maskflow-mcp
A Model Context Protocol proxy that
wraps any MCP server and keeps PII out of your agent's tool traffic. It
masks PII in outbound tools/call arguments before they reach the backend
tool, and restores the originals in the results, with placeholders that
stay consistent for the whole agent run.
Agents routinely pass user PII (names, emails, PAN, Aadhaar, phone numbers) straight into third-party MCP servers as tool arguments. This proxy is a drop-in shim that stops the real values at the boundary. It runs MaskFlow's detection engine, so the Indian identifiers (Aadhaar, PAN, GSTIN, UPI, IFSC, ABHA, Indian names / addresses) are covered alongside the generic PII.
MIT, no gates, no telemetry.
Install
pip install maskflow-mcp
# or, no install:
uvx maskflow-mcp stdio --backend "npx -y @modelcontextprotocol/server-github"
Pulls fastmcp (the 2.x line, which does not bundle LLM vendor SDKs). The
first detection run downloads a small spaCy model; pass --patterns-only
to skip it.
Use it
stdio (Claude Desktop, most agents)
Point the agent at maskflow-mcp and give it the real server as --backend:
// claude_desktop_config.json
{
"mcpServers": {
"github": {
"command": "maskflow-mcp",
"args": ["stdio", "--backend", "npx -y @modelcontextprotocol/server-github",
"--pass-env", "GITHUB_TOKEN"]
}
}
}
Or wrap a server already defined in a config file:
maskflow-mcp stdio --config ./claude_desktop_config.json --backend-name github
HTTP
maskflow-mcp http --backend https://example.com/mcp --host 127.0.0.1 --port 9000
Options
| Flag | Default | Meaning |
|---|---|---|
--backend |
– | Backend command line, or a URL |
--config / --backend-name |
– | Read the backend from a Claude-Desktop-style JSON file |
--pass-env VAR |
– | Forward an env var to a stdio backend (repeatable) |
--min-confidence |
0.5 |
Detection threshold |
--patterns-only |
off | Skip the spaCy NER pass (faster; drops bare-name / address detection) |
--mask-tool-results |
off | Also mask PII the tool introduced in its result, not just unmask placeholders it echoed |
--session-ttl |
3600 |
Lifetime of a per-connection session |
What is masked
tools/call arguments are walked (string and numeric values only, keys
never) and masked through the connection's session. The result's text and
structured content is unmasked, restoring placeholders the tool echoed. By
default raw PII that the tool adds to a result passes through untouched;
--mask-tool-results masks that too, so the agent never sees it.
tools/list, prompts/*, and resources/* pass through unchanged
(resource content masking is not on by default).
PII safety
The token-to-value map lives in memory per connection and is never logged.
Only masked values cross the wire to the backend. See docs/mcp.md in the
MaskFlow repo for the design.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file maskflow_mcp-0.1.1.tar.gz.
File metadata
- Download URL: maskflow_mcp-0.1.1.tar.gz
- Upload date:
- Size: 11.9 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
629cce91e9e595df9a9fb9d34119ce4de2989165c069ce573ab10861ac5ae411
|
|
| MD5 |
a8a9bb3b7117d0cc5a6d7a2cb30a2df6
|
|
| BLAKE2b-256 |
29703963e424e5d39ca52debf4447778a5e09c27c922fa59a1b3b85d5920b23b
|
Provenance
The following attestation bundles were made for maskflow_mcp-0.1.1.tar.gz:
Publisher:
release-mcp.yml on maskflow/maskflow
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
maskflow_mcp-0.1.1.tar.gz -
Subject digest:
629cce91e9e595df9a9fb9d34119ce4de2989165c069ce573ab10861ac5ae411 - Sigstore transparency entry: 2742527020
- Sigstore integration time:
-
Permalink:
maskflow/maskflow@b1642aea17749630b0ff6760dc3b8acd35d0c0aa -
Branch / Tag:
refs/tags/mcp-v0.1.1 - Owner: https://github.com/maskflow
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release-mcp.yml@b1642aea17749630b0ff6760dc3b8acd35d0c0aa -
Trigger Event:
push
-
Statement type:
File details
Details for the file maskflow_mcp-0.1.1-py3-none-any.whl.
File metadata
- Download URL: maskflow_mcp-0.1.1-py3-none-any.whl
- Upload date:
- Size: 10.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
8636b3137de33b7ce420517fd5c7883b32041d331e6a749d1afa9f1bf6da71e9
|
|
| MD5 |
1393922915a2580f0034eb52d1efe650
|
|
| BLAKE2b-256 |
7fe264dd356cc515cfb9622d1b188c3b65eab232312c309db5fcb21044eb58ad
|
Provenance
The following attestation bundles were made for maskflow_mcp-0.1.1-py3-none-any.whl:
Publisher:
release-mcp.yml on maskflow/maskflow
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
maskflow_mcp-0.1.1-py3-none-any.whl -
Subject digest:
8636b3137de33b7ce420517fd5c7883b32041d331e6a749d1afa9f1bf6da71e9 - Sigstore transparency entry: 2742527034
- Sigstore integration time:
-
Permalink:
maskflow/maskflow@b1642aea17749630b0ff6760dc3b8acd35d0c0aa -
Branch / Tag:
refs/tags/mcp-v0.1.1 - Owner: https://github.com/maskflow
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release-mcp.yml@b1642aea17749630b0ff6760dc3b8acd35d0c0aa -
Trigger Event:
push
-
Statement type:
