Flag PII-and-External-MCP Cross-Contamination in One Session
The risk isn't any single tool call — it's a session that read a customer PII file earlier and is now calling out to a third-party MCP server. This sets a session-scoped flag on the first PII-path read, then flags (not silently blocks, since false positives are likely) every external MCP call afterward in that same session.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — flags an external mcp__ call in a session that
earlier touched a PII-tagged path. Wire to matcher "Read|mcp__.*"."""
import json, re, sys
from pathlib import Path
data = json.load(sys.stdin)
tool_name = data.get("tool_name", "")
session_id = data.get("session_id", "unknown")
flag_path = Path(data.get("cwd", ".")) / ".claude" / f"pii_touched_{session_id}.flag"
if tool_name == "Read":
path = (data.get("tool_input") or {}).get("file_path", "")
if re.search(r"(?i)(/pii/|ssn|customer_data)", path):
flag_path.parent.mkdir(parents=True, exist_ok=True)
flag_path.touch()
sys.exit(0)
if tool_name.startswith("mcp__") and flag_path.exists():
print(f"NOTICE: this session touched a PII-tagged file earlier and is "
f"now calling external tool {tool_name}. Confirm no PII is in the payload.", file=sys.stderr)
sys.exit(1)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/flag-pii-external-mcp-cross-contamination.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Read|mcp__.*",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/flag-pii-external-mcp-cross-contamination.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks