How to Build a Privacy-First Medical Image De-Identification Agent with Claude and MCP

August 6, 2026 · #Healthcare AI

By Lakshmi Mahabaleshwara

Imagine asking an AI assistant to de-identify thousands of medical images. It runs the pipeline, tracks progress, summarizes every decision, and flags files that need human review—all without ever seeing a single pixel of patient data.

That sounds impossible at first, because AI assistants typically need access to the data they're helping you process. But in this tutorial, you'll build an AI agent that never inspects sensitive medical images directly. Instead, it orchestrates a local de-identification pipeline through carefully designed tools, keeping patient data entirely on your machine.

The key technology enabling this is the Model Context Protocol (MCP), an open standard that lets AI models call external tools rather than relying only on their built-in capabilities. As of 2026, MCP has become the de facto standard for AI-tool integration, supported by major platforms and frameworks.

In my previous article, How to Build an AI-Powered Medical Image De-Identification Pipeline for Clinical Research, I covered building Aegis, an open-source tool that uses a MONAI (PyTorch) pipeline to remove Protected Health Information (PHI) from both DICOM metadata and image pixels via OCR and NER. I've since extended Aegis with local MCP server support. In this article, we'll build that server from scratch using FastMCP, then connect it to Claude Desktop—turning Claude into an AI agent that can run, monitor, and audit de-identification jobs through natural conversation.

One note before we start: while Aegis serves as the example throughout, the pattern applies to any Python tool you want to expose to an AI agent. If you have your own pipeline, CLI, or library, you can follow along and wrap that instead.

Table of Contents

• What You'll Build
• Prerequisites
• What Aegis Does (Brief Recap)
• Why MCP for Privacy-First De-Identification
• Setting Up the Project
• Building the MCP Server with FastMCP
• Configuring Claude Desktop
• Running and Auditing Jobs via Conversation
• Testing the Privacy Guarantees
• Limitations and Considerations
• Conclusion

What You'll Build

By the end of this tutorial, you'll have a functional MCP server that wraps Aegis's de-identification pipeline, exposing it as a set of tools that Claude can invoke. The agent will be able to:

• List available input files without reading their contents.
• Run de-identification jobs on specified files or directories.
• Check job status in real time.
• Review summarized logs—not raw patient data—to identify files needing human review.

All sensitive operations remain local, and Claude only sees metadata, summaries, and structured outputs—never PHI pixels or DICOM tags.

Prerequisites

To follow along, you'll need:

• Python 3.10+ installed on your machine.
• Claude Desktop (latest version, as of 2026, supports MCP natively).
• Aegis installed locally—or any Python CLI/library you want to wrap.
• Basic familiarity with Python and command-line usage.

What Aegis Does (Brief Recap)

Aegis is an open-source de-identification tool that:

1. Reads DICOM files (standard medical imaging format).
2. Strips PHI from metadata (e.g., patient name, ID, date of birth).
3. Detects and redacts PHI in pixel data using OCR and NER.
4. Outputs de-identified DICOM files, ready for research sharing.



The original pipeline is detailed in the previous article. Now, we're adding an MCP interface.




Why MCP for Privacy-First De-Identification




MCP addresses a critical challenge in healthcare AI: enabling intelligent automation without data exposure. By designing tools that return only summaries and status updates—not raw pixel data—you maintain strict privacy boundaries. This aligns with regulatory frameworks like HIPAA, GDPR, and emerging AI-specific health data rules in 2026.




Setting Up the Project




Let's create a new directory and set up a virtual environment:




mkdir medical-mcp-agent
cd medical-mcp-agent
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate




Install required packages:




pip install fastmcp aegis  # Assumes Aegis is packaged; adjust as needed




Building the MCP Server with FastMCP




FastMCP simplifies MCP server creation in Python. Create a file named aegis_server.py:




import asyncio
from fastmcp import FastMCP, Context
import aegis  # Your local pipeline

mcp = FastMCP("Aegis De-identification Agent")

@mcp.tool()
async def list_input_files(directory: str, ctx: Context) -> list:
    """List DICOM files in a directory without reading their contents."""
    # Use aegis's file discovery, not a generic listing, to avoid accidental PHI access
    files = aegis.discover_files(directory)
    ctx.info(f"Found {len(files)} DICOM files")
    # Return only filenames and sizes
    return [{"filename": f.name, "size_bytes": f.stat().st_size} for f in files]

@mcp.tool()
async def run_deidentification(input_dir: str, output_dir: str, ctx: Context) -> str:
    """Run the full de-identification pipeline on a directory."""
    ctx.info("Starting de-identification job...")
    job_id = aegis.start_job(input_dir, output_dir)
    return f"Job started with ID: {job_id}"

@mcp.tool()
async def get_job_status(job_id: str, ctx: Context) -> dict:
    """Get status and progress of a running job."""
    status = aegis.get_status(job_id)
    ctx.info(f"Job {job_id} status: {status['state']}")
    return status  # Ensure it contains no PHI, only counts and timestamps

@mcp.tool()
async def get_review_summary(job_id: str, ctx: Context) -> list:
    """Return summaries of files that need manual review."""
    summaries = aegis.get_review_list(job_id)
    # Strip any identifying details from summaries
    clean_summaries = [{"file": s["file"], "reason": s["reason"]} for s in summaries]
    ctx.info(f"Returned {len(clean_summaries)} items for review")
    return clean_summaries

if __name__ == "__main__":
    mcp.run()




Note: The above code assumes Aegis exposes these functions. In practice, you'll adapt to Aegis's actual API, or implement wrappers around your own CLI.




Configuring Claude Desktop




After 2026 updates, Claude Desktop reads MCP configurations from claudedesktopconfig.json, typically located in ~/Library/Application Support/Claude/ (macOS) or %APPDATA%\Claude\ (Windows). Add:




{
  "mcpServers": {
    "aegis": {
      "command": "python",
      "args": ["/path/to/your/aegis_server.py"],
      "env": {}
    }
  }
}




Restart Claude Desktop. If correctly configured, you'll see Aegis's tools listed in the MCP integration panel.




Running and Auditing Jobs via Conversation




Once connected, you can interact naturally:




User: "List the files in /data/raw_patients."

Claude calls listinputfiles and responds with filenames and sizes.




User: "Run de-identification on that folder, output to /data/deidentified."

Claude calls rundeidentification, then getjob_status periodically to report progress.




User: "Which files need review?"

Claude calls getreviewsummary and lists flagged files with reasons (e.g., "OCR found text pattern resembling a medical record number").




This conversation flow demonstrates how the agent manages tasks without ever seeing PHI.




Testing the Privacy Guarantees




To verify that Claude never receives raw data:



1. Use a test set with synthetic PHI.
2. Monitor network traffic or logs to confirm no image data leaves your machine.
3. Query the agent for details on a specific patient and observe that it can't answer—it has no access to the underlying data.



Limitations and Considerations



• Tool design is crucial: Any tool that returns raw data defeats the privacy purpose.
• Latency: OCR/NER processing is compute-intensive; users should expect longer job times.
• Error handling: The agent may need explicit instructions to interpret failures correctly.
• Scaling: For large datasets, consider job queues and status endpoints.



As of 2026, MCP tooling has matured, but always validate against the latest FastMCP and Claude Desktop documentation.




Conclusion




By combining a privacy-first MCP server with Claude Desktop, you've built an AI agent that can orchestrate, monitor, and audit medical image de-identification without ever exposing sensitive data. This pattern is broadly applicable—any local, privacy-sensitive pipeline can be wrapped in MCP tools to enable powerful AI-driven workflows while upholding the highest standards of data protection.




Additional Resources



• Model Context Protocol Specification
• FastMCP Documentation
• Aegis Repository
• Previous Article: AI-Powered De-Identification for Clinical Research



---




This article was reviewed for accuracy against current MCP and Claude Desktop capabilities as of August 2026.

via FreeCodeCamp