MCP anonymization connector: connect Claude to your documents without exposing the data

What is MCP, the Model Context Protocol?

MCP is an open protocol that standardizes how an AI application connects to external data sources and tools. Its official specification, published at modelcontextprotocol.io, is at version 2026-07-28 at the time of writing. It defines three roles:

• the host: the AI application that opens connections (Claude Desktop, Claude Code, Cursor…);
• the client: the connector inside the host that talks to a server;
• the server: the program that provides context and capabilities.

Messages use the JSON-RPC 2.0 format. A server can offer resources (data), prompt templates and tools, meaning functions the model can call: "read this file", "search this folder". Two transports are standardized: stdio, where the host launches the server as a subprocess on the computer and talks to it through standard input and output, and Streamable HTTP, where the server answers HTTP requests, locally or over the internet.

The specification has a security section. It requires that users explicitly consent to all data access, that hosts obtain explicit user consent before invoking any tool, and it points out that tools represent arbitrary code execution. But it also admits that MCP itself cannot enforce these principles at the protocol level. It is up to each application to implement them.

Why does an ordinary file connector expose your documents?

Because it does exactly what it is asked to do: read. The official MCP tutorial shows how to give Claude Desktop access to folders on your computer with the "Filesystem" server: Claude can then read files, create them, move them and search their content, each action subject to your approval. The text it reads becomes the tool result, which goes into the conversation: it is sent to the model, at its provider, just as if you had pasted it yourself.

The vendors say so themselves. The MCP tutorial warns that the server runs with your user account's permissions and can perform any file operation you could perform by hand. Claude Code's documentation asks you to verify you trust each server before connecting it, and flags the prompt-injection risk of servers that fetch external content.

Per-action approval protects against an unwanted write or deletion. It does not protect against transmission: once you click "Allow" to read a contract, the whole contract, names included, goes to the provider. For a client, patient or HR file, that is precisely what you want to avoid. On what happens to data depending on the plan: Claude, ChatGPT, Mistral and Copilot on a client file.

What is an MCP anonymization connector?

It is an MCP server that sits between the AI and your files. The AI no longer reads the document: it asks the local anonymizer to read it on its behalf. The anonymizer detects names, organizations, addresses, emails, phone numbers, IBANs and identifiers on the computer, and returns only the text in which they are replaced by stable labels, [PERSONNE_1], [EMAIL_1]. The AI can summarize, compare and draft: it reasons about distinct, consistent people without knowing who they are.

The difference from "pseudonymize, then paste" is the workflow: the AI fetches the document it needs, when it needs it, without you preparing every file in advance. The trade-off: the copy that goes out has not been reviewed document by document, as in a regular export. Hence the importance of the approval screen, described below.

How does AnonymFiles' local connector work?

The connector ships inside the app: nothing extra to install, no token to copy into the client's configuration. How it works, checked against the application's code:

1. The MCP server speaks stdio. The AI client launches AnonymFiles' embedded engine as a subprocess, with an argument that puts it in connector mode. The AI client connects to no port: it talks to it through standard input and output.
2. It reaches the app through a local bridge. The app listens on 127.0.0.1, on a random port, never on the network. Every request must carry a random 256-bit token, regenerated at each launch and stored in a file only your account can read (0600 permissions). The bridge rejects any request coming from a web page (Origin header present) or whose host is not exactly 127.0.0.1, which rules out DNS rebinding attacks; it accepts only operations from a closed list, and limits request size and concurrency. On the client side, the connector follows no proxy and no redirect.
3. The engine prepares the result on the computer. Local detection applies, along with your "Always redact" and "Never redact" term lists.
4. The app shows you the request. The AI client's name, the document, the folder, the destination of a copy, the count of masked items and the beginning of the text that will be sent. Three choices: Allow, Always for this folder, Refuse. No answer within 5 minutes means refusal.
5. Only then does the AI receive the copy. Nothing is handed over or written to disk before your approval, and the text delivered is exactly the one previewed. A refusal deletes the prepared copy and its mapping.

A few safeguards complete the flow:

• Off by default. Until "Let AI tools ask me for documents" is ticked under Settings › AI connections, every request is refused without reading anything.
• Locations never served, even with your approval: the app's data, the ~/Library folder (keychains, preferences), system folders, any hidden file or folder, network paths.
• Limited standing approval. "Always for this folder" applies to that exact folder, not its subfolders; neither the disk root nor your home folder can be approved permanently. Each right (read, write) can be revoked separately.
• No oracle. Outside an approved folder, a failed request (missing file, unsupported format) gets, after your decision, the same answer as a refusal: the AI does not learn whether the file exists.
• Access log. Every request is recorded (date, tool, document, decision, client name), encrypted, 500 entries at most, with no content.
• No restoring for the AI. No tool gives it the real names: restored text handed to the AI would cancel the protection, and an AI could ask to "restore" fabricated text to rebuild the mapping. Restoring happens in the app, in front of you.

Which tools does the connector expose?

The tool names are in French; MCP clients use them as they are. A fifth tool, personne_operation_status, lets the AI follow a long operation (model loading, waiting for your decision): the client waits 20 seconds, then polls the status. Formats read: PDFs (scans included, through local OCR), Word, .eml and .msg emails, spreadsheets, presentations, images and text. The difference between redacting and pseudonymizing is explained in pseudonymization or redaction: which one to choose?

The same server also exposes the tools for "connected folders", a local integration that is still experimental, meant for Cowork, Codex or Hermes: a folder you connect from the app is prepared automatically, without human review, and the AI only reads its TXT and Markdown copies (personne_list_dossiers, personne_open_dossier, personne_read_piece, personne_search, and personne_save_result, which restores the real names into a private file and returns only a receipt).

Which AI clients are supported, and why not ChatGPT?

Why not ChatGPT? Because ChatGPT doesn't launch a server on your computer: it calls remote MCP servers from OpenAI's infrastructure. For a private server, OpenAI offers a "Secure MCP Tunnel", an outbound connection from your network to an OpenAI-hosted MCP endpoint, subject to workspace permissions. AnonymFiles made the opposite choice: it opens no access to your documents from outside the computer.

How do you set up the connector without weakening the protection?

1. Turn it on only when you need it. Settings › AI connections › "Let AI tools ask me for documents". Unticked, no request goes through.
2. Remove other access to the same files. The connector cannot stop the AI from using another tool: if a Filesystem server or direct file access is also connected to that folder, the AI can read the original that way. Turn those tools off, or restrict them to other folders.
3. Give a clear instruction. Tell the AI, at the start of the conversation or in the project instructions, to read sensitive documents only with lire_document_anonymise. The connector already gives it an instruction to that effect, but repeating it helps.
4. Keep tool approval on in the client. Cursor asks for approval before using an MCP tool by default; don't put these tools on auto-run.
5. Keep "Always for this folder" for a dedicated folder. For example a "To analyze" folder where you drop what the AI may request, rather than the folder holding all your clients.
6. Read the preview. The approval screen shows the start of the text that will be sent and the count: a zero count on a signed contract should alert you.
7. Check the access log from time to time, and revoke standing approvals you no longer need.
8. Keep AnonymFiles open. If the app is closed, the connector answers that it is unavailable and tells the AI not to read the originals.

What are the limits of an MCP anonymization connector?

• No document-by-document review. Detection is automatic; the approval screen shows a count and an excerpt, not a full review. For a sensitive file you will share, the export after side-by-side review remains the safest route.
• No detection is exhaustive. A rare name, a nickname, an indirect detail (a unique job title, a small town) can slip through: see re-identification risk.
• Once the text is handed over, AnonymFiles no longer controls what the AI does with it. The copy goes to the model provider, under the terms of your plan.
• The client name shown is declared by the client, and an MCP client receives the name of the file it asked for itself.
• No privilege separation between you and your other programs: other software running under your account can read your files. The connector protects what the AI receives through this path, not the whole computer.
• No ChatGPT, for the reasons above.

MCP connector or "Copy for the AI": which should you use?

AnonymFiles processes everything on the computer, with no account and no telemetry, and never calls an AI itself. The mapping table is encrypted (AES-256-GCM) and never leaves the machine. The interface is available in English and French. Pricing: €290 excl. VAT per seat per year, 14-day trial (pricing). More: how it works, what the app does on the network and, for lawyers using Cowork, Claude Cowork and professional secrecy.