Privacy tools and resources

Section 14 · From docs/MCP_PRIVACY.md on GitHub

All are in category privacy and reach the policy through ctx.layer.policy.

Primitive	Sensitivity	Purpose
privacy_status	internal	The policy as the caller sees it.
preview_transform	internal	Run the policy over sample data.
list_detectors	public	Detectors, key rules and the strategy each gets.
privacy_audit_log	restricted	Recent decisions from the ring buffer.
reveal_token	restricted, capability reveal	Reverse pseudonyms.
cloudg://policy	internal	policy.describe().
cloudg://privacy/detectors	public	Same as list_detectors without a filter.

privacy_status() returns the policy name, description, loaded_from, extends chain, the caller's id and roles, the sensitivity ceiling, the effective denied capabilities, how many tools the caller can see, each step of the generic output pipeline (the redactor lists its active detectors and key rules), whether pseudonymisation is on with the vault scope, entry counts per entity type and key source, whether auditing is on, and the decision counters (allowed, denied, rate_limited, rejected, hidden, reveal). Under a strict-based policy with a persisted vault, abridged:

{
  "policy": "strict-persist",
  "extends": ["standard", "strict"],
  "principal": {"id": "local", "roles": ["default", "local"]},
  "max_sensitivity": "confidential",
  "denied_capabilities": ["cloud_access", "exec", "reveal", "write_fs"],
  "visible_tools": 61,
  "output_pipeline": [
    {"type": "sanitize"},
    {"type": "redact", "default": "keep",
     "strategies": [{"applies_to": "secret", "strategy": "redact"},
                    {"applies_to": "private_key", "strategy": "drop"},
                    {"applies_to": "credential", "strategy": "redact"},
                    {"applies_to": "identifier", "strategy": "pseudonymize"},
                    "..."],
     "active_detectors": ["cloudg_uri", "private_key", "jwt", "..."],
     "key_rules": ["sensitive_key", "account_id_key", "..."],
     "min_confidence": 0.0, "pseudonymize_allowed": true},
    {"type": "project"},
    {"type": "annotate"}
  ],
  "pseudonymisation": {"active": true, "vault_scope": "global", "vault_entries": 8,
                       "by_entity": {"aws_account_id": 1, "aws_arn": 1, "cloudg_uri": 2, "dataset_name": 1,
                                     "person": 1, "resource_name": 2},
                       "key_source": "env"},
  "audit_enabled": false,
  "counters": {"allowed": 1}
}

Strategy tables are lists of {"applies_to", "strategy", "options"} items, here and in cloudg://policy, not mappings. Entity names such as secret and credential would otherwise be dict keys, and the caller's own redactor would treat them as sensitive field names.

preview_transform(data, tool=None, parse_json=True) runs the generic pipeline, or a tool's pipeline when tool is given, over data (any JSON value, or a JSON string when parse_json is true) and returns {"policy", "tool", "transformed", "report"}. It issues pseudonyms like any call, and it never reverses a pseudonym you paste into it. Same sample under two profiles:

{"account": "123456789012", "arn": "arn:aws:iam::123456789012:role/deploy",
 "note": "password=Tr0ub4dor&3 and key AKIAIOSFODNN7EXAMPLE",
 "cidr": "0.0.0.0/0", "ip": "10.20.30.40", "owner": "bob@example.com"}

Field	standard	strict
account	123456789012	192604312079
arn	arn:aws:iam::123456789012:role/deploy	arn:aws:iam::192604312079:role/res-24015814c5
note	password=[REDACTED:password] and key AKIA************MPLE	password=[REDACTED:password] and key [REDACTED:aws_access_key_id]
cidr	0.0.0.0/0	0.0.0.0/0
ip	10.20.30.40	10.42.77.177
owner	bob@example.com	user-47a5813e@d-91ebcaa6b8.example

The strict report: "pseudonymized": {"aws_account_id": 1, "aws_arn": 1, "private_ip": 1, "email": 1}, "redacted": {"password": 1, "aws_access_key_id": 1}.

list_detectors(category=None) is described in section 12.4.

privacy_audit_log(limit=50, decision=None) returns {"policy", "audit_enabled", "total", "entries"} with the most recent limit entries (1 to 1000), optionally only allowed, denied or rate_limited. The entries are described in section 15.1.

reveal_token(token) reverses one pseudonym, or every pseudonym inside a text of up to 20,000 characters. For an exact pseudonym it returns {"pseudonym", "found": true, "value", "entity_type"}; for text, or for a value that contains aliases, {"pseudonym", "found", "value", "replaced"} with the number of replacements; when nothing is found found is false and value null. It needs the reveal capability, and with the built-in profiles that means: never under strict, roles admin and privacy-admin under the standard family, and lead under soc-analyst. It is rate limited (30 per minute per principal in standard, 20 per hour for lead), logged twice on cloudg.mcp.audit (section 15.1), and it only reverses within the caller's namespace. Aliases from the caller's output pipeline (such as soc-analyst's account names) are reversed along with the pseudonyms, and the result skips the alias step, so the real value is returned as is. Measured responses are in section 8.3.

cloudg://policy returns describe(): the configuration with transform specs normalised, secret-looking option values (keys ending in key, secret, password, token) shown as ***, the vault settings and statistics with key_configured but never the key, loaded_from, the extends chain, the effective denied capabilities, the counters and the available profile names. policy_fingerprint(policy) gives a 16-hex hash of the configuration (vault excluded) to compare deployments.