PrivacyOps

Made by Seaynic Labs. Need tools like this built around your own systems? We do that.

PrivacyOps lets an AI assistant track your credit-report disputes and draft dispute letters, with every record kept in a file on your own computer. It works out the statutory response deadline for each open dispute, and it ships skills that walk you through a dispute from gathering facts to following up.

Not legal advice. PrivacyOps is a tracking and drafting aid. It does not know your facts or the law in your state. The letter templates have not been reviewed by a lawyer. For legal questions, ask a lawyer or a consumer-protection agency.

Security card
Network	None. PrivacyOps makes no outbound network calls and has no telemetry. Only --transport http opens a listener, on 127.0.0.1 unless you change --host.
Files	Reads its config file (~/.config/privacyops/config.toml, if present). Reads and writes its records file and letter text files in its data folder (~/.local/share/privacyops), owner-only. Appends one line per approval decision to ~/.local/state/privacyops/approvals.jsonl (ids only).
Secrets	PrivacyOps stores no passwords or API keys and has no tool that takes one. It never asks for a Social Security number.
Read-only tools	5: disputes_list, disputes_get, disputes_deadlines, letters_templates, privacyops_modules
Writes on this computer	disputes_create, disputes_update, letters_generate: local files only, no approval needed. Each dispute change is recorded in its history.
Needs your approval	disputes_delete: you approve each delete in your app, or pre-approve in settings. The AI cannot approve for you.
Startup cost	about 6,000 tokens (9 tools, 2 skill prompts)
Changes	Tool descriptions are locked by hash (tool-manifest.lock.json); CI fails if they change silently.

It is a bundle: tools, skills and instructions in one install. The tools are one server made of modules. You switch on the modules you use. New modules arrive switched off, so an update never changes what your assistant can do until you choose to.

Module	What it does	Status
disputes	Track disputes with consumer reporting agencies (Equifax, Experian, TransUnion) and with furnishers (the companies that report to them): status, sent dates, response deadlines, and a history of changes	0.2
letters	Dispute letters from two fixed templates, saved as text files on your computer	0.1

Planned, not built: data-broker opt-outs and credit-freeze tools. These are ideas, not commitments.

Audience: consumers who want their own record of disputes and clear letters. PrivacyOps is not for lawyers, credit repair businesses, or anyone handling other people's identity information.

Skills

Skills are short guides your assistant reads before it does a job. PrivacyOps ships two, in two forms from one source: a skills/ folder for apps that read Agent Skills (Claude Code and others), and MCP prompts for every other MCP app.

Skill	What it covers	By
getting-started	Setup, the data folder, settings, --doctor, and reading errors	Seaynic Labs, MIT
dispute-walkthrough	Gathering facts, choosing the agency or company route, certified mail, deadlines, follow-up, and when to get help	Seaynic Labs, MIT

No third-party skills ship with PrivacyOps. See CREDITS.md.

What stays on your computer

• Dispute records are kept in one JSON file in your data folder. Default: ~/.local/share/privacyops/privacyops.json. Set PRIVACYOPS_DATA_DIR to choose another folder.
• Letters are saved as Markdown text files in letters/ inside that folder.
• Approval decisions for deletes are appended to ~/.local/state/privacyops/approvals.jsonl: ids and decisions only.
• Nothing is sent to Seaynic Labs or to any other service. PrivacyOps makes no outbound network calls.
• The files are created readable only by you (mode 0600), but they are not encrypted. Anyone with access to your account can read them. Keep the folder out of shared or synced folders you do not control.
• Your AI assistant can see what you type into the chat, and so can the company that runs it. PrivacyOps cannot change that.

PrivacyOps never asks for a Social Security number. If a bureau asks for identifying numbers, you write them in by hand on the printed letter.

Install

PrivacyOps needs Python 3.11 or newer. With uv you do not install anything ahead of time:

uvx privacyops-mcp --version
uvx privacyops-mcp --doctor          # checks your data folder and records, prints fixes

Pin the exact version if you want updates only when you choose them: uvx privacyops-mcp==0.2.0.

Or with pip:

pip install privacyops-mcp

As a Claude Code plugin (server and skills in one step, once the seayniclabs/plugins marketplace lists PrivacyOps):

/plugin marketplace add seayniclabs/plugins
/plugin install privacyops@seayniclabs

Uninstalling with pip uninstall privacyops-mcp removes the program only. Your records and letters stay in the data folder. Delete that folder yourself if you want them gone.

Settings

PrivacyOps starts without any settings. The defaults are safe.

Variable	Module	What it does
PRIVACYOPS_DATA_DIR	all	Folder for your records and letters. Default ~/.local/share/privacyops
PRIVACYOPS_DISPUTES_ALLOW_DELETE	disputes	false by default: you approve each delete. true lets the assistant delete a dispute record without asking.
PRIVACYOPS_APPROVAL_LOG	all	Path of the approval log. Default ~/.local/state/privacyops/approvals.jsonl
PRIVACYOPS_<MODULE>_ENABLED	any	false turns a module off, e.g. PRIVACYOPS_LETTERS_ENABLED=false

Config file (optional). PrivacyOps also reads ~/.config/privacyops/config.toml, or the file named by PRIVACYOPS_CONFIG. Environment variables win over the file.

data_dir = "/Users/you/Documents/privacyops"

[disputes]
allow_delete = false

[letters]
enabled = true

Add it to your MCP client

Most clients use the same JSON shape. Put it where your client keeps MCP servers:

{
  "mcpServers": {
    "privacyops": {
      "command": "uvx",
      "args": ["privacyops-mcp"],
      "env": {
        "PRIVACYOPS_DATA_DIR": "/Users/you/Documents/privacyops"
      }
    }
  }
}

Client	Where the config goes
Claude Desktop	claude_desktop_config.json (Settings → Developer → Edit Config)
Claude Code	claude mcp add privacyops -- uvx privacyops-mcp, or a project .mcp.json
Cursor	~/.cursor/mcp.json, or .cursor/mcp.json in a project
VS Code	.vscode/mcp.json, using "servers" instead of "mcpServers"
Sonique, Hermes, OpenClaw, others	Any client that launches a stdio MCP server: command uvx, args ["privacyops-mcp"], plus the env values

Over HTTP. For clients that connect to a URL instead of launching a process:

privacyops-mcp --transport http --port 8765

It serves streamable HTTP at http://127.0.0.1:8765/mcp and listens only on your own machine by default. Put authentication in front of it before exposing it anywhere else.

Try these

Paste one into your assistant once PrivacyOps is set up:

1. "Open a dispute with Experian about a late payment I made on time, and draft the letter. Don't send anything yet."
2. "Which of my disputes are overdue, and what should I do next?"
3. "Walk me through disputing an item on my credit report, one step at a time."
4. "Show me where my dispute records are stored and what the file contains."
5. "Delete the dispute for the card issuer, but show me the preview first."

Tools

Tool	What it returns
privacyops_modules	Which modules are on, what each tool does, where your data is, the skills, and the disclaimer. Call this first.
disputes_list	Dispute summaries, filtered by status or party type, paged with offset
disputes_get	One dispute with its details, due date, letters written, and history
disputes_deadlines	Open disputes with the statutory response deadline for each, days remaining, an overdue flag, the next action, and the facts it cannot know
disputes_create	Starts tracking a dispute
disputes_update	Changes status, sets the sent date, or adds a note. Every change goes into the history.
disputes_delete	Deletes a dispute record. Preview first; you approve it. Letter files are not deleted.
letters_templates	The templates, the agencies with checked contact details, and the disclaimer
letters_generate	Writes a letter to a text file. Attaches it to a dispute if you give its id.

Every tool returns structured data with a published schema. Errors read privacyops.<module>.<code>: <message> Fix: <hint>.

Response deadlines

disputes_deadlines counts the periods that the statute sets, from the sent date you record:

• Consumer reporting agency: the agency must reinvestigate within 30 days of receiving your dispute, 15 U.S.C. 1681i(a)(1)(A). It may extend that by up to 15 days only if you send relevant information during the 30 days, and not if it finds the item inaccurate or cannot verify it in that period, 1681i(a)(1)(B)–(C). Source: https://www.law.cornell.edu/uscode/text/15/1681i
• Furnisher (the company that reported the item): a direct dispute must be investigated and answered before the period in 1681i(a)(1) ends, 15 U.S.C. 1681s-2(a)(8)(E)(iii). A dispute an agency forwards follows 1681s-2(b)(2). Source: https://www.law.cornell.edu/uscode/text/15/1681s-2

The tool counts from your sent date. The statute counts from the day the other side receives the dispute, so the real deadline is the same or later. The tool does not know when the letter arrived, whether you sent extra information, or which route a furnisher dispute took, so it says so in each row instead of guessing. The periods were checked against the official text on 2026-10-27.

Letter templates and sources

Both templates are fixed text. Nothing is generated by a model. Each citation was checked against the official statute text on 2026-10-27.

Template	Used for	Cites (15 U.S.C.)	Source
cra_dispute	Asking a consumer reporting agency to reinvestigate an item	1681i(a)(1)(A), (a)(5)(A), (a)(6)(A), (a)(7)	https://www.law.cornell.edu/uscode/text/15/1681i
furnisher_dispute	Disputing directly with the company that reported the item	1681s-2(a)(8), (a)(8)(D), (a)(8)(E)	https://www.law.cornell.edu/uscode/text/15/1681s-2

Contact details are included only where the agency's own site was checked on 2026-10-27:

Agency	Mailing address in letters	Online disputes	Checked
Equifax	Not published on the official page: fill in by hand	https://www.equifax.com/personal/credit-report-services/credit-dispute/	2026-10-27
Experian	Experian, Dispute by Mail, P.O. Box 4500, Allen, TX 75013	https://www.experian.com/disputes/main.html (sign-in required)	2026-10-27
TransUnion	Not verified (the official page returned an error when checked): fill in by hand	Not verified: fill in by hand	not checked

Check any address against the agency's own website before you mail a letter. Agencies change their addresses.

Safety

• PrivacyOps makes no outbound network calls and sends nothing anywhere.
• Deleting a dispute record asks you first, through your MCP client's approval prompt. The assistant cannot approve on your behalf. Some clients cannot show approval prompts. In those, deletes are refused unless you set PRIVACYOPS_DISPUTES_ALLOW_DELETE=true.
• Every delete decision (asked, approved, declined, refused) is appended to the approval log with the dispute id. The log never holds names, item text, reasons, notes or letter text.
• Writes never delete other records. A failed save leaves the previous file unchanged, and an unreadable file is never overwritten.
• The disclaimer appears in the server's instructions, in privacyops_modules, in every skill, and in every letter's footer.

Check your setup

uvx privacyops-mcp --doctor

Doctor reads your data folder, records file, letter folder and approval log. It prints ok or FIX for each item, with the step to take, and exits 1 when something needs fixing. It makes no network calls and changes no files.

Develop

uv venv -p 3.11 && uv pip install -e '.[dev]'
.venv/bin/pytest
python3 scripts/check_skills.py
.venv/bin/python scripts/tool_lock.py --check
.venv/bin/python scripts/security_card.py --check

The tests use temporary data folders and make no network calls. scripts/tool_lock.py (without --check) rewrites the lock after a deliberate change to a tool, prompt or the instructions. Add a changelog line in the same change.

Security

Report a vulnerability privately through GitHub (Security tab, "Report a vulnerability"). See SECURITY.md.

License

MIT. Published by Seaynic Labs.

---

Built by Seaynic Labs. We build tools like this around a business's own systems: local-first, with a person approving every change. See custom integrations.