Balmas MCP server
{
"mcpServers": {
"balmas": {
"command": "npx",
"args": [
"-y",
"balmas-mcp@latest",
"balmas-mcp",
"--level",
"strict"
],
"env": {
"BALMAS_API_KEY": "<balmas_api_key>"
}
}
}
}{
"mcpServers": {
"balmas": {
"command": "npx",
"args": [
"-y",
"balmas-mcp@latest",
"balmas-mcp",
"--level",
"strict"
],
"env": {
"BALMAS_API_KEY": "<balmas_api_key>"
}
}
}
}{
"mcpServers": {
"balmas": {
"command": "npx",
"args": [
"-y",
"balmas-mcp@latest",
"balmas-mcp",
"--level",
"strict"
],
"env": {
"BALMAS_API_KEY": "<balmas_api_key>"
}
}
}
}{
"servers": {
"balmas": {
"command": "npx",
"args": [
"-y",
"balmas-mcp@latest",
"balmas-mcp",
"--level",
"strict"
],
"env": {
"BALMAS_API_KEY": "${input:balmas_api_key}"
}
}
},
"inputs": [
{
"id": "balmas_api_key",
"type": "promptString",
"description": "Balmas api key",
"password": true
}
]
}{
"mcpServers": {
"balmas": {
"command": "npx",
"args": [
"-y",
"balmas-mcp@latest",
"balmas-mcp",
"--level",
"strict"
],
"env": {
"BALMAS_API_KEY": "<balmas_api_key>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y balmas-mcpversion 0.3.0
What it does
Balmas MCP is a read-only gateway that sits between AI agents and your files, replacing personally identifiable information and secrets with consistent tokens before the agent reads them. It enforces strict folder access controls and performs all anonymization locally, with restoration of original values only in the agent's final output.
- Grant an AI agent access to contracts, emails, or documents while replacing names, addresses, and ID numbers with consistent tokens to prevent inference of sensitive patterns.
- Let an agent analyze business files without exposing API keys, passwords, JWTs, or other secrets that might be present in the source material.
- Minimize what an agent can read within allowed folders by both restricting filesystem access and redacting sensitive content before it sees any file contents.
Tools this server exposes
| Tool | Does |
|---|---|
| list_files | Returns names, sizes, and types of files in allowed folders without exposing file contents. |
| read_clean_file | Returns file text with personally identifiable information and secrets replaced by consistent local tokens. |
| restore_text | Maps anonymization tokens back to original values in the agent's output, using session tokens only. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.