Ocultar Pii MCP server

Ocultar

Ocultar is an open-source local PII/PHI masking engine for AI workflows.

It runs as a local HTTP sidecar. Send it text before it reaches a cloud LLM; it returns the same text with every piece of personal data replaced by a deterministic, reversible token ([EMAIL9c8f7a1b], [PERSON3a12b4cd], …). Originals are encrypted and stored in a local vault. Callers with the auditor token can restore them.

No PII ever reaches the upstream model.

Quick start — Docker

export OCU_MASTER_KEY=$(openssl rand -hex 32)
export OCU_SALT=$(openssl rand -hex 16)
export OCU_AUDITOR_TOKEN=$(openssl rand -hex 24)

docker run --rm -p 4141:4141 \
  -e OCU_MASTER_KEY \
  -e OCU_SALT \
  -e OCU_AUDITOR_TOKEN \
  ghcr.io/ocultar-dev/ocultar:latest -serve 4141

Quick start — build from source

CGO_ENABLED=1 go build -o ocultar ./services/refinery/cmd/

OCU_MASTER_KEY=$(openssl rand -hex 32) \
OCU_SALT=$(openssl rand -hex 16) \
OCU_AUDITOR_TOKEN=$(openssl rand -hex 24) \
./ocultar -serve 4141

API reference

GET /api/health

Returns engine status. No authentication required.

{
  "status": "healthy",
  "version": "1.14",
  "vault": { "status": "online" },
  "slm":   { "status": "online", "circuit": "closed" }
}

POST /api/refine

Mask PII in text or JSON. No authentication required.

Request body: raw text string or any JSON value.

Response:

{
  "refined": "{\"message\":\"Hello [PERSON_3a12b4cd], your order [EMAIL_9c8f7a1b] is ready.\"}",
  "report": {
    "hits": 2,
    "types": ["PERSON", "EMAIL"]
  }
}

refined is a JSON-encoded string — parse it once to get the masked payload.

POST /api/reveal

Restore vault tokens back to originals.

Authentication: Authorization: Bearer header required. Returns 403 if OCUAUDITORTOKEN is not set on the server.

Request body:

{ "tokens": ["[PERSON_3a12b4cd]", "[EMAIL_9c8f7a1b]"] }

Response:

{
  "results": {
    "[PERSON_3a12b4cd]": "Alice Martin",
    "[EMAIL_9c8f7a1b]": "alice@example.com"
  }
}

GET /api/entities · POST /api/entities · POST /api/entities/seed

Manage the persistent entity registry (pre-seed canonical names so all variants map to the same token). Requires Authorization: Bearer .

Architecture

Ocultar runs two detection tiers before any text leaves the machine:

Tier 1 — Deterministic regex / heuristics (fast, zero-egress)

Tier 2 — SLM-based NER (higher recall, configurable endpoint)

Sends text to a local AI sidecar for named-entity recognition. The scanner is always initialized but produces no results unless a compatible sidecar is running at SLMSIDECARURL. Point it at a privacy-filter or llama.cpp instance to activate NER.

SLM_SIDECAR_URL=http://localhost:8085 ./ocultar -serve 4141

Shortened. The full README is on GitHub.