Masking Sensitive Data in MCP Server Responses

Liferay DXP 2026.Q3+ Release Feature

Important

Masking data in MCP server responses requires a release feature flag (LPD-63311). You must also enable the feature for a virtual instance. See Enabling the MCP Server for more information.

Data masks detect patterns in an MCP server tool response and replace the matching text with a substitute value. Use them to redact any information you don’t want reaching an AI application, like personally identifiable information (PII). Liferay DXP provides nine system masks for common formats such as email addresses, phone numbers, and national identification numbers. System masks ship with Liferay DXP and can’t be created, updated, or deleted. You can also create custom masks, which you can edit or delete.

Masks apply per MCP Server Profile rather than instance-wide, so the masks that apply to a response are the ones attached to the profile serving the request. The endpoint path decides which profile serves a request. A request to http://localhost:8080/o/mcp uses the profile named default, and a request to http://localhost:8080/o/mcp/[profile title] uses the profile with that title. A request naming a profile that does not exist returns 404, the same status a disabled MCP server returns.

Every new profile starts with all the system masks attached. You can remove any of them and attach custom masks on the profile’s Data Masks tab. See Managing MCP Server Profiles.

Note

In Liferay DXP 2026.Q4+, you manage data masks in the MCP Server application. For Liferay DXP 2026.Q3, see Managing Data Masks in Liferay DXP 2026.Q3.

Creating a Custom Data Mask

Navigate to Control Panel → MCP Server → Data Masks.
Click New Data Mask.
In Mask Information, fill in these fields:
- Name: Enter a name for the mask. The name must be unique.
- Description: (Optional) Enter a description of what the mask detects.
For Regex Pattern in Detection Configuration, enter a Java regular expression that identifies the value.
In Replacement Configuration, fill in these fields:
- Match Pattern: (Optional) Enter a regular expression that runs within each detected value. Leave it empty to replace the entire detected value with the Replacement.
- Replacement: Enter the text that replaces the match.
(Optional) In Test This Mask, enter a value for Sample and click Test to preview the masked result in Output.
Click Save.

If the Regex Pattern or Match Pattern isn’t a valid regular expression, the save fails. A new custom mask has no effect until you attach it to a profile.

System masks have the same Test This Mask section on their read-only View Data Mask screen, so you can try a mask before you attach it. For example, testing the Email Address mask on reach me at alex@example.com please shows reach me at [EMAIL_ADDRESS] please.

Tip

To base a custom mask on a system mask, click Actions () for the system mask, select Duplicate, and edit the copy.

Editing and Deleting a Data Mask

To edit a custom mask, click its title in the Data Masks list, make your changes, and click Save. System masks are read-only.

To delete a custom mask, click Actions () for it and select Delete. Deleting a mask removes it from every profile that uses it, so matching values are no longer masked in those profiles’ responses. See Auditing Data Mask Changes.

Attaching a Data Mask to a Profile

Navigate to Control Panel → MCP Server → Profiles, click the profile’s title, and click Data Masks.
Click Add Masks ().
Check the masks to attach.

The modal lists only the masks the profile doesn’t have yet.
Click Add.

Liferay DXP adds the masks after the profile’s current last mask. To change the execution order or remove a mask, see Managing a Profile’s Data Masks.

A profile with no masks attached returns responses unchanged.

How Masks Are Applied

Masks run in the order the profile’s Data Masks tab lists them, from top to bottom. Masks form a chain: each one receives the text the previous mask already modified. A later mask can match text an earlier mask inserted.

A Regex Pattern runs over the serialized response body as one string, not field by field. Liferay DXP replaces every match anywhere in the body, and ^ and $ refer to the whole body.

Regex Pattern and Match Pattern are Java regular expressions, evaluated by java.util.regex.Pattern. Liferay DXP compiles them with no flags, so matching is case sensitive and . doesn’t match a newline. For case-insensitive matching, include an inline flag group such as (?i) in the pattern. Named capture groups work too: define a group in the Match Pattern and reference it as ${name} in the Replacement.

The two patterns combine in one of two ways:

When Match Pattern is empty, Liferay DXP substitutes the Replacement for the whole detected value. Liferay DXP inserts the Replacement literally, so a $1 in it appears as the characters $1.
When Match Pattern is set, Liferay DXP runs it within each detected match. The Replacement can then use $1-style back-references. They resolve against the Match Pattern’s groups, not the Regex Pattern’s.

System Data Masks

Liferay DXP provides nine system masks:

Name	External Reference Code	Replacement
Bank Account Number (IBAN)	`L_DATA_MASK_IBAN`	`[BANK_ACCOUNT_NUMBER]`
Credit Card Number	`L_DATA_MASK_CREDIT_CARD_NUMBER`	`[CREDIT_CARD_NUMBER]`
Email Address	`L_DATA_MASK_EMAIL_ADDRESS`	`[EMAIL_ADDRESS]`
IPv4 Address	`L_DATA_MASK_IPV4`	`.0/24`
IPv6 Address	`L_DATA_MASK_IPV6`	`::/48`
National ID (BSN)	`L_DATA_MASK_NATIONAL_ID_BSN`	`[NATIONAL_ID]`
National ID (DNI and NIF)	`L_DATA_MASK_NATIONAL_ID_DNI_NIF`	`[NATIONAL_ID]`
National ID (SSN)	`L_DATA_MASK_NATIONAL_ID_SSN`	`[NATIONAL_ID]`
Phone Number	`L_DATA_MASK_PHONE_NUMBER`	`[PHONE_NUMBER]`

These are their Regex Patterns:

Name	Regex Pattern
Bank Account Number (IBAN)	`\b[A-Z]{2}\d{2}(?:\s?[A-Z0-9]){11,30}\b`
Credit Card Number	`\b(?:\d[ \-]?){13,19}\b`
Email Address	`\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b`
IPv4 Address	`\b(?:\d{1,3}\.){3}\d{1,3}\b`
IPv6 Address	`(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\\|(?:[0-9a-fA-F]{1,4}:)[0-9a-fA-F]{0,4}::(?:[0-9a-fA-F]{1,4}:)[0-9a-fA-F]{0,4}`
National ID (BSN)	`\b[1-9]\d{8}\b`
National ID (DNI and NIF)	`\b\d{8}[A-Z]\b`
National ID (SSN)	`\b\d{3}-\d{2}-\d{4}\b`
Phone Number	`(?<!\d)\+\d[\d\s\-().]{6,19}(?!\d)`

Every system mask replaces the whole match with a token, except the IPv4 Address and IPv6 Address masks. Those two masks set a Match Pattern as well, so the network prefix remains. The IPv4 Address mask uses the Match Pattern \.\d{1,3}$ and replaces each address with its /24 subnet. The IPv6 Address mask replaces an expanded address with its /48 prefix. It does the same for a compressed address with at most three groups before ::. A compressed address with more groups keeps every group before ::, so 2001:db8:1:2::5 becomes 2001:db8:1:2::/48.

The Bank Account Number (IBAN) mask detects IBAN-formatted bank account numbers from any country. The three National ID masks cover different countries: BSN for the Netherlands, DNI and NIF for Spain, and SSN for the United States.

Note

System masks cannot be created, updated, or deleted, and a custom mask cannot be converted into a system mask.

Masking Limits

Masks redact only what their Regex Patterns match, so any unmatched value passes through unchanged. Five limits follow:

The Phone Number mask matches international format only, because its pattern requires a leading +. A number written without a country code is not redacted.
The Credit Card Number mask matches digit groups by pattern only. It does not run a Luhn checksum, so it can match a long digit string that is not a card number.
The three National ID masks cover only the Netherlands, Spain, and the United States.
A response whose media type is not JSON or plain text is returned unchanged.
A mask whose Replacement references a capture group that its Match Pattern doesn’t define is skipped when the response is redacted, and the matched data passes through unmasked. Liferay DXP logs a warning rather than failing the request, and it accepts the mask when you save it, because it validates only the two patterns. Test a mask that uses both patterns before relying on it.

Masking applies to MCP server tool responses. Liferay DXP applies masks when the request carries the mask list that the MCP server sends with a forwarded tool call, so a user calling Liferay DXP’s REST APIs directly receives unmasked data. Masking is not an access control, and it does not restrict which tools a profile can call. To remove named fields from a tool’s responses instead, see Restricting Fields in MCP Server Tools.

Auditing Data Mask Changes

Creating, updating, and deleting a data mask are recorded in the audit log, as are attaching and removing a mask on a profile.

Deleting a custom data mask removes it from every profile it was attached to, and Liferay DXP records the reason Data mask was deleted. on each removed assignment. That reason is visible in the audit log entry for the deletion. Deleting an MCP Server Profile removes that profile’s assignments the same way, with the reason MCP server profile was deleted. System masks cannot be deleted, so this applies only to custom masks.

Managing Data Masks in Liferay DXP 2026.Q3

Liferay DXP 2026.Q3

In Liferay DXP 2026.Q3, you manage data masks, MCP Server Profiles, and the masks attached to each profile in the Control Panel, under the Object heading. The data mask form there uses different field labels. PII Category corresponds to Name, Detection Pattern to Regex Pattern, Replacement Pattern to Match Pattern, and Replacement Value to Replacement. The form also has a Mask Type field.

MCP Server Profiles are at Control Panel → MCP Server Profiles. Open a profile there to read its external reference code. Liferay DXP provides one profile, with the name default and the external reference code L_MCP_SERVER_DEFAULT_PROFILE. The system masks’ external reference codes appear in System Data Masks.

Creating a Custom Data Mask on the Objects Screen

Navigate to Control Panel → Data Masks.
Click Add Data Mask.
(Optional) Enter a description of what the mask detects.
For Detection Pattern, enter the regular expression that identifies the value.
For Mask Type, leave the field set to Custom.
For PII Category, enter a name for the mask. This value must be unique.
(Optional) For Replacement Pattern, enter a regular expression that runs for each match.
For Replacement Value, enter the text that replaces the match.
Click Save.

Tip

To base a custom mask on a system mask, open the system mask and copy its Detection Pattern, Replacement Pattern, and Replacement Value into a new data mask.

If the Detection Pattern or Replacement Pattern doesn’t compile, the save fails. The error message names the internal field, detectionRegex or replacementRegex, instead of the form label.

Attaching a Data Mask on the Objects Screen

Navigate to Control Panel → MCP Server Profile Data Masks.
Click Add MCP Server Profile Data Mask.
For Data Mask, enter the external reference code of the mask to apply.
For Delete Reason, enter the reason the assignment is removed.

This field is optional when creating the assignment, but you must enter a value before you can remove it.
(Optional) For Execution Order, enter a number to determine when this mask runs relative to the other masks on the profile.

Lower values run first.
For MCP Server Profile External Reference Code, enter the external reference code of the profile the mask applies to.
Click Save.