Document PII sanitizer and MCP tool decorator, add ModelContextProtocol dep

Grow the README with an example of constructing BedrockGuardrailsSanitizer
directly and note the structured-content limitation. Bring in
ModelContextProtocol 2.1.0 (for the tool-decorator types) and record the new
user-facing feature in the autover changelog.

Author: GarrettBeatty

.autover/changes/AWS.Bedrock.MAG-initial-preview.json

@@ -6,7 +6,8 @@
       "ChangelogMessages": [
         "Initial preview scaffold (0.1.0-preview): package infrastructure and a shared internal guardrail client wrapping ApplyGuardrail. User-facing features (policy backend, audit sink, PII sanitizer, high-level entry points) ship in follow-up preview releases.",
         "Bedrock Guardrails policy backend: an IExternalPolicyBackend that evaluates tool-call context via ApplyGuardrail and denies calls that trip the guardrail. Fails closed on Bedrock/AWS errors by default. Wire it up imperatively with PolicyEngine.AddExternalBackend.",
-        "CloudWatch audit sink: subscribes to the toolkit's AuditEmitter and writes governance events to CloudWatch Logs via AWS.Logger.Core, aggregating per-agent/per-policy counters and publishing them as CloudWatch metrics on a configurable flush interval. Delivery is background and non-blocking; sink hiccups can't break the governance loop."
+        "CloudWatch audit sink: subscribes to the toolkit's AuditEmitter and writes governance events to CloudWatch Logs via AWS.Logger.Core, aggregating per-agent/per-policy counters and publishing them as CloudWatch metrics on a configurable flush interval. Delivery is background and non-blocking; sink hiccups can't break the governance loop.",
+        "Bedrock Guardrails PII sanitization for MCP tool output: BedrockGuardrailsSanitizer runs the ANONYMIZE action on tool-result text blocks (30+ PII entity types). GovernedBedrockMcpServerTool decorates an MCP tool so sanitization runs after the toolkit's own scrubbing. Structured (non-text) tool content is passed through unchanged (post-v1 follow-up)."
       ]
     }
   ]

src/AWS.Bedrock.MAG/AWS.Bedrock.MAG.csproj

@@ -32,6 +32,7 @@
         <PackageReference Include="AWS.Logger.Core" Version="4.0.3" />
         <PackageReference Include="AWSSDK.CloudWatch" Version="4.0.103.2" />
         <PackageReference Include="Microsoft.AgentGovernance" Version="5.0.0" />
+        <PackageReference Include="ModelContextProtocol" Version="2.1.0" />
         <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.300" PrivateAssets="All" />
     </ItemGroup>
 

src/AWS.Bedrock.MAG/README.md

@@ -4,8 +4,9 @@ AWS backends for [Microsoft's Agent Governance Toolkit](https://github.com/micro
 
 - **Bedrock Guardrails policy backend**: ML policy evaluation added alongside the toolkit's rule, OPA, and Cedar backends. Fails closed on error.
 - **CloudWatch audit sink**: writes governance events to CloudWatch Logs with aggregated metrics.
+- **Bedrock Guardrails PII sanitization**: redacts or blocks 30+ PII entity types in MCP tool output.
 
-> Preview (0.1.0). The API may change while the toolkit's extension surface stabilizes. Remaining features (PII sanitization, high-level MCP/DI entry points, inline guardrail checks) ship in follow-up preview releases.
+> Preview (0.1.0). The API may change while the toolkit's extension surface stabilizes. Remaining features (high-level MCP/DI entry points, inline guardrail checks) ship in follow-up preview releases.
 
 ## Install
 
@@ -38,21 +39,36 @@ using var audit = new CloudWatchAuditSink(new CloudWatchAuditOptions
 audit.Subscribe(kernel.AuditEmitter);
 ```
 
-The high-level MCP and DI entry points that wire these up for you (`WithBedrockGovernance`, `AddBedrockGovernance`, `AddBedrockGuardrailsPolicy`, `AddCloudWatchAudit`) land in a follow-up preview release.
+### PII sanitization on MCP tool output
+
+`BedrockGuardrailsSanitizer` runs the ANONYMIZE action on the text blocks of an MCP tool result. The MCP server wiring that plugs it in for you (via `WithBedrockGovernance`) lands in the next preview; in the meantime you can construct the sanitizer directly to feed it tool-result text:
+
+```csharp
+var sanitizer = new BedrockGuardrailsSanitizer(new BedrockSanitizationOptions
+{
+    GuardrailId = "gr-abc123",
+});
+
+var scrubbed = await sanitizer.SanitizeAsync(rawToolText, cancellationToken);
+```
 
 ## Required IAM
 
 The credentials the agent runs under need:
 
-- `bedrock:ApplyGuardrail` on the guardrail evaluated by the policy backend.
+- `bedrock:ApplyGuardrail` on the guardrail (policy backend and PII sanitization).
 - `logs:CreateLogGroup`, `logs:CreateLogStream`, `logs:PutLogEvents` on the audit log group (audit sink).
 - `cloudwatch:PutMetricData` (audit metrics, when `EmitMetrics` is on).
 
 The audit sink uses [AWS.Logger.Core](https://github.com/aws/aws-logging-dotnet), which creates the log group and stream on first use, so the `logs:Create*` permissions are required.
 
+## Limitations
+
+PII sanitization covers the **text** blocks of an MCP tool result, matching the toolkit's own sanitizer. A tool result's `StructuredContent` (structured JSON) is passed through unchanged. If a tool returns PII in `StructuredContent`, mirror it into a text block so the guardrail sees it. Sanitizing arbitrary structured output is a post-v1 follow-up.
+
 ## Cost
 
-This package calls billed AWS services: Bedrock Guardrails (priced per text unit evaluated) on every governed tool call, plus CloudWatch Logs ingestion/storage and CloudWatch custom metrics from the audit sink. Tune `FlushInterval` to trade audit latency against request volume.
+This package calls billed AWS services: Bedrock Guardrails (priced per text unit evaluated, once for policy on the input and once for PII on the output), CloudWatch Logs ingestion and storage, and CloudWatch custom metrics. Tune `FlushInterval` to trade audit latency against request volume.
 
 ## License