PriviTools
ESEN

When AI redacts your PDF, where does the file go?

By PriviTools Engineering —

The six data-redaction MCP servers split into two groups, three running on the user's machine and three sending the file to a third party, with a callout noting that none is simultaneously local, free and able to redact PDFs

You ask your assistant to strip the personal data out of a document before you share it. The assistant has a tool for that. The tool works. Nobody tells you whether the document left your computer.

MCP makes that question answerable without guesswork, because every server publishes its transport to a public registry. A server that declares remotes receives your data on someone else’s machine, necessarily. One that declares packages with stdio transport runs on yours. You don’t have to take anyone’s word for it: it’s in the metadata.

So we counted.

Method

We queried the official MCP registry on 16 August 2026:

GET https://registry.modelcontextprotocol.io/v0/servers?search=redact

The response returned 13 entries and no nextCursor — the set was exhausted. Keeping only the latest version of each server leaves 6 unique servers.

Each was classified by schema fields, never by the text of its description:

  • packages with no environment variable marked isRequired + isSecret → local
  • packages with a mandatory API key → bridge to a remote API
  • remotes only → remote

The script is published in the repository, and anyone can repeat the run:

node scripts/backlinks/mcp-registry-audit.mjs redact --json

Results

Server Architecture Scope Cost
com.pdf-redaction/pdf-redaction-mcp Remote PDF + PII Remote API
com.x402supply/pii-redact Remote Text only $0.02 per call
com.dyndns-server.noon-ai/face-blur-redaction-mcp Remote Image and video —
io.github.groupdocs-redaction/groupdocs-redaction-mcp Local Documents Commercial licence
io.github.nickjlamb/redacta-mcp Local Text only Free
io.github.r3352/redact-mcp Local Text only Free

Three of six run on your machine. The other three receive the content on a third-party server — not as a configuration option, but as the only architecture on offer.

The empty box

Of the six, two can handle personal data inside a PDF. One is remote. The other is local but requires a commercial licence; without it, it runs in evaluation mode.

Which means: there is currently no MCP server that is simultaneously local, free, and able to detect and redact personal data in PDF files. The two that are local and free work on plain text only. Anyone who needs to redact a PDF without it leaving their machine and without buying a licence has no option in the registry.

A second, narrower gap: none of the six recognises Latin American tax identifiers — RFC, CURP, RUC, CUIT, NIT, RUT — which are precisely the personal data that appear on invoices and case files across half a dozen countries.

The limits of this method, which are real

This measures declared architecture, not audited behaviour. It’s worth being explicit about what the count does not prove:

  1. A local package could open sockets anyway. The registry says how software is distributed, not what it does inside.
  2. A remote server is not automatically bad. For many tasks it’s the sensible choice, and some operators handle data more rigorously than an unencrypted laptop does.
  3. Descriptions were not audited. We found at least one case where the description speaks of on-device processing while the entry declares remote transport only; most likely the sentence describes the project’s web application rather than its MCP server.

What the count does prove is narrower and more useful: if a server declares only remotes, your file leaves your machine. That admits no nuance.

How to check it yourself, in two minutes

Declared architecture is verified by running the server with no network. If it still works, it wasn’t calling anywhere:

# Linux
unshare -rn node dist/index.js

# macOS or Windows, with Docker
docker run --rm --network none -v "$PWD":/app -w /app node:20 node dist/index.js

A server that needs the internet fails here immediately. It’s the cheapest test there is, and it works for any MCP server, not just redaction ones.

Data

The full dataset, with each server’s classification and a link to the original query, is in the repository as data/backlinks/mcp-redaccion-registro-2026-08-16.json. Reuse it and check it.

One caveat about the date: the registry changes weekly. These figures are from August 2026 and will not hold in two months. The script still will.

PriviTools publishes @privitools/mcp, one of the local servers in this category. It works on text, not PDFs: we don’t fill the empty box described above either. That seemed more honest than writing a survey we happened to win.

KEEP READING

A browser audit follows selected file bytes through the page and a Web WorkerHow to audit a browser-based file tool without trusting its privacy claimA reproducible checklist for checking whether a web tool sends selected file bytes, including canary data, Workers, dependencies, and honest exceptions.Illustration of local PDF processing for content redaction and trace cleanupHow to redact a PDF permanently: a black rectangle is not enoughCovering visible data does not remove it from a PDF. Learn the difference between hiding, redacting, rasterizing, and sanitizing before sharing a sensitive document.A file is processed between the interface and Web Workers inside a browser, without being sent to a processing serverYour files are not uploaded: how local processing works in PriviToolsWhat happens after you choose a file, what remains in your browser, what network traffic still exists on a website, and how we test the no-upload claim.