised callers, but live use requires a server key tied to an approved IP and allows at most 10 token IDs per call.

Set `STRAC_API_KEY` and run the server with `uvx strac-mcp-dlp`. Without that key, it cannot call Strac. `STRAC_API_BASE` and `STRAC_API_TIMEOUT` are available as client environment settings when required.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `STRAC_API_KEY`, `STRAC_API_BASE`, `STRAC_API_TIMEOUT` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env STRAC_API_KEY=<STRAC_API_KEY> --env STRAC_API_BASE=<STRAC_API_BASE> --env STRAC_API_TIMEOUT=<STRAC_API_TIMEOUT> --transport stdio strac-mcp-dlp -- uvx strac-mcp-dlp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from strac-mcp-dlp <command>

### Codex

**Platform CLI**
```bash
codex mcp add strac-mcp-dlp --env STRAC_API_KEY=<STRAC_API_KEY> --env STRAC_API_BASE=<STRAC_API_BASE> --env STRAC_API_TIMEOUT=<STRAC_API_TIMEOUT> -- uvx strac-mcp-dlp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from strac-mcp-dlp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "strac-mcp-dlp": {
            "command": "uvx",
            "args": [
                "strac-mcp-dlp"
            ],
            "env": {
                "STRAC_API_KEY": "<STRAC_API_KEY>",
                "STRAC_API_BASE": "<STRAC_API_BASE>",
                "STRAC_API_TIMEOUT": "<STRAC_API_TIMEOUT>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from strac-mcp-dlp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "strac-mcp-dlp": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "strac-mcp-dlp"
            ],
            "env": {
                "STRAC_API_KEY": "<STRAC_API_KEY>",
                "STRAC_API_BASE": "<STRAC_API_BASE>",
                "STRAC_API_TIMEOUT": "<STRAC_API_TIMEOUT>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from strac-mcp-dlp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e STRAC_API_KEY=<STRAC_API_KEY> -e STRAC_API_BASE=<STRAC_API_BASE> -e STRAC_API_TIMEOUT=<STRAC_API_TIMEOUT> strac-mcp-dlp uvx strac-mcp-dlp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from strac-mcp-dlp <command>

## When to use it
- sanitize text before an agent receives it
- scan content for PII, PHI, PCI data, or secrets
- inspect a PDF, image, or scan with OCR
- save a redacted file without changing the source

## Example prompts
- Use Strac to remove sensitive values from this text before I send it to the ticket.
- Scan `./w2.pdf` with Strac and report the data categories you find without changing the file.
- Create a sanitised copy of `./config.yaml` and save it as `./config.redacted.yaml`.

## Similar
- [output-sanitizer](https://affpapa.org/en/nevibecode/skills/output-sanitizer.md) — skill · 475 installs
- [security-patterns](https://affpapa.org/en/nevibecode/skills/security-patterns.md) — skill · 731 installs
- [logging-best-practices](https://affpapa.org/en/nevibecode/skills/secondsky-logging-best-practices.md) — skill · 396 installs
- [yt-dlp](https://affpapa.org/en/nevibecode/skills/yt-dlp.md) — skill · 1600 installs
- [browser-extract](https://affpapa.org/en/nevibecode/skills/browser-extract.md) — skill · 697 installs
- [marketplace-health-check](https://affpapa.org/en/nevibecode/skills/marketplace-health-check.md) — skill · 389 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md