omitly-leak-check-mcp

A free, local MCP server that answers one question: did your PDF redactionactually work, or is the data still sitting in the file underneath the blackboxes?

Most tools "redact" by drawing a rectangle over text — the characters stay in thePDF and are trivially recoverable. This server re-extracts the text layer andflags any emails, SSNs, phone or card numbers that survived.

Zero install — npx omitly-leak-check-mcp. No native binary, no qpdf.
Nothing uploaded — the engine is a WebAssembly build of Omitly's detectorthat runs inside the MCP process. Your PDF never leaves the machine.
Masked — results show •••-••-6789, never the raw value.

Use with Claude

Add to your MCP client config (e.g. Claude Desktop claude_desktop_config.json):

{
  "mcpServers": {
    "omitly-leak-check": {
      "command": "npx",
      "args": ["-y", "omitly-leak-check-mcp"]
    }
  }
}

Then ask: "Did I actually redact /path/to/file.pdf?"

Tools

Tool	What it does
`check_redaction`	Audit a "redacted" PDF; report surviving PII (masked).
`find_sensitive_regions`	List PII candidates with page + coordinates.
`locate_text`	Find exact strings (names/addresses) and their positions.

All three are detect-only and read-only. They never modify a file.

This finds the problem. Omitly fixes it.

Detecting a leak is free. Removing the data for real — with independentverification that nothing survives, plus a signed audit log — is theOmitly desktop app. Detection is also pattern-based: names,addresses, and text inside scanned images aren't covered, so a clean result isnot a guarantee of completeness.

Develop

npm install && npm run build
npm run smoke -- /path/to/test.pdf   # prove the wasm loads + scans

The wasm in wasm/ is built from crates/leakcheck-wasm in the Omitly repo(wasm-pack build --target web).

omitly-leak-check-mcp