Redact PDF MCP server

Redact PDF MCP server

An MCP server that permanently redacts PII from PDFs. Give an agent a PDF, get back a PDF with the sensitive text removed from the file — not covered with a black rectangle that anyone can select, copy, or delete.

Most "redaction" MCP servers scrub PII out of prompt text. This one takes a real document and returns a real redacted document.

claude mcp add redact-pdf -- npx -y redact-pdf-mcp

Then ask: "Redact the personal data in ~/Documents/contract.pdf".

Your data

You are sending the document the agent is meant to protect, so this comes first.

AI services used for OCR and PII detection run with content logging disabled, so document content is not retained or used for model improvement.

• Never used to train AI models — not ours, not Microsoft's, not anyone's. The Azure

The redacted output is kept for your account's retention window (14 days by default, configurable) and can be purged at any time with DELETE /v1/jobs/{job_id}.

• Processed in the EU and Switzerland on Microsoft Azure.
• Encrypted with TLS 1.2+ in transit and AES-256 at rest.
• The original is deleted after processing under the default ephemeral retention.

ISO 27018 certifications and is HIPAA-eligible under Microsoft's BAA. Redact PDF AI itself is not independently audited for these frameworks; it is built so legal, medical and finance teams can use it inside their own compliance posture.

• Certified infrastructure. Azure holds SOC 2 Type II, ISO 27001, ISO 27017 and

what the server does locally.

• The MCP server sends no telemetry of its own — see

Details: redact-pdf.ai/security · privacy policy

Why not let the agent redact it itself?

An agent can find names in text. It cannot make a PDF safe on its own:

underneath; anyone can select, copy or extract it. This server rasterizes each page and drops the text layer and metadata, so there is nothing left to recover.

• A black box is not a redaction. Drawing a rectangle over text leaves the text layer

runs first, in 100+ languages, then PII detection runs over what it read.

• Scans have no text to search. Contracts, IDs and statements are often images. OCR

pattern. The detector is purpose-built for PII, and your always-redact and never-redact lists cover the rest.

• Detection is a model, not a regex. Names, addresses and organizations do not follow a

Examples

Prompts that work as-is once the server is installed:

Shortened. The full README is on GitHub.