io.github.lokal-id/lokal·Security

Lokal

Indonesia-ready agents: NIK, phone, Rupiah, regions, postal codes, holidays, and PII masking.

Stars
0
Version
0.2.2
License
MIT
Review
Passed
Language
TypeScript
Last commit
1h ago
Forks
0
Open issues
0
Registry update
Oct 16, 2026
agent-skillsai-agentsclaude-codeindonesiamcppiiuu-pdp

Connect

npm
Terminal
$claude mcp add lokal \  -e LOKAL_ROOT=<lokal-root> \  -- npx -y @lokal-id/[email protected]

Environment variables

  • LOKAL_ROOT

    Folder the file tools (scan_pii, read_file_masked, write_file_unmasked) may access. Defaults to the working directory.

Security review

Review passed

Reviewed 11m ago.

metadata
scanned
packages
1 checked

No findings.

Tools

This server runs on your machine, so its tool list is not fetched before install — the README below describes what it offers.

@lokal-id/mcp

npm License: MIT

An MCP server that makes AI agents Indonesia-ready: accurate Kemendagri region and postal code data, holidays and working days, NIK/NPWP/phone validation, Rupiah, and Samaran, which lets an agent read production files (CSV, Excel, logs) with Indonesian personal data replaced by stable placeholders, then write results with the real values restored, locally.

Part of Lokal · Bahasa Indonesia

Install

Claude Code: install the Lokal plugin, which bundles this server with the skills and the Samaran Guard hook:

/plugin marketplace add lokal-id/lokal
/plugin install lokal@lokal

Cursor, Claude Desktop, Windsurf (.cursor/mcp.json, claude_desktop_config.json, ~/.codeium/windsurf/mcp_config.json):

{
  "mcpServers": {
    "lokal": {
      "command": "npx",
      "args": ["-y", "@lokal-id/mcp"],
      "env": { "LOKAL_ROOT": "/path/to/your/project" }
    }
  }
}

VS Code (.vscode/mcp.json):

{ "servers": { "lokal": { "type": "stdio", "command": "npx", "args": ["-y", "@lokal-id/mcp"] } } }

Codex CLI (~/.codex/config.toml):

[mcp_servers.lokal]
command = "npx"
args = ["-y", "@lokal-id/mcp"]

The file tools can only access LOKAL_ROOT, which defaults to CLAUDE_PROJECT_DIR and then to the working directory.

Tools

ToolWhat it does
parse_nikValidate and decode a NIK: region, date of birth, sex
validate_npwp15-digit NPWP, 16-digit NPWP, or NIK as NPWP
parse_phoneNormalize numbers, display format, WhatsApp link, carrier
format_rupiah / parse_rupiahRp1.500.000, terbilang; "2jtan", "goceng" → numbers
search_wilayah / list_wilayahProvinces down to villages, with codes and postal codes
lookup_kode_posPostal code → villages, or all postal codes in a region
list_holidays / working_daysNational holidays and cuti bersama (SKB 2026, 2027), SLA due dates
scan_piiScan files and folders for personal data by UU PDP category; reports files it could not scan
read_file_maskedRead a file (text, CSV, JSON, logs, .xlsx, .docx) with personal data replaced by placeholders
write_file_unmaskedWrite results with placeholders restored, on your machine

Samaran Guard

lokal-mcp guard is a Claude Code hook (UserPromptSubmit, and PreToolUse for Read|Grep|Bash|PowerShell). It holds prompts that contain NIK, bank account, or health data, and blocks commands that would print a personal data file into the conversation, pointing the agent to read_file_masked instead. The Lokal plugin sets it up for you.

License

MIT. The library is @lokal-id/core.

From the server's repository — third-party content, read it before running anything it suggests.

More in Security

Listing from the official MCP Registry · repository facts from GitHub, 17m ago.