MCP Server PII Protection: Keep Data Private in Claude Desktop & Cursor

What is MCP Server and Why Does It Matter for Privacy?

The Model Context Protocol (MCP), introduced by Anthropic, is an open standard that lets AI assistants like Claude Desktop, Cursor, and VS Code Copilot call external tools mid-conversation. Instead of manually copying text into a separate anonymization app, MCP lets you type a single prompt — and the AI can route the data through your chosen tools as it works.

For privacy teams, this is transformative. With the anonym.legal MCP server, the assistant can pass your sensitive text to a tool, get a pseudonymized version back, continue working on that version, and restore the original values in the response. It is not an automatic filter: anything in the chat, including the text the assistant passes to the tool, has already reached the model.

What stays where: The MCP server calls the anonym.legal API over TLS, so the text is processed on our servers in Germany. Where it may not leave your machine, anonym.plus Enterprise runs a local MCP server instead.

The 9 MCP Tools for PII Protection

The MCP server, hosted at https://anonym.legal/mcp, exposes 9 tools. Besides the six below, anonym_legal_get_balance, anonym_legal_estimate_cost and anonym_legal_list_presets show your token balance, the cost of a request and the available presets:

1. anonym_legal_anonymize_text

Purpose: Replace detected PII with placeholder tokens (tokenize mode, the default) or remove it permanently (redact mode). In tokenize mode the mapping is stored on the server, encrypted, for later restoration.

Example prompt: "Anonymize the following support ticket before I send it for analysis: [paste text]"

2. anonym_legal_analyze_text

Purpose: Scan text and return the PII found without modifying the text. Useful for audits and risk assessment.

Example prompt: "Detect all PII in this log file and tell me what types are present."

3. anonym_legal_redact_image

Purpose: Redact or analyze PII in a PNG or JPEG image using OCR. Requires image redaction to be enabled on your account.

Example prompt: "Redact the personal data in this scanned form."

4. anonym_legal_detokenize_text

Purpose: Restore original values from placeholders, using the session ID from a previous anonymize call in tokenize mode. Completes the anonymize → process → de-anonymize cycle.

Example prompt: "De-anonymize the AI's response so I can send it to the actual customer."

5. The encrypt operator

Purpose: An option of the anonymize tool: replace PII with reversible encrypted tokens (AES) that can only be reversed with your key. The key is sent with the request and the server sees the text during this step.

Example prompt: "Encrypt all PII in this CSV before uploading to our data warehouse."

6. anonym_legal_list_sessions and anonym_legal_delete_session

Purpose: List the stored token mappings of your account and delete one before it expires (24 hours by default, 30 days if you choose persistent).

Example prompt: "Delete the token mapping from this morning's session."

Installation: JSON Configuration

The anonym.legal MCP server is hosted at https://anonym.legal/mcp (Streamable HTTP, included from the Pro plan), so nothing runs locally: add its URL and your API key to your Claude Desktop or Cursor configuration file. For Claude Desktop, the config lives at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows.

{
  "mcpServers": {
    "anonym-legal": {
      "type": "http",
      "url": "https://anonym.legal/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

In Claude.ai you can instead add https://anonym.legal/mcp as a custom connector under Settings → Connectors; the sign-in runs through OAuth. Other MCP clients that support remote HTTP servers take the same URL and header. Restart the AI assistant after saving.

Verifying the Installation

Once installed, type this prompt in Claude Desktop:

Use the anonymize tool to anonymize: "John Smith's email is john@acme.com and his SSN is 123-45-6789"

You should receive: "[PERSON_1]'s email is [EMAIL_1] and his SSN is [US_SSN_1]"

Workflow: Anonymize → Send to LLM → De-anonymize Response

The complete privacy-preserving workflow has three steps, each a separate tool call that a compatible client can chain from a single prompt:

Step 1 — User prompt:
"Anonymize the following patient note, then summarize it for a billing review,
then de-anonymize the summary."

Patient note: "Maria Rossi, DOB 12/03/1981, MRN 78234, was admitted for
chest pain. Her insurer is BlueCross policy #BC-9923. She lives at
42 Maple Street, Boston MA."

Step 2 — MCP anonymizes (internally):
"[PERSON_1], DOB [DATE_1], MRN [MRN_1], was admitted for chest pain.
Her insurer is [ORG_1] policy #[ID_1]. She lives at [ADDRESS_1]."

Step 3 — LLM summarizes the anonymized text (it continues with placeholders)

Step 4 — the assistant calls the detokenize tool on its output

A compatible MCP client can chain these steps in one turn; check this in your client, since the server does not enforce the sequence. Text you paste into the prompt itself reaches the model as written — to keep it from the model, anonymize it before it enters the chat.

Entity Presets: GDPR, HIPAA, Custom

Presets control which entity types the MCP server detects; anonym_legal_list_presets shows the ones available on your account. Choose the preset that matches your compliance requirement:

Real-World Use Cases

Code Review with Customer Data

Developers often paste database query results into Claude to debug issues. Without anonymization, real customer records — names, emails, account numbers — enter the LLM context. With the MCP server, the assistant can replace them with placeholders before working on them further; to keep them from the model entirely, anonymize them before pasting.

Prompt: "Anonymize this query result, then help me optimize the SQL that produced it."

Document Analysis for Legal Teams

Legal documents contain client names, case numbers, financial amounts, and dates. Anonymize before asking Claude to summarize or extract key terms. De-anonymize the output before sending to the client.

API Debugging with Production Logs

Production logs frequently contain PII in request payloads, headers, and error messages. Detect and redact PII before pasting logs into Cursor for debugging assistance.

Prompt: "Detect PII in this API log, then help me find the 500 error root cause."

Customer Data Processing Pipelines

For teams building data pipelines with AI-assisted code generation, use the encrypt operator to pseudonymize sample data used during development. The actual schema and processing logic remain visible; personal values are replaced with encrypted tokens.

What the Server Sees: How It Works in the MCP Context

In the MCP context, three things matter:

1. Your API key authenticates the request — the anonym.legal API processes the text over TLS and returns anonymized output. Text is processed in memory. It is stored, encrypted, only if you turn on history, or as a token mapping for reversible anonymization (24 hours by default, up to 30 days if you choose persistent).
2. The mapping table is stored on the server, encrypted — in tokenize mode the entity-to-placeholder mapping is kept for 24 hours by default (30 days if you choose persistent), and the list-sessions and delete-session tools let you manage it. With the e2e_mode option the server returns text positions instead, so your client can keep the mapping itself.
3. The model sees what is in the chat — the assistant has to pass text to the tool, so that text has already reached the model; the tools keep identifiers out of what the assistant works on from there, and restore them in the reply. The hosted service does read the text in order to detect; if it may not be read at all, the same MCP interface is available from the local client, where nothing is sent anywhere.

So the MCP tools limit where identifiers travel after the tool call; they are not a shield between your chat and the model.

Compliance: GDPR and EU AI Act Article 10

Using the MCP Server can support two legal requirements; it does not by itself establish compliance with either:

GDPR Article 25 (Privacy by Design): Routing AI workflows through an anonymization layer can be one technical measure supporting data minimization and privacy by design.

EU AI Act Article 10 (Data Governance): Article 10 requires that training and validation data used in high-risk AI systems be subject to "appropriate data governance practices." It concerns the training, validation and testing data of high-risk AI systems rather than everyday prompts; anonymized data can be one part of the data governance it requires.

Limitations & Honest Caveats

An MCP anonymization layer protects the text that flows through it — and nothing else. Its limitations are worth stating plainly: it cannot see data pasted into a personal phone, a screenshot, or any channel that bypasses the server, so it is a control, not a perimeter. Detection is never perfect, so treat the residual miss-rate as a risk to manage rather than zero. And it is not for workflows that need the real values returned downstream — there, reversible encryption with strict key control is the better choice than redaction. The drawbacks are operational, not fatal: pair the layer with clear policy and user training.

Sources

• Model Context Protocol specification, version 2026-07-28 (modelcontextprotocol.io), read 2026-10-26
• Regulation (EU) 2016/679 (GDPR) (EUR-Lex), read 2026-10-26
• Regulation (EU) 2024/1689 (AI Act) (EUR-Lex), read 2026-10-26