sanyambassi/thales-cdsp-cakm-mcp-server

A Model Context Protocol (MCP) server for Database EKM/TDE operations using CipherTrust Application Key Management (CAKM).
🔑 Features
- **Resource-Based Management**: Tools are organized by the database objects they manage (e.g., keys, encryption, wallets), not just by actions.
- **Operational Grouping**: Each tool exposes multiple operations (e.g., create, list, rotate) for comprehensive lifecycle management.
- **Unified Status & Auditing**: A single tool (status_tde_ekm) provides health, compliance, and configuration monitoring across all supported databases.
- **Advanced Oracle TDE Detection**: Intelligent detection of Oracle TDE configurations including:
- **HSM-only TDE**: Direct HSM wallet usage
- **HSM with Auto-login**: Forward migrated configurations (HSM primary, auto-login secondary)
- **FILE wallet TDE**: Password-based software wallets
- **FILE with Auto-login**: Standard or reverse migrated configurations
- **Migration Status Recognition**: Automatically identifies forward/reverse migration states based on wallet order and types
- **Database TDE Operations**: Encrypt, decrypt, and manage TDE on multiple database types.
- **CipherTrust Integration**: Seamless integration with CipherTrust Manager via CAKM EKM.
- **Multi-Database Support**: SQL Server and Oracle Database.
- **Key Rotation**: Automated encryption key rotation with key management on Thales CipherTrust Manager.
> **🎥 Watch Demo Video** - See the MCP server in action managing database encryption
🚀 Quick Start
Clone the Repository
Installation
Usage
📦 Installing uv
This project uses uv to manage dependencies and run scripts. Please install it using one of the methods below.
**Windows (PowerShell):**
**Linux, macOS, and other shells:**
For more information, visit the uv installation guide.
🔧 Available Tools
- **Core Tools**
- list_database_connections(): Lists all configured database connections.
- **Unified Status & Auditing**
- status_tde_ekm(): Provides a unified interface to monitor the health, configuration, and compliance of TDE across both SQL Server and Oracle.
- **SQL Server Tools**
- manage_sql_ekm_objects(): Manages EKM providers, credentials, and their associated server logins.
- manage_sql_keys(): Manages the lifecycle of cryptographic keys (Asymmetric Master Keys and DEKs), including creation, listing, dropping, and rotation.
- manage_sql_encryption(): Encrypts or decrypts one or more SQL Server databases.
- **Oracle Tools**
- manage_oracle_tde_deployment(): Handles high-level TDE deployment workflows like initial setup or migration to/from an HSM.
- manage_oracle_configuration(): Manages TDE-related database parameters.
- manage_oracle_wallet(): Performs all wallet-specific actions (open, close, backup, manage auto-login).
- manage_oracle_keys(): Manages the lifecycle of Master Encryption Keys (MEKs), including rotation and listing.
- manage_oracle_tablespace_encryption(): Manages the encryption and decryption of specific tablespaces.
🤖 AI Assistant Integration
Add to your AI assistant configuration:
Claude Desktop
Cursor AI (mcp.json)
Gemini CLI (settings.json)
Architecture Overview
**Note**: This MCP server communicates only with database servers. The CAKM providers installed on database servers handle all communication with CipherTrust Manager.
Oracle TDE Enablement Logic
The server uses Oracle-documented logic to determine TDE status based on wallet configurations and TDE parameters:
**✅ TDE is ENABLED when:**