Privacy¶
The privacy tools let a caller see what the active policy does to its data. MCP_PRIVACY.md explains the profiles, transforms and the vault; this section covers the tool contracts. The examples ran under open, which has no transforms, except where noted.
privacy_status¶
Category privacy · sensitivity internal · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)
The active policy as it applies to the caller: policy, description, loaded_from (profile name or file), extends (inheritance chain), principal (id, roles), max_sensitivity, denied_capabilities, visible_tools, output_pipeline (one description per transform; the redact step lists its strategies as {applies_to, strategy, options} items), pseudonymisation (active, vault_scope, vault_entries, by_entity, key_source), audit_enabled and counters (allowed, denied, rate-limited, hidden and reveal decisions so far).
Arguments: none.
Called with the arguments below, privacy_status returned this structuredContent.
{
"policy": "open",
"description": "No transforms, no restrictions. Trusted local experiments only.",
"loaded_from": "profile:open",
"extends": [],
"principal": {
"id": "local",
"roles": [
"default",
"local"
]
},
"max_sensitivity": null,
"denied_capabilities": [],
"visible_tools": 74,
"output_pipeline": [],
"pseudonymisation": {
"active": false,
"vault_scope": "global",
"vault_entries": 0,
"by_entity": {},
"key_source": "random"
},
"audit_enabled": false,
"counters": {
"allowed": 190
}
}
preview_transform¶
Category privacy · sensitivity internal · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)
Runs the caller's output pipeline (or the pipeline of tool, when given) over sample data and returns policy, tool, transformed and report. A JSON string is parsed first unless parse_json is false. The tool's own result is exempt from transforms, so the preview is shown as produced. Pseudonyms in a preview come from a separate vault with a random key (Policy.preview_vault()), so they never match the pseudonyms in real results and a preview cannot be used to confirm which real value is behind one; nothing is stored. strict hides the tool.
| Argument | Type | Default | Constraints | Description |
|---|---|---|---|---|
data |
any | required | JSON value (object / array / string) or text to transform | |
tool |
string or null | null |
Preview with the pipeline of this tool (default: the policy's generic pipeline) | |
parse_json |
boolean | true |
Parse data as JSON when it is a JSON string |
Under open nothing changes:
Called with the arguments below, preview_transform returned this structuredContent.
{
"data": {
"arn": "arn:aws:iam::111111111111:role/app-role",
"password": "hunter2",
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
}
}
{
"policy": "open",
"tool": null,
"transformed": {
"arn": "arn:aws:iam::111111111111:role/app-role",
"password": "hunter2",
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
},
"report": {}
}
list_detectors¶
Category privacy · sensitivity public · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)
The sensitive-entity detectors (content patterns) and key rules (field-name patterns), each with the strategy the caller's policy applies (redact, mask, hash, pseudonymize, generalize, drop, keep), filtered by category when given. Under open there is no redaction transform, so no strategy is attached.
| Argument | Type | Default | Constraints | Description |
|---|---|---|---|---|
category |
string or null | null |
Only this category: secret, credential, identifier, network, pii, temporal, free_text |
Called with the arguments below, list_detectors returned this structuredContent.
{
"policy": "open",
"detectors": [
{
"name": "aws_access_key_id",
"entity": "aws_access_key_id",
"category": "credential",
"confidence": 0.99,
"description": "AWS access key IDs (long-term AKIA, temporary ASIA)",
"enabled": true
}
],
"key_rules": []
}
privacy_audit_log¶
Category privacy · sensitivity restricted · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)
Recent access decisions kept in memory by the policy: denials and rate-limit hits always, every call when the policy enables audit. Arguments appear as field names with keyed hashes, never values. Returns policy, audit_enabled, scope, total (after the decision filter) and the last limit entries. A caller with the admin or privacy-admin role sees every principal's entries (scope: "all"); anyone else sees only their own (scope: "own"). It is restricted: strict hides it, and soc-analyst shows it only to the lead role, whose sensitivity ceiling is restricted.
| Argument | Type | Default | Constraints | Description |
|---|---|---|---|---|
limit |
integer | 50 |
1..1000 | Most recent entries |
decision |
string or null | null |
Filter: allowed, denied or rate_limited |
Called with the arguments below, privacy_audit_log returned this structuredContent.
Under the soc-analyst profile for a principal with the lead role, after one reveal_token call. lead is neither admin nor privacy-admin, so it sees its own entries only:
{
"policy": "soc-analyst",
"audit_enabled": true,
"scope": "own",
"total": 2,
"entries": [
{
"ts": 1791555925.6701138,
"decision": "allowed",
"kind": "tool",
"name": "reveal_token",
"principal": "lee",
"roles": [
"lead"
],
"arguments": {
"token": "[REDACTED:sensitive_field]"
},
"reason": "reveal"
},
{
"ts": 1791555925.674695,
"decision": "allowed",
"kind": "tool",
"name": "privacy_audit_log",
"principal": "lee",
"roles": [
"lead"
],
"arguments": {
"limit": "c4fdb6b794fd"
}
}
]
}
reveal_token¶
Category privacy · sensitivity restricted · capabilities reveal · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)
Reverses pseudonymisation: returns the real value behind a pseudonym, or replaces every pseudonym inside a longer text. It needs the reveal capability, which standard grants only to the admin and privacy-admin roles, soc-analyst to lead, and strict to nobody. Every call is logged on the cloudg.mcp.audit logger with a hash of the token, never the value. Returns pseudonym (the input), found, value, and entity_type for a direct hit or replaced (count) for text.
| Argument | Type | Default | Constraints | Description |
|---|---|---|---|---|
token |
string | required | min length 1; max length 20000 | A pseudonym (e.g. an account ID, ARN or IP from a result) or text containing pseudonyms |
Under open there is no pseudonym to reverse:
Called with the arguments below, reveal_token returned this structuredContent.
Under soc-analyst, an analyst called get_asset(ref="web-1") and received a pseudonymised name (the id, uri and edge names in the same result carry the same pseudonym); a lead then revealed it:
{
"args": {
"token": "res-661a5c1774"
},
"structured": {
"pseudonym": "res-661a5c1774",
"found": true,
"value": "web-1",
"entity_type": "resource_name"
},
"is_error": false,
"text": null
}
Revealing the ARN from the same result restores both parts: the instance id, from the vault, and the account. The soc-analyst profile replaces account 111111111111 with the alias prod-payments before pseudonymising; reveal_token maps the aliases of the caller's own output pipelines back as well, so replaced counts two substitutions: