Skip to main content
Glama
dcl632

phi-guard-mcp

by dcl632
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

phi-guard-mcp

CI PyPI Python Release License

MCP server and CLI for detecting, redacting, and auditing PHI before medical text is sent to AI agents.

phi-guard-mcp is healthcare AI safety infrastructure, not a clinical product. It is a local, rule-based guardrail that helps developers identify PHI-like identifiers in plain text, redact them with stable placeholders, and produce audit-friendly JSON before content reaches an AI agent or MCP workflow.

Proof points for maintainers:

  • Synthetic benchmark with exact-match PHI finding evaluation.

  • Safe Harbor mapping audit fields for review workflows.

  • CI privacy gate that blocks PHI-like identifiers in maintained source and docs.

  • CLI, Python API, and MCP stdio tools sharing one stable JSON result model.

Important scope limits:

  • Not for diagnosis, treatment, triage, medical advice, or medication recommendations.

  • Not a HIPAA compliance guarantee and not a substitute for legal, privacy, or security review.

  • Not an FDA-regulated clinical decision support or device software function.

  • Do not test with real patient records. The examples in this repo are synthetic.

The project aligns its documentation vocabulary with HHS HIPAA de-identification concepts such as Safe Harbor and Expert Determination, while intentionally avoiding clinical decision support scope. See HHS de-identification guidance, FDA CDS guidance, and FDA device software functions.

Install

python -m pip install phi-guard-mcp

For local development:

python -m pip install -e ".[dev]"

Related MCP server: phi-redact-mcp

Quickstart

Scan a synthetic note:

phi-guard scan examples/synthetic_clinical_note.txt

Redact PHI-like identifiers:

phi-guard redact examples/synthetic_clinical_note.txt --out /tmp/synthetic_redacted.txt

Audit a note:

phi-guard audit examples/synthetic_clinical_note.txt

Validate text before it enters an AI agent:

phi-guard validate examples/synthetic_clean_note.txt

Run the synthetic benchmark:

phi-guard benchmark benchmarks/synthetic/cases --out benchmarks/synthetic-report.json

Run the repository privacy gate:

phi-guard gate --config .phi-guard.toml

All CLI commands output stable JSON for automation.

See docs/demo.md for a complete CLI and MCP transcript.

MCP Server

Run the stdio MCP server:

phi-guard-mcp

Available tools:

  • scan_phi(text)

  • redact_phi(text, mode="placeholder")

  • audit_deidentification(text)

  • validate_no_phi(text)

MCP tools return the same finding schema as the CLI, including safe_harbor_identifier.

Example MCP client config:

{
  "mcpServers": {
    "phi-guard": {
      "command": "phi-guard-mcp"
    }
  }
}

Python API

from phi_guard_mcp import audit_text, evaluate_benchmark, redact_text, scan_text, validate_no_phi

result = scan_text("Patient Name: Jordan Rivera, MRN: MRN-48291")
redacted = redact_text("Patient Name: Jordan Rivera, MRN: MRN-48291")
audit = audit_text("Patient Name: Jordan Rivera, MRN: MRN-48291")
validation = validate_no_phi("No identifiers are present in this synthetic note.")
benchmark = evaluate_benchmark("benchmarks/synthetic/cases")

What It Detects

The first release focuses on plain text and common PHI-like identifiers:

  • Names in clinical label contexts

  • Dates

  • Phone numbers

  • Email addresses

  • Address-like fragments

  • Medical record numbers

  • Social Security numbers

  • URLs and IP addresses

  • Medical facility names

  • Account, member, policy, and patient ID tokens

This is a deterministic heuristic engine. It favors transparent behavior and repeatable JSON over opaque model judgment.

Safe Harbor mapping is included as a review aid only. It does not make output HIPAA compliant and does not replace Expert Determination or legal review.

Project Docs

Development

python -m compileall -q src tests
python -m pytest -q
ruff check .
phi-guard gate --config .phi-guard.toml
python -m build
twine check dist/*

Available Tools

4 tools
audit_deidentificationB

Return an audit-oriented summary of PHI-like identifiers and limitations.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesPlain text to inspect.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It states 'audit-oriented summary,' hinting at a read-only operation, but fails to detail whether it modifies data, requires special permissions, or returns paginated results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that is concise. However, it could be slightly longer to cover key details without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema, the description should explain what the summary contains more precisely. Currently, it vaguely mentions 'PHI-like identifiers and limitations,' which is insufficient for an agent to anticipate the output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the parameter 'text' is described in the schema as 'Plain text to inspect.' The tool description adds no additional meaning beyond this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'return' and resource 'audit-oriented summary of PHI-like identifiers and limitations,' which differentiates it from sibling tools like 'redact_phi' (modification) and 'scan_phi' (detection). However, it does not explicitly contrast with 'validate_no_phi'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for auditing (e.g., compliance review) but does not specify when to prefer this tool over alternatives or provide exclusions. Sibling names offer some context, but no explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

redact_phiB

Detect and redact PHI-like identifiers with placeholders.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoRedaction mode.placeholder
textYesPlain text to inspect.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full burden but only states 'detect and redact with placeholders.' It does not disclose how detection works, what patterns are matched, whether the operation is destructive, or the format of the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence. It is front-loaded but could be slightly expanded to include behavioral details without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool that modifies data with no annotations or output schema, the description lacks completeness. It does not explain the redaction process, return value, or constraints. With three siblings, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters. The description adds no information beyond the schema; the parameters 'text' and 'mode' are already described adequately in the input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool redacts PHI-like identifiers with placeholders. This distinguishes it from siblings: audit_deidentification (auditing), scan_phi (scanning), and validate_no_phi (validating absence).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description does not mention prerequisites, preferred scenarios, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_phiB

Detect PHI-like identifiers and return structured findings.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesPlain text to inspect.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only states the tool's function without disclosing behavioral traits. It does not explicitly state that the tool is read-only or non-destructive, nor does it describe any side effects, limitations, or security considerations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no superfluous words. It is appropriately concise and front-loaded with the core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description lacks critical context. It does not describe what 'structured findings' look like, the types of PHI identifiers detected, or any constraints on the input text length or format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% since the single parameter 'text' is described in the schema ('Plain text to inspect.'). The description adds no additional meaning beyond the schema, achieving the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Detect PHI-like identifiers and return structured findings' clearly states the tool's action (detect) and resource (PHI-like identifiers), and distinguishes it from siblings like 'redact_phi' (redact) and 'validate_no_phi' (validate absence). The verb 'scan' in the name is supported.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided. The description does not mention when to use this tool vs alternatives (audit_deidentification, redact_phi, validate_no_phi), nor does it specify prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_no_phiB

Validate whether text has no detected PHI-like identifiers.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesPlain text to inspect.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description adds some value by indicating the tool checks for PHI-like identifiers but does not specify the output format (e.g., boolean, report) or behavior upon detection, limiting transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no waste, but it could be slightly more informative without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description fails to explain what the call returns. It also does not address when to use this validation versus scanning (scan_phi) for finding specific PHI items.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage for parameters is 100% with clear descriptions; the tool's description does not add meaning beyond the schema, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool validates whether text has no detected PHI-like identifiers, using a specific verb and resource. This distinguishes it from siblings like audit_deidentification, redact_phi, and scan_phi.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description does not mention conditions for use, exclusions, or comparison to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv0.1.1
    • First observedaudit_deidentification
    • First observedredact_phi
    • First observedscan_phi
    • First observedvalidate_no_phi
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.6/5.0
Disambiguation5/5

Each tool serves a distinct purpose: scanning, redacting, validating absence, and auditing. There is no overlap in function.

Naming Consistency4/5

Tools follow a verb_phi or verb_deidentification pattern, but 'audit_deidentification' uses a different noun than the others ('phi'), causing slight inconsistency.

Tool Count5/5

Four tools is appropriate for a focused PHI detection/redaction server. It covers key operations without excess.

Completeness4/5

The set covers detection, redaction, validation, and audit. A minor gap is the lack of a tool to manage or customize identifier patterns, but the core workflow is complete.

Maintenance

ActivityStale
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • phi-redact-mcp

    Rinava
    A
    license
    A
    quality
    A
    maintenance
    An MCP server that redacts PII/PHI from text before it ever reaches an LLM — self-hosted, fail-closed, and HIPAA-aware.
    3
    MIT

  • HealthClawGuardrails

    aks129
    A
    license
    A
    quality
    A
    maintenance
    Open-source guardrails between AI agents and FHIR clinical data — PHI redaction, immutable audit, step-up auth, tenant isolation. MCP server + OpenAI/Gemini adapters. A healthclaw.io project.
    29
    30
    MIT

  • wardcat-mcp

    oguzhantopcu0
    A
    license
    A
    quality
    B
    maintenance
    MCP server providing on-prem PII detection and anonymization tools (scan and is_sensitive) for AI agents, ensuring data stays local.
    4
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/dcl632/phi-guard-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server