Phi Guard Mcp

Name: Phi Guard Mcp
Author: LLM Mart

No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.

A local-first MCP server that catches PHI (protected health information) flowing into LLM prompts, log statements, and analytics calls — in your source code, before it ships.

The server itself makes no network calls: it runs as a local stdio process and never uploads your code. What it returns is a different matter. Findings go back to whatever MCP client launched it, so if that client is a hosted assistant, the findings enter that model's context. Matched PHI values are masked out of results by default for exactly this reason — see Security boundary.

Why

The risky moment in a healthcare codebase is rarely the database. It's the line where a patient record gets interpolated into a prompt, a console.log, or an analytics event. Those lines look harmless in review and never show up in infrastructure scanning, because nothing is misconfigured — the code is just doing what it says.

Demo

scan_code flagging a patient name and diagnosis passed into an openai.responses.create call, then redact_suggest returning a masked result

Eleven seconds of the walkthrough: scan_code flags line 15 — a patient name and diagnosis interpolated into an openai.responses.create call — and redact_suggest masks the same values out of a raw prompt. Every value shown is synthetic.

A linter for one class of mistake. Not a HIPAA certification, not a compliance attestation, and not a dataflow analyzer — see What this is NOT.

Install

Requires Node.js 22 or newer. The entrypoint uses JSON import attributes (with { type: "json" }), so older runtimes will not start it. Verified on Node 22.18.0, 24.2.0, and 26.8.2; Node 20 and below are unsupported and untested.

From npm (recommended)

Nothing to clone or build. Your MCP client runs it on demand:

npx -y phi-guard-mcp --version

From source

git clone https://github.com/Abidit/phi-guard-mcp.git
cd phi-guard-mcp
npm ci

npm ci runs the prepare script, which builds dist/. There is no separate build step to forget. npm install works too; npm ci is the reproducible one because it installs exactly what package-lock.json pins.

MCP configuration

Copy-paste one of the following. The npm form needs no paths and is the one to hand to someone else.

Claude Code

One command, project scope:

claude mcp add phi-guard -- npx -y phi-guard-mcp

Or commit a .mcp.json at your project root:

{
  "mcpServers": {
    "phi-guard": {
      "command": "npx",
      "args": ["-y", "phi-guard-mcp"]
    }
  }
}

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows:

{
  "mcpServers": {
    "phi-guard": {
      "command": "npx",
      "args": ["-y", "phi-guard-mcp"]
    }
  }
}

Cursor

.cursor/mcp.json in the project, or ~/.cursor/mcp.json globally:

{
  "mcpServers": {
    "phi-guard": {
      "command": "npx",
      "args": ["-y", "phi-guard-mcp"]
    }
  }
}

Running a local clone instead of the npm release

Point the client at the build output. Use an absolute path unless you are certain your client launches the server with the project root as its working directory:

{
  "mcpServers": {
    "phi-guard": {
      "command": "node",
      "args": ["/absolute/path/to/phi-guard-mcp/dist/index.js"]
    }
  }
}

The .mcp.json committed in this repo uses the relative form (dist/index.js) so the repo can dogfood its own server after npm ci.

Whichever form you use: restart the client, or run /mcp in Claude Code and reconnect phi-guard. A rebuild alone will not reach an already-running stdio process.

Why