Redacta — Disclosure Control for AI Agents | PharmaTools.AI

Disclosure control · Agents · Libraries · Self-hosted

Control what an AI agent is allowed to know.

Redacta replaces patient identifiers with labelled tokens, keeps the map that reverses them outside the model's context, and checks the text on the way out. Clinical meaning intact; the patient doesn't travel with it.

1,000+ installs · engine v1.4.0 · MCP v2.1.0 · MIT-0 license · DOI 10.5281/zenodo.21115605

Download on the App Store How it works

Input · raw clinical letter

Dear Mrs Patricia Hartley, DOB: 14/03/1952 (age 73), NHS Number: 943 476 5919. Following your recent review, your ferritin remains low and we recommend continuing oral iron.

Output · safe for AI

Dear [PATIENT_NAME], DOB: [DATE_OF_BIRTH] (age [AGE]), NHS Number: [NHS_NUMBER]. Following your recent review, your ferritin remains low and we recommend continuing oral iron.

Redaction report: 4 identifiers pseudonymised — 1 name, 1 date of birth, 1 age, 1 NHS number. Clinical content preserved.

Re-identify · originals restored on your machine

Dear Mrs Patricia Hartley, DOB: 14/03/1952 (age 73), NHS Number: 943 476 5919. Following your recent review, your ferritin remains low and we recommend continuing oral iron.

Round trip: process the safe text in any AI tool, then put the real values back from the token map — locally, never sent anywhere.

01The idea

It depends where the text is going

There is no single correct amount of redaction. The same clinical letter needs different treatment depending on its destination — and that, not detection, is the hard part.

→ THE CLINICIAN

Nothing removed

Care requires the patient's name and number. Inside a trusted setting, identifiers in the text aren't a leak — they're the point. Redaction here would only destroy the record.

→ A RESEARCH EXPORT

Safe Harbor

Text leaving for analysis or publication crosses out of the care relationship. Now every date, every specific age and the long tail of HIPAA identifiers have to go.

→ AN AI AGENT

Tokens, and no map

An agent needs the clinical meaning to do its work and nothing else. It should hold tokens, never the key that reverses them — and be checked on the way out.

A detector that only reads the text can't make any of these calls — it sees identifiers and removes them, everywhere, always. Redacta treats redaction as a decision about a boundary rather than a property of a document, which is why the sections below are about enforcement and verification as much as detection.

02The boundary

Enforced, then verified

Redacting text is only half the job in an agent workflow — the token map that reverses it is the key to the whole record. The Redacta MCP server keeps that map inside the server process, so the agent you're protecting the data from can never see it.

01 · PROTECT

The agent sees tokens only

protect redacts the text and returns the safe version plus an opaque session ID. The reversal map stays in server memory — never in the tool result, never in the model's context. The agent then summarises, drafts or analyses on tokens alone.

02 · CHECK

The boundary is checked, not assumed

check_output reads what the model produced and looks for identifiers that found their way back in verbatim, re-tokenising them without ever echoing the raw values. Most tools guard the way in. This is the one that asks whether the boundary actually held.

03 · RELEASE

Restored on the far side

release_to_file writes the re-identified result to a folder you configured. The agent receives a receipt, not the identifiers. Sessions expire automatically.

Proven, not promised

The test suite runs a real MCP client against the server and asserts the invariant directly: no original identifier and no token map ever appears in a protect or release response. Those acceptance tests gate every release, alongside engine and Python-mirror tests in repo-wide CI. Read the design

The clinical meaning stays. The patient behind it doesn't travel with the text.

03Detection

Two layers of detection

Patterns catch the structured identifiers. Reasoning catches the ones that don't follow a pattern — the names, addresses and ages that regex alone reliably misses.

LAYER 01 · PATTERNS

Deterministic matching

Fixed-format identifiers are matched exactly, every time — including a Modulus 11 checksum to confirm real NHS numbers.

NHS numbers (checksum-validated)
Dates of birth
UK postcodes & phone numbers
Email & hospital / MRN numbers
National Insurance numbers

LAYER 02 · REASONING

Agent judgement

For everything a pattern can't pin down, Redacta reads context — and tells a patient apart from the clinician treating them.

Patient names (not clinician names)
Relatives & carers named in the text
Postal addresses
Identifying ages
Self-checks the output for anything missed

Identifiers become labelled tokens

[PATIENT_NAME] [RELATIVE_NAME] [DATE_OF_BIRTH] [AGE] [NHS_NUMBER] [POSTCODE] [PHONE] [EMAIL] [MRN] [NI_NUMBER] [ADDRESS]

04Careful by design

The judgement calls, made well

Redaction is full of decisions a blunt tool gets wrong. Redacta makes the ones that matter — protecting the person behind the text without gutting the clinical record.

DATES

Dates of birth, not appointments

A patient's date of birth is removed; the date of their next appointment stays. Stripping every date would erase the timeline a clinician actually needs — unless you ask for Safe Harbor mode, which removes them all.

NAMES

The patient, not their clinician

Redacta protects the person being treated — it redacts the patient and keeps the GP, consultant and hospital named in the letter, so the text still reads sensibly. Need a fuller scrub? It can remove those too.

UNCERTAINTY

When in doubt, redact

Faced with something that might identify a patient, Redacta errs toward removing it — and lists every change in a report, so nothing happens silently.

Benchmark · vs Microsoft Presidio

100% recall, zero false positives across 300 synthetic clinical notes — and stable over 10 random seeds.

On the same text, a general-purpose detector over-redacts 1,643 times — every clinician name and appointment date.

False positives · lower is better

Redacta

Presidio

1,643

See the full benchmark

The engine is also regression-gated by OpenGATE, our open-source evaluation framework — whose first run surfaced two name-capture bugs that this benchmark's cases didn't cover. Both were fixed and verified the same day, and shipped in v1.2.1 across every surface. That's the point of continuous evaluation: finding the failure before a patient's name does.

05Safe Harbor mode

Stricter, for US HIPAA

The second destination from section 01, in concrete terms. Ask for HIPAA Safe Harbor — or "US de-identification" — and Redacta switches to its strictest pass, aligned with the §164.514 Safe Harbor method.

On top of everything above, it removes every date tied to the individual — not just the date of birth, but appointment, admission and discharge dates too — along with all specific ages, and the remaining HIPAA identifiers a clinical letter rarely shows but sometimes does: fax and certificate/licence numbers, device serial numbers, vehicle VINs, and health-plan beneficiary numbers. It errs on the safe side, removing a little more than the letter of the standard requires.

Added in Safe Harbor mode

[DATE] [AGE] [FAX] [LICENSE] [DEVICE_ID] [VIN] [HEALTH_PLAN_NUMBER]

06Who it's for

From one letter to a whole system

The same engine serves a developer wiring up an agent and a clinician with a letter to summarise. Only the surface changes.

Builders & AI agents

Put an enforced boundary around any agent that touches clinical text — identifiers and their reversal map stay out of the model's context end to end, and outbound text is checked before it lands.

Researchers & medical writers

Work with real case text in AI tools while keeping identifiers out of the prompt — or run a Safe Harbor pass over material bound for analysis or publication.

Clinicians & care teams

Summarise or rewrite a letter with AI without exposing the patient behind it. On iPhone it runs entirely on-device.

07Get started

Install in one line

Redacta is free and open source under the MIT-0 license. Nine surfaces, one detection engine: an iPhone app, an agent skill, an MCP server, Python and TypeScript libraries, a CLI, a self-hosted Kubernetes service, and plugins for Miro and FigJam.

Install the skill

Add Redacta from ClawHub with a single command.

Point it at your text

A letter, note, discharge summary or report — paste it in.

Get clean output

A pseudonymised document plus a report of every identifier replaced.

iPhone app · App Store

Use it

Redact on-device, straight from the share sheet — nothing leaves your phone.

Download on the App Store → About the app →

Agent skill · OpenClaw / ClawHub

Use it

Deterministic patterns plus agent reasoning, inside Claude Code and other agents.

$openclaw skills install redacta

MCP server · Claude Desktop, Cursor & more

Use it

v2 adds protect / release — the reversal map never enters the agent's context. One-click install from Anthropic's MCP Directory, or via npx. Read the docs →

$npx -y redacta-mcp

Python library · pip

Build with it

The same engine and PrivacyGateway loop, mirrored for Python — standard library only.

$pip install redacta

TypeScript library · npm

Build with it

The dependency-free engine every surface ships, with PrivacyGateway — protect / release in-process, expiring sessions, output guard. Read GATEWAY.md →

$npm install @pharmatools/redacta

Self-hosted · Kubernetes

Deploy it

An HTTP service that runs inside your own cluster — plain YAML, two deployment profiles, health probes, no-PHI logging. Deployment guide →

$kubectl apply -f gateway-service/k8s/

Command line · npx

Build with it

Redact a file or a pipe from the terminal — useful in scripts, batch jobs and CI, with no install step.

$npx redacta-cli

Whiteboards · Miro & FigJam

Whiteboard

Redact sticky notes and text right on the board, before a screenshot travels.

Get Redacta for FigJam → Redacta for Miro →

An honest note on limits. Redacta is a strong first line of defence, not a guarantee. It won't catch every possible identifier and isn't a substitute for formal data-protection processes. Always review the redaction report before sharing text.

Keep the boundary inside your own infrastructure

The whole gateway runs as a self-hosted HTTP service with a plain-YAML Kubernetes deployment — so the point where identifiable text becomes tokens sits inside your cluster, not someone else's. Everything on this page is MIT-0 and free to use; the code, the design notes and the acceptance tests are all in the open.

View the source

Kubernetes deployment guide → · Get in touch →