io.github.seayniclabs/privacyops

PrivacyOps

Made by Seaynic Labs. Need tools like this built around your own systems? We do that.

PrivacyOps lets an AI assistant track your credit-report disputes and draft dispute letters, with every record kept in a file on your own computer. It works out the statutory response deadline for each open dispute, and it ships skills that walk you through a dispute from gathering facts to following up.

Not legal advice. PrivacyOps is a tracking and drafting aid. It does not know your facts or the law in your state. The letter templates have not been reviewed by a lawyer. For legal questions, ask a lawyer or a consumer-protection agency.

It is a bundle: tools, skills and instructions in one install. The tools are one server made of modules. You switch on the modules you use. New modules arrive switched off, so an update never changes what your assistant can do until you choose to.

Planned, not built: data-broker opt-outs and credit-freeze tools. These are ideas, not commitments.

Audience: consumers who want their own record of disputes and clear letters. PrivacyOps is not for lawyers, credit repair businesses, or anyone handling other people's identity information.

Skills

Skills are short guides your assistant reads before it does a job. PrivacyOps ships two, in two forms from one source: a skills/ folder for apps that read Agent Skills (Claude Code and others), and MCP prompts for every other MCP app.

No third-party skills ship with PrivacyOps. See CREDITS.md.

What stays on your computer

• Dispute records are kept in one JSON file in your data folder. Default: ~/.local/share/privacyops/privacyops.json. Set PRIVACYOPS_DATA_DIR to choose another folder.
• Letters are saved as Markdown text files in letters/ inside that folder.
• Approval decisions for deletes are appended to ~/.local/state/privacyops/approvals.jsonl: ids and decisions only.
• Nothing is sent to Seaynic Labs or to any other service. PrivacyOps makes no outbound network calls.
• The files are created readable only by you (mode 0600), but they are not encrypted. Anyone with access to your account can read them. Keep the folder out of shared or synced folders you do not control.
• Your AI assistant can see what you type into the chat, and so can the company that runs it. PrivacyOps cannot change that.

PrivacyOps never asks for a Social Security number. If a bureau asks for identifying numbers, you write them in by hand on the printed letter.

Install

PrivacyOps needs Python 3.11 or newer. With uv you do not install anything ahead of time:

uvx privacyops-mcp --version
uvx privacyops-mcp --doctor          # checks your data folder and records, prints fixes

Pin the exact version if you want updates only when you choose them: uvx privacyops-mcp==0.2.1.

Or with pip:

pip install privacyops-mcp

As a Claude Code plugin (server and skills in one step, once the seayniclabs/plugins marketplace lists PrivacyOps):

/plugin marketplace add seayniclabs/plugins
/plugin install privacyops@seayniclabs

Uninstalling with pip uninstall privacyops-mcp removes the program only. Your records and letters stay in the data folder. Delete that folder yourself if you want them gone.

Settings

PrivacyOps starts without any settings. The defaults are safe.

Config file (optional). PrivacyOps also reads ~/.config/privacyops/config.toml, or the file named by PRIVACYOPS_CONFIG. Environment variables win over the file.

data_dir = "/Users/you/Documents/privacyops"

[disputes]
allow_delete = false

[letters]
enabled = true

Add it to your MCP client

Most clients use the same JSON shape. Put it where your client keeps MCP servers:

{
  "mcpServers": {
    "privacyops": {
      "command": "uvx",
      "args": ["privacyops-mcp"],
      "env": {
        "PRIVACYOPS_DATA_DIR": "/Users/you/Documents/privacyops"
      }
    }
  }
}

Over HTTP. For clients that connect to a URL instead of launching a process:

privacyops-mcp --transport http --port 8765

It serves streamable HTTP at http://127.0.0.1:8765/mcp and listens only on your own machine by default. Put authentication in front of it before exposing it anywhere else.

Try these

Paste one into your assistant once PrivacyOps is set up:

1. "Open a dispute with Experian about a late payment I made on time, and draft the letter. Don't send anything yet."
2. "Which of my disputes are overdue, and what should I do next?"
3. "Walk me through disputing an item on my credit report, one step at a time."
4. "Show me where my dispute records are stored and what the file contains."
5. "Delete the dispute for the card issuer, but show me the preview first."

Tools

Every tool returns structured data with a published schema. Errors read privacyops.<module>.<code>: <message> Fix: <hint>.

Response deadlines

disputes_deadlines counts the periods that the statute sets, from the sent date you record:

• Consumer reporting agency: the agency must reinvestigate within 30 days of receiving your dispute, 15 U.S.C. 1681i(a)(1)(A). It may extend that by up to 15 days only if you send relevant information during the 30 days, and not if it finds the item inaccurate or cannot verify it in that period, 1681i(a)(1)(B)–(C). Source: https://www.law.cornell.edu/uscode/text/15/1681i
• Furnisher (the company that reported the item): a direct dispute must be investigated and answered before the period in 1681i(a)(1) ends, 15 U.S.C. 1681s-2(a)(8)(E)(iii). A dispute an agency forwards follows 1681s-2(b)(2). Source: https://www.law.cornell.edu/uscode/text/15/1681s-2

The tool counts from your sent date. The statute counts from the day the other side receives the dispute, so the real deadline is the same or later. The tool does not know when the letter arrived, whether you sent extra information, or which route a furnisher dispute took, so it says so in each row instead of guessing. The periods were checked against the official text on 2026-10-27.

Letter templates and sources

Both templates are fixed text. Nothing is generated by a model. Each citation was checked against the official statute text on 2026-10-27.

Contact details are included only where the agency's own site was checked on 2026-10-27:

Check any address against the agency's own website before you mail a letter. Agencies change their addresses.

Safety

• PrivacyOps makes no outbound network calls and sends nothing anywhere.
• Deleting a dispute record asks you first, through your MCP client's approval prompt. The assistant cannot approve on your behalf. Some clients cannot show approval prompts. In those, deletes are refused unless you set PRIVACYOPS_DISPUTES_ALLOW_DELETE=true.
• Every delete decision (asked, approved, declined, refused) is appended to the approval log with the dispute id. The log never holds names, item text, reasons, notes or letter text.
• Writes never delete other records. A failed save leaves the previous file unchanged, and an unreadable file is never overwritten.
• The disclaimer appears in the server's instructions, in privacyops_modules, in every skill, and in every letter's footer.

Check your setup

uvx privacyops-mcp --doctor

Doctor reads your data folder, records file, letter folder and approval log. It prints ok or FIX for each item, with the step to take, and exits 1 when something needs fixing. It makes no network calls and changes no files.

Develop

uv venv -p 3.11 && uv pip install -e '.[dev]'
.venv/bin/pytest
python3 scripts/check_skills.py
.venv/bin/python scripts/tool_lock.py --check
.venv/bin/python scripts/security_card.py --check

The tests use temporary data folders and make no network calls. scripts/tool_lock.py (without --check) rewrites the lock after a deliberate change to a tool, prompt or the instructions. Add a changelog line in the same change.

Security

Report a vulnerability privately through GitHub (Security tab, "Report a vulnerability"). See SECURITY.md.

License

MIT. Published by Seaynic Labs.

Built by Seaynic Labs. We build tools like this around a business's own systems: local-first, with a person approving every change. See custom integrations.