balmas-mcp is a local MCP server that sits between AI agents and your files: every file the agent reads is anonymized on your machine first — names, IDs, phones, companies, and secrets like API keys and passwords become consistent tokens. Read-only, folder-allowlisted, zero cloud.
Israel's Privacy Protection Authority recommends strict permission minimization for AI agents. This is what that regime looks like enforced technically, not just on paper:
| RECOMMENDATION | HOW BALMAS-MCP ENFORCES IT |
|---|---|
| Read-only access | The server exposes no write tools at all |
| Dedicated folders only | A folder allowlist on the command line; everything else is refused |
| Minimum necessary data | One step further: not just which files — what's inside them is minimized too |
| Transparency and control | Every access is logged locally on your machine |
{
"mcpServers": {
"balmas": {
"command": "npx",
"args": ["-y", "balmas-mcp",
"/Users/me/Documents/work",
"--level", "strict"],
"env": { "BALMAS_API_KEY": "bk_..." }
}
}
}Works with any MCP-compatible client. Three tools: list_files (names only), read_clean_file (content after anonymization), restore_text (real values back into the output).
The key (bk_...) is created free on the team & API page — every plan works, free included. Each file the agent reads counts against your monthly document quota (10 free, 200 PRO, 1,000 TEAM); only anonymous counters are sent for metering — content never leaves your machine.
Honest limits: the gateway helps only when the agent reads files through it — grant it instead of raw file access, not alongside. Detection is deterministic (patterns, lexicons, checksums): excellent, not clairvoyant.
No IT rollout. Each employee installs the gateway in front of the Claude, Cursor or Copilot they already use, and the organization forms itself.
Everyone who signs up with the company domain lands in the same organization automatically — no invites, no admin setup.
Each employee creates their own bk_ key and gets 10 free documents a month. Usage is attributable, and a leaver's key is revoked without touching anyone else's.
When the team needs more, one paid plan pools the quota for the whole organization, and admins see usage per key — counters only, never content.
Available now on npm: npx -y balmas-mcp — or start cleaning documents in the browser right now.