Privacy-Scanner

Overview

Privacy-Scanner is an MPP-signed MCP tool for detecting personally identifiable information (PII), tracking identifiers, and compliance risks in data payloads, source code, API responses, and agent-generated content.

It runs entirely within a WASM sandbox. No data leaves the sandbox. Nothing is sent to external services.

Installation

mpp install @q2x/privacy-scanner

MCP Tools Provided

scanText

Scan a string for PII and privacy-relevant patterns.

Input:

{
  "text": "Contact John at john.smith@example.com or call +44 7700 900123",
  "regulations": ["GDPR", "CCPA"],
  "redact": true
}

Output:

{
  "findings": [
    {
      "type": "EMAIL_ADDRESS",
      "regulation": "GDPR",
      "severity": "HIGH",
      "value": "john.smith@example.com",
      "location": { "start": 17, "end": 39 },
      "redacted": "[EMAIL REDACTED]"
    },
    {
      "type": "PHONE_NUMBER_UK",
      "regulation": "GDPR",
      "severity": "HIGH",
      "value": "+44 7700 900123",
      "location": { "start": 49, "end": 64 },
      "redacted": "[PHONE REDACTED]"
    }
  ],
  "redactedText": "Contact John at [EMAIL REDACTED] or call [PHONE REDACTED]",
  "riskScore": 85
}

scanPayload

Scan a JSON object or array for PII across all fields and nested values.

Input:

{
  "payload": {
    "user": { "name": "Jane Smith", "email": "jane@example.com", "ssn": "123-45-6789" },
    "metadata": { "ip": "192.168.1.1" }
  },
  "redact": true,
  "regulations": ["GDPR"]
}

Output:

{
  "findings": [ ... ],
  "redactedPayload": {
    "user": { "name": "[NAME REDACTED]", "email": "[EMAIL REDACTED]", "ssn": "[SSN REDACTED]" },
    "metadata": { "ip": "[IP_ADDRESS REDACTED]" }
  },
  "riskScore": 95
}

scanCode

Scan source code for hardcoded PII, secrets, or data handling patterns that may violate privacy regulations.

Input:

{
  "code": "const userId = 'usr_john.smith@example.com'; ...",
  "language": "typescript",
  "checks": ["hardcoded_pii", "insecure_logging", "missing_consent_check"]
}

Output:

{
  "findings": [
    {
      "type": "HARDCODED_EMAIL",
      "severity": "MEDIUM",
      "line": 1,
      "description": "Email address hardcoded in source — should use environment variable or secrets manager",
      "regulation": "GDPR"
    }
  ]
}

assessCompliance

Produce a structured compliance assessment for a dataset or data flow description.

Input:

{
  "dataCategories": ["email", "ip_address", "purchase_history"],
  "processingPurposes": ["order_fulfilment", "marketing_analytics"],
  "storageDuration": "5_years",
  "transfersOutsideEEA": true,
  "regulations": ["GDPR"]
}

Output:

{
  "compliant": false,
  "issues": [
    {
      "article": "GDPR Art. 6",
      "description": "Marketing analytics requires explicit consent — no consent mechanism specified",
      "severity": "HIGH"
    },
    {
      "article": "GDPR Art. 46",
      "description": "Transfers outside EEA require an appropriate safeguard (SCCs, adequacy decision, or BCRs)",
      "severity": "HIGH"
    }
  ],
  "recommendations": [ ... ]
}

Detection Patterns

Privacy-Scanner detects the following PII types:

Category	Examples
Identity	Full name, date of birth, national ID, passport number
Contact	Email address, phone number, postal address
Financial	Credit card number, bank account, IBAN, sort code
Health	NHS number, medical record identifiers
Digital	IP address, MAC address, cookie identifier, device ID
Credentials	API keys, OAuth tokens, password hashes
UK-specific	NI number, UK driving licence, UK postcode
US-specific	SSN, EIN, US driving licence

Regulation Profiles

Profile	Description
GDPR	EU/UK General Data Protection Regulation
CCPA	California Consumer Privacy Act
HIPAA	US Health Insurance Portability and Accountability Act
PCI_DSS	Payment Card Industry Data Security Standard
UK_DPA_2018	UK Data Protection Act 2018

Capability Manifest

Privacy-Scanner requires no network access or filesystem writes:

{
  "capabilities": {
    "filesystem": {},
    "network": {},
    "env": []
  }
}

All scanning is performed in-process within the WASM sandbox.

Changelog

v2.0.0 — assessCompliance method, HIPAA and PCI_DSS profiles, UK-specific patterns v1.5.0 — scanCode method, TypeScript/Python/Go language support v1.2.0 — scanPayload nested JSON scanning, redaction mode v1.0.0 — Initial release with scanText, GDPR/CCPA profiles