Skip to main content
MCPcat provides powerful client-side redaction capabilities, allowing you to sanitize sensitive information before it ever leaves your environment. This ensures that sensitive data never reaches our servers.

​
How it works

You can provide a custom redaction function when initializing MCPcat tracking: 
import * as mcpcat from "mcpcat";

const options = {
  redactSensitiveInformation: async (text) => {
    // Redact email addresses
    if (text.includes("@")) {
      return "[REDACTED-EMAIL]";
    }

    // Redact credit card numbers
    if (/\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}/.test(text)) {
      return "[REDACTED-CC]";
    }

    // Redact API keys and secrets
    if (text.toLowerCase().includes("secret") || text.toLowerCase().includes("key")) {
      return "[REDACTED-SECRET]";
    }

    return text;
  }
};

mcpcat.track(mcpServer, "proj_YOUR_PROJECT_ID", options);

​
Key Features

  • Recursive Application: Redaction is applied to all string values in event data, including nested objects and arrays
  • Protected Fields: Essential analytics fields (like sessionId, projectId, eventType) are preserved to maintain functionality
  • Type Preservation: Non-string values (numbers, booleans, dates) are preserved without modification
  • Error Handling: If redaction fails, the entire event is skipped to prevent accidental data leakage