Overview

MCP Explorer automatically detects, encrypts, and redacts sensitive information in user chat messages and tool parameters. This protects passwords, API keys, tokens, and other secrets from accidental exposure.

Key Capabilities

🔍 Automatic Detection

Three-phase detection: regex patterns, heuristic scanning, and optional AI

🔐 AES-256 Encryption

All sensitive values encrypted before storage

👁️ Per-Value Reveal Toggles

Show/hide individual sensitive values on demand

🎨 Inline Badge UI

Clean, visual redaction matching app design

🔄 Reset on Reload

Reveal state resets when page reloads for security

⚙️ Configurable Keywords

Add custom sensitive field names

🤖 Optional AI Detection

Enable context-aware detection (disabled by default)

📊 Debug Mode

View detection reasons for troubleshooting

Detection Methods

Phase 1: Regex Pattern Matching (Default)

Always active, fast, and offline. No API costs or latency.

Detects sensitive values following keywords:

  • password, secret, token, key
  • apikey, api_key, api-key
  • Custom keywords from your configuration

Supported patterns:

With quotes:

secret: "value"
password 'value'
token "value"

Without quotes:

set key of VALUE
password: VALUE
token = VALUE
apikey VALUE

Flexible separators:

  • Colon (:)
  • Equals (=)
  • Keyword “of”
  • Space

Example:

Input: set the api_key to abc123xyz
Detected: abc123xyz
Displayed: set the api_key to [●●●●●● 👁️]

Phase 2: Heuristic Token Scanning

Composition-based analysis that flags tokens without preceding keywords.

Flags tokens that:

  • Contain mixed letters + digits (e.g., abc123)
  • Contain special characters (e.g., _-@#$)
  • Are NOT pure numbers, GUIDs, URLs, or plain words
  • Are NOT dates, times, ordinals, or contractions

Example:

Input: The key is ghp_ABC123xyz456def
Detected: ghp_ABC123xyz456def (no keyword, but looks like a token)
Displayed: The key is [●●●●●●●● 👁️]

Advantages:

  • Catches unprefixed API keys
  • Zero latency (fully local)
  • No API costs
  • Minimal false positives with smart exclusions

Phase 3: AI-Enhanced Detection (Optional)

Context-aware detection using your selected LLM model.

Disabled by default—must be explicitly enabled in Sensitive Fields settings.

How it works:

  1. Message is sent to LLM for analysis
  2. LLM identifies sensitive segments based on context
  3. Results are filtered by strictness setting
  4. Combined with regex + heuristic results

Strictness levels:

  • Conservative: Only accept AI segments with configured keywords
  • Balanced: Accept segments with keywords or heuristic-sensitive tokens
  • Aggressive: Accept all AI-identified segments (higher recall, more false positives)

Pros:

  • Smarter detection without specific keywords
  • Understands context and intent
  • Can catch edge cases

Cons:

  • Adds latency (1-3 seconds)
  • Requires API calls (costs money)
  • Message sent to provider before encryption
  • Privacy consideration: provider sees raw message

📸 Screenshot needed: sensitive-data-ai-toggle.png Description: Show the Sensitive Fields configuration page with the AI detection toggle and strictness dropdown

warning: Privacy Note: When AI detection is enabled, your message is sent to the LLM provider for analysis before local encryption. Consider this when handling highly confidential data.

Visual Redaction

Inline Badges

Sensitive values are displayed as badge-style pills that blend with the app’s design.

Badge format:

[●●●●●●●● 👁️]

Features:

  • Clean, non-intrusive appearance
  • Consistent with app aesthetic
  • Clear indication of hidden content
  • One-click reveal toggle

📸 Screenshot needed: sensitive-data-badge-redaction.png Description: Show a chat message or tool parameter with multiple sensitive values redacted as badges

Show/Hide Toggles

Each sensitive value has its own reveal button.

Eye icon states:

  • 👁️ (open eye): Value is hidden (default)
  • 👁️‍🗨️ (eye in speech bubble): Value is revealed

How to use:

  1. Click the eye icon on a redacted badge
  2. The sensitive value is temporarily revealed
  3. Click again to hide

Security:

  • Each value toggles independently
  • Reveal state resets on page reload
  • No persistent “always show” option

📸 Screenshot needed: sensitive-data-toggle-revealed.png Description: Show a message with one sensitive value revealed and another still hidden

Configuration

Additional Sensitive Fields

Add custom keywords to detect organization-specific sensitive fields.

How to add:

  1. Navigate to Sensitive Fields configuration
  2. Find Additional Sensitive Fields section
  3. Enter custom keywords (e.g., ssn, credit_card, employee_id)
  4. Save configuration

Examples:

  • ssn, social_security
  • credit_card, card_number
  • auth_token, session_id
  • employee_id, account_number

📸 Screenshot needed: sensitive-fields-custom-keywords.png Description: Show the Additional Sensitive Fields configuration with several custom keywords added

Allow/Deny Lists

Fine-tune detection to avoid false positives.

Allow List: Keywords that should NOT trigger detection

  • Example: public_key, key_name, primary_key (if these are not secrets)

Deny List: Keywords that should ALWAYS trigger detection

  • Example: Company-specific field names like sfdc_token, internal_secret

How to configure:

  1. Navigate to Sensitive Fields settings
  2. Add keywords to Allow or Deny lists
  3. Save configuration
  4. Detection now respects these rules

AI Detection Settings

Control AI-enhanced detection behavior.

Settings:

  • Enable AI Detection: Toggle on/off (default: off)
  • Strictness: Conservative / Balanced / Aggressive
  • Show Detection Debug: Enable detailed logging

Debug mode: When enabled, console logs show:

  • Which tokens were flagged
  • Which detection phase caught them
  • Why they were classified as sensitive
  • (Does NOT log raw secret values)

Use cases:

  • Troubleshooting false positives
  • Understanding detection behavior
  • Tuning custom keywords
  • Optimizing strictness settings

📸 Screenshot needed: sensitive-data-debug-mode.png Description: Show the browser console with detection debug logs (can be simulated text)

Encrypted Storage

How It Works

When sensitive data is detected:

  1. Value is extracted from message
  2. Encrypted using AES-256
  3. Encrypted blob stored in session file
  4. Original value removed from plain text
  5. Redaction badge displayed in UI

Storage location:

  • %APPDATA%\McpExplorer\settings.json (Windows)
  • Equivalent locations on macOS/Linux

Encryption method:

  • Algorithm: AES-256
  • Platform: Windows DPAPI (Data Protection API)
  • Scope: Current user account

info: Note: Encrypted values are tied to your user account and cannot be decrypted by others or on different machines.

What’s Encrypted

Chat messages:

  • Sensitive segments in user messages
  • Tool call parameter values

Connections:

  • API keys
  • Bearer tokens
  • Client secrets
  • Custom header values

Persistence:

  • All encrypted data persists across sessions
  • Reveal state does NOT persist (resets on reload)

Common Workflows

Testing Detection

  1. Type a message with a known sensitive value:
    set password to test123
  2. Verify badge appears: set password to [●●●●●● 👁️]
  3. Click eye icon to reveal temporarily
  4. Refresh page and verify value is hidden again

Configuring Custom Keywords

  1. Navigate to Sensitive Fields settings
  2. Add organization-specific keywords (e.g., tenant_secret)
  3. Test with a message containing your keyword:
    set tenant_secret to xyz789
  4. Verify detection works

Enabling AI Detection

  1. Navigate to Sensitive Fields settings
  2. Toggle Enable AI Detection to ON
  3. Select Strictness level (start with Balanced)
  4. Test with a message lacking specific keywords:
    Here's the access code: ABC-XYZ-123
  5. Verify AI detects “ABC-XYZ-123” even without “password” keyword

Troubleshooting False Positives

  1. Enable Show Detection Debug in settings
  2. Send a message that’s incorrectly flagged
  3. Review console logs to see why it was detected
  4. Add false positive to Allow List
  5. Test again to verify it’s no longer flagged

Best Practices

🔐 Keep AI Detection Off by Default

Only enable if regex+heuristic miss critical cases. Adds latency and costs.

🎯 Use Custom Keywords

Add organization-specific field names to catch internal secrets.

🧪 Test Detection

Send test messages to verify your configuration catches expected patterns.

📋 Document Sensitive Fields

Keep a list of your custom keywords for team reference.

🔄 Review Periodically

Audit what’s being detected and adjust Allow/Deny lists as needed.

🚫 Avoid Over-Redaction

If too many false positives, tune Allow List or reduce AI strictness.

👁️ Use Reveal Sparingly

Only reveal sensitive values when absolutely necessary.

Detection Examples

Example 1: API Key with Keyword

Input:

set api_key to sk_live_123abc456def

Detection:

  • Phase 1: Regex matches “api_key” keyword
  • Value: sk_live_123abc456def

Output:

set api_key to [●●●●●●●● 👁️]

Example 2: Token Without Keyword

Input:

The access code is ghp_ABC123xyz

Detection:

  • Phase 2: Heuristic flags ghp_ABC123xyz (mixed chars)
  • No keyword, but token shape matches

Output:

The access code is [●●●●●●●● 👁️]

Example 3: Password with “of” Keyword

Input:

set password of abc123

Detection:

  • Phase 1: Regex matches “password of” pattern
  • Value: abc123

Output:

set password of [●●●●●● 👁️]

Example 4: Quoted Secret

Input:

secret: "my-secret-value"

Detection:

  • Phase 1: Regex matches “secret” with quotes
  • Value: my-secret-value

Output:

secret: [●●●●●●●● 👁️]

Troubleshooting

Sensitive Data Not Detected

Problem: Expected secrets shown in plain text

Solutions:

  1. Use recognized keywords (password, key, token, secret)
  2. Add custom keywords to Additional Sensitive Fields
  3. Enable AI detection for context-aware identification
  4. Use quotes around sensitive values for better regex matching
  5. Check Allow List isn’t blocking detection

Too Many False Positives

Problem: Normal text incorrectly flagged as sensitive

Solutions:

  1. Add false positives to Allow List
  2. Reduce AI strictness to Conservative
  3. Disable AI detection if causing issues
  4. Review heuristic exclusions (dates, times, GUIDs, etc.)
  5. Enable debug mode to understand why detection triggered

Revealed Value Won’t Hide

Problem: Clicking eye icon doesn’t hide value

Solutions:

  1. Refresh the page (forces reset)
  2. Check browser console for JavaScript errors
  3. Verify browser localStorage isn’t disabled
  4. Clear browser cache and retry

Encryption Failures

Problem: Error messages about encryption/decryption

Solutions:

  1. Ensure running on supported OS (Windows, macOS, Linux)
  2. Check application has file write permissions
  3. Verify %APPDATA%\McpExplorer folder exists
  4. Try running as administrator (Windows)
  5. Review console for detailed error messages

Next Steps