# Strac MCP connector The Strac connector lets Claude, ChatGPT, Cursor, and the Elaichi Agent detect, redact, tokenize, and anonymize sensitive data in documents, sheets, and webhooks through one governed endpoint, with every action recorded in an audit log. Source: https://elaichi.ai/connectors/strac/ ## Facts | | | | --- | --- | | Application | Strac | | Category | Security | | AI tools | 27 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | Yes | ## What you can ask once Strac is connected - Which Strac detections fired on documents uploaded this week? - Create a Strac redaction for last night's uploaded contract. - List Strac tokens tagged payroll and who created them. ## Connect Strac in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Strac. 2. Optionally set Share with, then press Connect. 3. Paste a Strac API key. One person generates a token in Strac and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Strac tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Strac to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Strac to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Strac to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Strac to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Strac tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Strac through Elaichi ### Check a file for sensitive data first Security. Upload a contract or export to Strac as a document and ask what it contains before anyone forwards it. Card numbers, national IDs, and other secrets show up in the answer so the file can be cleaned or held back. ### Redact personal details from a document Compliance. Run a redaction on a Strac document and pull back the redacted copy by ID, ready to send outside the company. The original stays untouched for the record. ### Replace card numbers pasted into tickets Support. When a customer types a card or account number into a chat, turn it into a Strac token, in a single call or a batch. The agent keeps working with the placeholder and only detokenizes when the job truly needs the real value. ### Anonymize a Google Sheet before analysis Data. Point Strac at a Google Sheet, anonymize the personal columns, and hand the safe version to the analyst. When the results are ready, reverse the job to map findings back to real people, and check on running jobs along the way. ### Redact and detokenize traffic through a proxy Engineering. Set up a Strac proxy so incoming webhooks and outgoing requests are redacted or detokenized on the way through, with a function to shape the payload. No service on either side ever handles the raw values. ### Find every token tied to one customer Legal. When a deletion request arrives, search Strac tokens by tag or by the original datum, read the details on each one, then update or delete them. The log shows exactly which tokens were removed and by whom. ## Frequently asked questions ### How do I connect Strac to Claude? First connect Strac in Elaichi, which asks only for your Strac API key. There is no OAuth application to register and no client ID or secret to generate. Then in Claude open Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp. Sign in with your Elaichi account and Strac is ready to use. ### Does Strac work with ChatGPT and Cursor as well as Claude? Yes. Once Strac is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect Strac once and every client picks it up. ### What can an AI agent actually do with my Strac data? With Strac connected, an agent can upload a document and detect sensitive data in it, produce a redacted copy, and fetch that copy back. It can turn card numbers or IDs into Strac tokens, search tokens by tag, look up their details, update or delete them, and detokenize a batch when the real values are needed. It can also anonymize a Google Sheet and reverse the job later, and set up Strac proxies that redact or detokenize webhook traffic. ### Does connecting Strac give the AI full access to my Strac account? No. Everything an agent does in Strac runs under the API key of the person who connected it, so it can do nothing that key cannot do. Elaichi can then narrow that further, for example allowing detection and redaction while blocking detokenization or deletion. Elaichi never widens access beyond what Strac itself grants. ### Can my team share one Strac connection? Yes. One person connects Strac in Elaichi and shares the connection with a team, and nobody else ever sees or handles the Strac API key. Each teammate still signs in to Elaichi as themselves, so the audit log names the actual person who redacted a document or searched for a token. ### Can I stop an agent from deleting or changing things in Strac? Yes. Restrictions in Elaichi work per action, so you can allow an agent to detect and redact in Strac while blocking it from deleting documents, deleting tokens, or detokenizing values. A blocked action is never shown to Claude, ChatGPT, Cursor, or any other client, so no prompt, however worded, can reach it. ### What happens to a Strac connection when someone leaves? Offboarding a person in Elaichi ends their access to Strac at once, across every client they used. If the Strac connection was shared, it keeps working for everyone else on the team. If you want to remove Strac entirely, disconnecting it once in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client at the same time. ## All 27 Strac tools Every tool below is callable through https://api.elaichi.ai/mcp once Strac is connected, subject to the toolbox it is in and the restrictions on the caller. - **Create a Strac document** (Create). Upload a document to the strac vault and receive a reference ID for later retrieval. Returns: documentId. Required: document (binary, max 10 MB). Each upload is immutable — repeating the call creates a new stored document and a new reference ID. - **Get single Strac document by ID** (Get). Download the original document from strac by its document ID. Returns the raw binary file content of the document (an opaque binary stream, not a structured JSON response). Required: id. - **Delete a Strac document by ID** (Delete). Delete a document from strac by its document ID. Returns an empty 204 response on success. Required: id. - **Create a Strac detect** (Create). Detect sensitive data from a document or text using strac. Submits a detection payload to the strac engine and returns the resulting sensitive-data findings. The exact request and response fields are defined by the strac DetectDocumentInput and DetectDocumentOutput schemas respectively — consult the strac API docs for the full field-level breakdown. - **Create a Strac redact** (Create). Redact a document in the strac vault by submitting a redaction request. On success, returns a RedactDocumentOutput object that can subsequently be used to retrieve the fully redacted document via the strac Get redacted document API. The specific request body fields and response fields are defined by the RedactDocumentInput and RedactDocumentOutput schemas; consult the upstream strac API documentation for the field-level breakdown. - **Create a Strac redact** (Create). Redact sensitive data from inline text content in Strac, replacing detected PII and other sensitive fields according to the configured redact mode (e.g., substituting tokenized Strac vault links for sensitive values). Returns: redacted_text. Required: text. - **Get single Strac redacted document by ID** (Get). Download a redacted document from strac by document ID. Returns the redacted document as a binary file stream (not a JSON object — the response body is raw binary content). Required: id. - **List all Strac tokens** (List). List token identifiers within a strac redacted document. Returns: id. Required: document_id. - **Create a Strac token** (Create). Create a token in the strac vault by sending sensitive data and receiving back a reference identifier. By default a new token is generated per request; set idempotent to true to reuse an existing token for duplicate data. Returns: id. - **Update a Strac tokens modify by ID** (Update). Update an existing Strac token's value and type by id. Returns: tokenId, value, type. Required: id. Updates to tokens created with idempotency and updates to tags are not supported. - **Delete a Strac tokens modify by ID** (Delete). Delete an existing Strac token by id. Returns an empty 204 response on success. Required: id. - **Create a Strac tokens batch** (Create). Create a batch of up to 200 strac tokens by sending sensitive data elements to the vault. Returns reference token identifiers for each submitted data element. The entire batch is atomic — if any single element fails to tokenize, the whole request fails. Each call always produces a new set of tokens regardless of duplicate input. - **Create a Strac tokens search datum** (Create). Search for tokens by data in Strac. Submits a sensitive data value to find its matching token. Returns: token. Required: data. - **Create a Strac tokens search tag** (Create). Search for tokens in Strac by tag. Returns: tokens. Required: tag. Access is restricted to server-to-server connections; contact Strac to allowlist your IP addresses for live environments. - **Create a Strac tokens info** (Create). Extract information about a strac token without revealing the original sensitive data in full (e.g., last four digits of a social security number). Returns: token_type, attributes. Required: token. - **Create a Strac tokens detokenize batch** (Create). Batch detokenize up to 10 Strac tokens to retrieve their original sensitive data. Returns: tokens (array of detokenized results mapping each input token to its original value). Required: tokens. Restricted to server-to-server connections only; IP allowlisting required for live environments. - **Create a Strac anonymize gsheet** (Create). Anonymize a Google Sheet document in strac by replacing sensitive fields — phone numbers, names, emails, and ZIP codes — with pseudonyms or tokens via Google Workspace domain-wide delegation. Can be configured to run on a recurring basis. Returns the anonymization output object; specific response fields are defined in the upstream AnonymizeGoogleSheetsOutput schema and are not enumerable from the available source documentation. - **Create a Strac anonymize gsheets reverse** (Create). De-anonymize a Google Sheet in Strac, restoring an anonymized Google Sheets document to its original content within a specified Google Drive folder. This reverses the effects of a prior anonymize-gsheets operation. Returns: message, file_id. Required: file_id, folder_id. - **List all Strac anonymize gsheets jobs** (List). List recurring Google Sheets anonymization jobs in Strac. Returns job objects including id and attributes containing job-specific configuration details. No required parameters. - **Create a Strac proxy** (Create). Send any HTTP request (POST, PUT, PATCH, GET, DELETE, or OPTIONS) to a third-party endpoint via the Strac outbound proxy, substituting tokens for sensitive values such as API keys or SSNs. Strac forwards the call to the specified target URL and relays the third-party's response verbatim; the response shape is entirely endpoint-specific. Returns the proxied third-party response; shape is endpoint-specific. Required: Target-Url. - **Create a Strac proxy redact** (Create). Send any HTTP request through Strac's outbound proxy to a third-party URL, replacing sensitive data (such as SSNs and passport numbers) with redacted, non-sensitive equivalents before forwarding. Returns the forwarded response from the third-party service; the response shape is entirely determined by the target endpoint and cannot be enumerated statically. Required: Target-Url. - **Create a Strac proxy detokenize** (Create). Invoke the strac inbound detokenize proxy to retrieve original sensitive data for up to 10 tokens. The request body and headers are forwarded to your configured authorization server for end-user authorization; on success, the authorization server's response is returned with the detokenized values decorated in. The response shape is dynamic and depends entirely on the authorization server's configuration. - **Create a Strac proxy webhook** (Create). Forward HTTP webhook requests through Strac's webhook proxy to your server, replacing sensitive data such as SSNs and bank account numbers with tokens. Returns the forwarded response from your connected server; the response shape is determined by your server's implementation. Required: id (contact Strac to generate a webhookId and configure your endpoint). - **Create a Strac proxy function** (Create). Send a request to a third-party API through a Strac-hosted proxy function, forwarding tokens in place of sensitive data. Returns a dynamic JSON response whose shape is determined entirely by the hosted function. Required: Function-Id. - **Create a Strac proxy sftp** (Create). Detokenize and upload a CSV file to an SFTP server via Strac's proxy. SFTP server credentials must be pre-registered with Strac before use. Returns a 200 OK response with no body on success. - **List all Strac data security risks** (List). List data security risks discovered in strac across integrated applications, filterable by app type, date ranges, sensitive data types, and other criteria. Returns records containing event (with eventId, detectedElementTypes, filePath, eventTime, documentId), endpointResourceType, and endpointRemediationType. Required: appType, startDate, endDate. - **List all Strac data security audit events** (List). List strac data security audit events tracking user actions and system activities. Returns an events array where each record includes eventId, actionName, actorEmailAddress, dateTime, actorIpAddress, actorUserGroups, actionRequestPath, and a target object with action-specific context. Optionally filter by startDate or endDate.