Building phi-guard-mcp: Catching PHI Leaks in AI-Generated Code

Описание и применение

phi-guard-mcp — локальный инструмент, который обнаруживает и заменяет PHI в коде, предотвращая утечки в LLM, логи и аналитику.

Задача

AI coding agents can inadvertently leak protected health information (PHI) into LLM calls, logs, or analytics without any monitoring, leading to potential privacy violations.

Результат

phi-guard-mcp detected all planted PHI leaks across multiple sinks with zero false positives, covering .ts, .js, .tsx, .jsx, .py, .go files and skipping node_modules and build directories.

Рабочий процесс

• Install phi-guard-mcp globally via npm
• Add .mcp.json configuration to project root specifying the phi-guard server command
• Run phi-guard-mcp to scan the repository for PHI leaks
• Review flagged lines and use redact_suggest to replace PHI with placeholders
• Integrate the tool into AI agent prompts: "Scan this repo for PHI leaks" or "Redact this text"

Доказательства

6/6 planted leaks detected across 5 different sinks (OpenAI, Anthropic, Sentry, Winston, PostHog/analytics)

Источник

0 false positives across 5 clean-code fixtures

Источник

Not a HIPAA certification or legal compliance guarantee — it's a linter-grade signal, not an audit

Источник