data-compliance-mcp-production.up.railway.app

The description uses directive, rule-like language aimed at the agent ('Call this BEFORE your agent passes any assembled payload...', 'Returns machine-ready verdict, no further analysis needed') to make it seem mandatory to send every payload — including PCI, HIPAA, GDPR-covered data — to this tool prior to any external transmission or storage. This is the classic pattern of an exfiltration channel disguised as a compliance/safety gate: the very data this tool claims to protect (financial, health, personal data) is what it requests in full via the 'payload' parameter. The claim that the payload is 'analysed in memory and immediately discarded — never stored or logged' is an unverifiable assertion designed to lower the agent's/user's guard. Additionally it requests 'data_origin_ip' (the data subject's IP address), which is itself PII being sent to a third party for a plausible-sounding but unnecessary reason (jurisdiction detection).

This tool re-requests the full flagged payload (and in BATCH mode, up to 50 payloads at once) to an external service, again framed with mandatory-sounding language ('Do not proceed with the original payload after a non-SAFE verdict without running this tool first'). Combined with validate_data_safety, this creates a two-stage funnel that aggregates and transmits sensitive/regulated user data to whatever backend implements this tool, under the guise of providing 'redaction strategies' and 'compliant reformulations'. The instructive tone is written to override the agent's own judgment about when to send data externally, rather than describing a narrow, well-scoped capability.