Tamperlens MCP server

tamperlens-mcp

MCP server for Tamperlens — ask whether a document was edited, whether its redactions held, and whether it is safe for a model to read, before it reaches your agent's context.

// Claude Desktop / Claude Code — claude_desktop_config.json or .mcp.json
{
  "mcpServers": {
    "tamperlens": {
      "command": "npx",
      "args": ["-y", "tamperlens-mcp"],
      "env": { "TAMPERLENS_API_KEY": "tl_..." }
    }
  }
}

No key is required to try it — without one you get the anonymous allowance of 10 documents an hour. A free key at tamperlens.com/account raises that to 50 a month with no card.

Tools

Accepts PDF; Word, Excel and PowerPoint (.docx, .xlsx, .pptx and the macro-enabled twins); and JPEG, PNG, WebP, HEIC/HEIF and AVIF.

A local path or a URL

inspectdocument, checkredaction and comparedocuments (as originalUrl/candidateUrl) take either a local path or an http/https url — not both. A url is fetched by this server, on your own machine, over your own network, and only the bytes are sent on to Tamperlens. That is why the option lives here and not on the REST API: a server-side fetch of a caller-supplied URL is an SSRF risk on the API host, whereas fetching from your machine reaches only what you can already reach. It is still guarded: http/https only (re-checked at every redirect), a redirect cap, a 30s timeout (TAMPERLENSFETCHTIMEOUTMS to tune), and the same 10 MB cap, enforced on the bytes received rather than a Content-Length that can lie.

It also checks the destination IP, not just the scheme: a url that points at — or redirects to, or resolves by DNS to — a loopback, link-local/metadata (169.254.169.254), private or otherwise non-routable address is refused, and the address it connects to is pinned to the one it validated, so DNS rebinding cannot slip an internal address past the check. The check re-runs at every redirect hop. If you genuinely need to fetch from an internal host, allow-list specific addresses with TAMPERLENSFETCHALLOW_IPS (comma-separated; empty by default, and the default reaches nothing internal).

Shortened. The full README is on GitHub.