# Data Sanitizer — REST API endpoint `data-sanitizer`

Sanitize untrusted text and return the cleaned output, a list of changes made, and a risk level. Modes: html (escape HTML special characters), sql (escape quotes/backslashes, strip comments and semicolons), js (strip script tags, javascript: URLs, event handlers, CSS expressions), url (percent-encode), or all (html + sql + js). Defaults to all.

- Category: security
- MCP server: https://mcp.findutils.com/ (Streamable HTTP, no API keys, 120 req/min per IP)
- REST endpoint: POST https://api.findutils.com/api/tools/data-sanitizer/execute (no API keys, 60 req/min per IP)
- Reference page: https://findutils.com/api/data-sanitizer/
- Same tool on the other surface: https://findutils.com/mcp/data-sanitizer/

## Call the endpoint (verified example)

```bash
curl -X POST https://api.findutils.com/api/tools/data-sanitizer/execute \
  -H "Content-Type: application/json" \
  -d '{
    "text": "<b>hi</b>",
    "mode": "html"
  }'

# Parameter schema
curl https://api.findutils.com/api/tools/data-sanitizer
```

## Input schema

| Argument | Type | Required | Description |
|---|---|---|---|
| `text` | string | yes | The input text to sanitize. |
| `mode` | string (html \| sql \| js \| url \| all) | no | Sanitization mode. Default: all. Default: `"all"`. |

Example arguments (verified):

```json
{
  "text": "<b>hi</b>",
  "mode": "html"
}
```

OpenAPI 3.1 spec: https://findutils.com/api/openapi.json · Interactive docs: https://findutils.com/api/docs/

## Also an MCP tool

```bash
claude mcp add findutils --transport http https://mcp.findutils.com/
```

Then ask the client to call `findutils:data_sanitizer`. Full MCP reference: https://findutils.com/mcp/data-sanitizer/

---
Full catalog: GET https://api.findutils.com/api/tools · https://findutils.com/api/ · https://findutils.com/llms.txt