How to build a PII-safe MCP server with Vurb.ts
Quando usar: You're wrapping an internal system and must guarantee PII never leaves the perimeter.
Pré-requisitos
- Node 20+ and npm — Standard
- Vurb CLI — npm install -g @vurb/cli
Fluxo
-
ScaffoldRun vurb create customer-mcp with the prisma vector, and open the generated src/tools/ folder.✓ Copiado→ Scaffolded project
-
Declare a presenterAdd a presenter for the Customer model that exposes only id, plan, and country. Everything else (email, phone, address) is physically stripped.✓ Copiado→ LLM sees only declared fields
-
Add PII redaction on free-text fieldsOn the Note model's body field, apply .redactPII() at the Late Guillotine.✓ Copiado→ Emails/phones inside note bodies masked
-
Test with the in-memory pipelineWrite a @vurb/testing case that feeds a record with fake PII and asserts the output is redacted.✓ Copiado→ Test passes
Resultado: An MCP server where PII leakage is a compile/runtime impossibility, not a code review item.
Armadilhas
- Redaction regex never catches everything — Combine presenter whitelist + redaction — don't rely on redaction alone
- Presenter drift over time — CI assertion: snapshot presenter output for key models; fail PRs that change it without review