Redact data in tool calls
Redact sensitive data from MCP tool responses before the agent sees it.
A tool response can carry SSNs, API keys, or email addresses that the agent has no need to see. Data Protection response filters redact that text after the call is allowed and before the agent reads the result.
What a filter does
A filter never allows or blocks a call: Agent Access decides whether a call runs, and a filter only rewrites the response. Every active filter whose scope matches a call applies, in no fixed order. You scope a filter by MCP server, agent, user, group, or tool pattern, with the same pills that Agent Access uses.
Patterns and AI judges
A pattern is a regular expression paired with a replacement, which is [REDACTED] when you leave it blank.
Browse presets adds patterns for common data such as email addresses, SSNs, card numbers, and API keys.
An AI judge takes a plain-language instruction for data that a pattern can't describe, and costs a model call.
What gets rewritten
A filter rewrites the text in the response's content blocks and every string inside its structured content, including object keys. Images and other binary content pass through unchanged. Filters apply to error results too, because an error message can carry the same data. Each call with a redacted response shows a Redacted ×N badge in the audit log.
For how filters combine, AI judge setup, and failure handling, see Data Protection.