ReleaseGuard
About
Scans datasets/models for PII/secrets, redacts, and packages a public-release bundle via MCP.
Details
- Author
- rudrendupaul
- Categories
- Developer Tools
Jump to
Setup
Install ReleaseGuard in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/rudrendupaul/ReleaseGuard
Follow the installation instructions in the repository README, then restart your MCP client.
What is ReleaseGuard, and why does it exist
ReleaseGuard is an open-source CLI, Python library, and MCP server that chains three steps, PII/secret detection (via Presidio), redaction, and public-release documentation, into one command. Each step already exists as a separate tool: Presidio detects,presidio-anonymizerredacts,huggingface_hubhas card-generation helpers, and the European Commission publishes a training-data-summary template as a document you fill in by hand. Nothing before ReleaseGuard chained a real scan directly into a filled-in template.
It exists because publishing a dataset or model responsibly involves running a PII scan, redacting what it finds, and then writing up two documents almost by hand, a card and (for general-purpose AI model providers) an EU AI Act training-data summary. ReleaseGuard automates the second half of that workflow so the resulting documents reflect what was actually scanned, not what someone remembered to write down afterward.
EU AI Act Art. 53(1)(d), stated precisely:this article requires providers ofgeneral-purpose AI (GPAI) modelsto publish a "sufficiently detailed summary" of training content, using the template the European Commission's AI Office published on 2025-07-24 (in force for new models from 2025-08-02, transitional deadline 2027-08-02 for models already on the market, enforcement checks from the AI Office starting 2026-08-02). It requires acategorical summary of data sources and modalities. It does not require raw training samples, full training recipes, or model weights, and it applies specifically to GPAI model providers, not to every dataset publisher. ReleaseGuard's generated summary is a starting draft for that narrow, real requirement, never a claim of broader "total transparency" compliance.
- Not a PII detector.Every entity type, confidence score, and detection decision comes from Presidio. ReleaseGuard adds no NLP model, no recognizer, and no accuracy claim of its own. If Presidio misses something or overcounts (see theURL/email overlap in the Quickstart above), ReleaseGuard inherits that behavior unmodified.
- Not a hosted service.Everything runs locally. No scan target, scan result, or redacted output is transmitted anywhere. See](https://github.com/bigcode-project/pii-lib)SECURITY.md's scope section.
- Not proof of legal compliance.The generated EU AI Act summary is a draft that still needs a human to fill in licensing, data-source, and copyright sections ReleaseGuard cannot infer from a scan. Runningreleaseguard packagedoes not, by itself, satisfy Art. 53(1)(d) or any other regulation.
- Not evidence of demand beyond what's cited above.The closest prior attempt at this same workflow,pii-lib, sits at 16 GitHub stars. ReleaseGuard does not claim to have solved the adoption problem that project ran into; it claims to fill a real, narrow, independently-verified gap (no existing open-source tool chains a Presidio scan directly into an Art. 53(1)(d) template), and lets real usage decide the rest.
Does ReleaseGuard detect PII more accurately than Presidio?No. It cannot, since it calls Presidio's ownAnalyzerEnginefor every detection decision. Any accuracy question is a Presidio question; seePresidio's own documentationandpresidio-researchfor its evaluation methodology.
Why doesscanneed a spaCy model download?Presidio'sAnalyzerEnginerequires a spaCy language model for context-aware detection (recognizing that "John Smith" is a name from surrounding text, not just a capitalized word). spaCy models ship as their own installable packages, not as apipdependency, sopython -m spacy download en_core_web_smis a required one-time step, the same as it is for anyone using Presidio directly.
Does ReleaseGuard work on Windows, macOS, and Linux?It's pure Python with no OS-specific code path, and the npm launcher shim pickswhereorwhichper platform to locate the installed CLI (npm-shim/bin/releaseguard-cli.js). CI currently runs onubuntu-latestonly, across Python 3.10 and 3.12, so macOS and Windows aren't yet covered by an automated test matrix. Treat them as expected to work, not CI-verified, until that matrix expands.
Is the EU AI Act Art. 53(1)(d) summary legally sufficient on its own?No. It is a structurally correct starting draft populated with real scan data where ReleaseGuard can verify it (the PII/secrets section) and an explicit placeholder everywhere it can't (data sources, licensing, copyright status). A human, ideally with legal review, has to fill in the placeholders before publishing it as a compliance artifact.
Does this only apply if I'm training a GPAI model?The Art. 53(1)(d) summary specifically targets general-purpose AI model providers under the EU AI Act, a narrow buyer set. Thescan,redact, and Hugging Face card-generation parts of ReleaseGuard are useful for any dataset or model release, regardless of whether Art. 53(1)(d) applies to you.
Why two registries?ReleaseGuard's implementation is Python, since Presidio itself is Python (presidio-analyzer/presidio-anonymizer); wrapping it in another language would mean re-shelling out or reimplementing bindings. The npm package (releaseguard-cli) is a thin launcher, not a reimplementation. It locates and execs the realreleaseguardbinary installed from PyPI, sonpx releaseguard-cliworks for npm-first agent tooling without duplicating Presidio's detection logic in two languages.
What license is ReleaseGuard under, and can I use it commercially?Apache 2.0, the same license Presidio itself uses. It permits commercial use, modification, and redistribution, including inside a proprietary product, subject to the standard Apache 2.0 terms: keep the license and copyright notice, and state any changes made to the source. SeeLICENSEfor the full text.
Does anyone actually need this, or is it "glue code nobody asked for"?Honestly stated: no organic demand signal (an HN/Reddit thread describing this exact workflow as a lived pain point) had surfaced as of this project's initial research. The independently verifiable fact is narrower and more defensible: no existing open-source tool chains a Presidio scan directly into an Art. 53(1)(d) template or a combined HF card, in one command, from one scan. Whether that gap turns into real usage is an open, falsifiable question this project tracks rather than assumes the answer to.
What happens to files ReleaseGuard can't parse (images, model weight files, Parquet without the extra)?scanandredactskip them (listed underfiles_skippedin--jsonoutput);redactcopies them through to the output directory unchanged rather than silently dropping them from the release bundle. They are not scanned for PII, so review them separately before publishing.
SeeCONTRIBUTING.md. Security issues: seeSECURITY.md.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Create crafted UI components inspired by the best 21st.dev design engineers.
Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server
An MCP server to help AI assistants to answer questions and generate AccelByte Extend SDK code more effectively .
MCP server for AI Diagram Maker — generate beautiful software engineering diagrams directly inside Cursor, Claude Desktop, Claude Code, or any MCP-compatible AI agent
ALAPI MCP Tools,Call hundreds of API interfaces via MCP
AI-powered SVG animation generator that transforms static files into animated SVG components using the Allyson platform
MCP server that gives AI assistants on-demand access to 1,500+ amCharts docs, ~300 code examples, and 1000+ class API references.
APIMatic MCP Server is used to validate OpenAPI specifications using APIMatic. The server processes OpenAPI files and returns validation summaries by leveraging APIMatic’s API.
One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.
Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
