---
schema_version: "1"
id: ae774700eaf1d6ed7e4c96c78402ba74ddb9326a3b7645753117463aefcb57de
title: MCP Personally Identifiable Information (PII) Detector Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-included-mcp-pii-detector.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-pii-detector
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 96ce4afc791eeb980bc2146575733543e6ef85e9a2f91135a479eb051f98f849
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
keywords: api gateway, flex gateway, gateway, policy
---

# MCP Personally Identifiable Information (PII) Detector Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>MCP PII Detector Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Blocks elicitation responses containing personally identifiable information (PII) from reaching MCP servers</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>MCP</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.9.3</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. The policy reports a policy violation when PII is detected.</p></td></tr></tbody></table>

## Summary

The MCP PII Detector policy blocks elicitation responses containing personally identifiable
information (PII) from reaching MCP servers.

When PII is detected in the elicitation response `result` field, the policy:

- Reports a policy violation.

- Sends a modified response to the MCP server that the request was declined and includes the message
  `PII data requested or found in user response`.

The policy doesn’t send a response to the client when PII is detected.

The policy only scans JSON-RPC responses that contain a `result` field. JSON-RPC requests with a
`method` field are ignored.

## Configuring Policy Parameters

### Flex Gateway Local Mode

The MCP PII Detector policy isn’t supported in Local Mode.

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Element</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Entities</p></div></div></td><td><div><div><p>Array that defines the types of PII to detect. You can select multiple PII types. Supported values are <code>Email</code>, <code>US SSN</code>, <code>Credit Card</code>, <code>Phone Number</code>.<br>For more information, see <a href="#pii-types">PII Types</a>.</p></div></div></td></tr></tbody></table>

### PII Types

When you configure an MCP PII Detector policy, you can choose which types of PII to detect:

<table><colgroup><col> <col></colgroup><thead><tr><th>PII Type</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Email</p></div></div></td><td><div><div><p>Standard email addresses such as <code>User.Name+tag@example.com</code>.</p></div></div></td></tr><tr><td><div><div><p>US SSN</p></div></div></td><td><div><div><p>United States Social Security Numbers (SSNs) in the standard format: <code>XXX-XX-XXXX</code> where each <code>X</code> is a digit. For example, <code>123-45-6789</code>.</p></div></div></td></tr><tr><td><div><div><p>Credit Card</p></div></div></td><td><div><div><p>Credit card numbers in the form of four groups of four digits, separated by optional spaces or hyphens. For example,<code>1234-5678-9012-3456</code>, <code>1234 5678 9012 3456</code>, or <code>1234567890123456</code>.</p></div></div></td></tr><tr><td><div><div><p>Phone Number</p></div></div></td><td><div><div><p>United States phone numbers in various formats, with or without country code, parentheses, spaces, hyphens, or dots. For example, <code>123-456-7890</code>, <code>(123) 456-7890</code>, <code>123.456.7890</code>, <code>+1 123 456 7890</code>, or <code>1234567890</code>.</p></div></div></td></tr></tbody></table>