Data Guard - PII, PHI, and Secret Redaction MCP Server

Data Guard is a deterministic security gateway that automatically intercepts and sanitizes sensitive data before it reaches AI models, logs, support tickets, or third-party APIs. Deployed as a stateless container inside your own AWS environment, it ensures confidential information never leaves your security boundary.

Data Guard provides five core tools:

list_detectors: Discovers available entity types, compliance policy packs, and redaction strategies.

scan_data: Locates sensitive values in a document and returns masked previews without altering the original input.

redact_data: Sanitizes sensitive information according to your selected policy and generates a secure audit receipt.

restore_data: Reverses AES-GCM encrypted redactions using your encryption key to recover the original values.

check_policy: Evaluates a document against compliance frameworks to issue a pass or fail result.

Detection relies on exact rules rather than statistical models. It validates payment cards, bank accounts, healthcare identifiers, credentials, and national identity numbers across ten countries using mathematical check digits and prefix matching. It uncovers sensitive terms hidden in free-text chat logs and support tickets, and selectively redacts structured formats like JSON, YAML, and CSV without breaking their schema.

Data Guard offers seven redaction strategies, including masking, reversible encryption, removal, labeling, and deterministic hashing for joinable analytics. Built-in policy packs cover HIPAA Safe Harbor, PCI-DSS, GDPR pseudonymization, and secrets scrubbing. Every operation produces an audit receipt containing entity counts, triggered rules, and input hashes without ever exposing raw values.