MedSeal-MBT

MedSeal-MBT is a small DICOM metadata validation and basic de-identification tool written in MoonBit.

It parses DICOM Part 10 files using Explicit VR Little Endian, validates basic file structures, removes or replaces common direct identifiers, optionally removes private elements, preserves pixel data, and writes a new DICOM file with a JSON audit report.

Features

• DICOM Part 10 file parsing
• Explicit VR Little Endian support
• Common text and integer VR decoding
• Defined-length and common undefined-length nested Sequence support
• Structural and basic image-metadata validation
• Basic metadata de-identification
• Optional private tag removal
• Pixel Data byte preservation
• Staged DICOM rewriting with parse-after-write verification
• JSON audit reports that never include original sensitive values
• Native command-line interface

Build and test

MoonBit version 0.1.20260724 or newer is recommended.

moon fmt --check
moon check --target all --deny-warn
moon test --target all --deny-warn
moon build --target native
moon info
moon package

Usage

Inspect a file without printing patient values:

moon run cmd/main inspect samples/input.dcm
moon run cmd/main inspect samples/input.dcm --json

Validate a file:

moon run cmd/main validate samples/input.dcm
moon run cmd/main validate samples/input.dcm --json

Perform basic metadata de-identification:

moon run cmd/main anonymize samples/input.dcm \
  --output samples/output.dcm \
  --report samples/report.json \
  --remove-private

An existing output is rejected unless --force is supplied. The input path can never be used as the output path. The writer stages the result, reparses and validates it, then atomically replaces the destination.

Other commands:

moon run cmd/main --help
moon run cmd/main inspect --help
moon run cmd/main validate --help
moon run cmd/main anonymize --help
moon run cmd/main --version

Exit codes are 0 for success, 1 for validation failure, 2 for command errors, 3 for unsupported DICOM formats, 4 for file I/O errors, and 5 for de-identification or write-back failures.

Built-in policy

Version 0.1.1 replaces Patient Name with ANONYMOUS, replaces Patient ID with MEDSEAL-ID, and empties the configured birth date, institution, address, physician, operator, device serial number, and related direct identity fields. Patient Sex is retained. Study Description, Series Description, and Protocol Name are retained with warnings. UIDs are retained to avoid breaking object relationships.

Private elements are retained with a risk warning by default. Use --remove-private to remove elements whose group number is odd. Original private values are never written to the report.

Important limitations

MedSeal-MBT does not inspect pixel data for burned-in personal information. It does not provide medical diagnosis and does not guarantee complete anonymization. Version 0.1.1 supports only Explicit VR Little Endian files.

It does not implement Implicit VR, Explicit VR Big Endian, compressed image decoding, DICOM networking, PACS, DICOMweb, OCR, pixel-region redaction, batch directory processing, or the complete DICOM standard. Unsupported Transfer Syntax UIDs are rejected explicitly; the parser never guesses.

The limits are 256 MiB per file, 128 MiB per element, 100,000 elements, and 32 Sequence nesting levels.

Privacy and safety

The audit report records only tag, field name, and action. It never records the original field value. The CLI does not print patient names or identifiers. Only synthetic files generated by this repository are committed under samples/. See SECURITY.md and samples/README.md.

Mooncakes

The module is 001-Elsa/medseal, version 0.1.1, with native as the preferred target. It is published at mooncakes.io/docs/001-Elsa/medseal. The CLI entry package is cmd/main.

Release acceptance evidence is documented in ACCEPTANCE.md. Competition submission metadata is in PROJECT_APPLICATION.md. Architecture and provenance are documented in ARCHITECTURE.md and THIRD_PARTY.md.

Repository mirrors:

• GitHub: https://github.com/001-Elsa/MedSeal-MBT
• GitLink: https://gitlink.org.cn/Hzhhhh/MedSeal-MBT

License

Apache-2.0. See LICENSE.