sanyambassi/thales-cdsp-crdp-mcp-server

A Model Context Protocol (MCP) server that allows interacting with the CipherTrust RestFul Data Protection (CRDP) service.
Overview
This MCP server enables AI applications and LLMs to securely protect and reveal sensitive data through the CipherTrust CRDP service. It supports both individual and bulk protect and reveal operations with versioning support.
Demo Videos
- **Video 1**: [https://youtu.be/O2pQRoykaaU] - Deployment and usage with Cursor AI
- **Video 2**: [https://youtu.be/ILNyWRYQUpw] - How to use the n8n workflows
Features
- **Data Protection**: Protect sensitive data using Data Protection policies defined on the Thales CipherTrust manager.
- **Data Revelation**: Securely reveal protected data with proper authorization (username/jwt)
- **Bulk Operations**: Process multiple data items in single batch operations
- **Versioning Support**: Handles external versioned, internal versioned, and version disabled protection policies.
- **Monitoring**: Health checks and metrics collection
- **Multiple Transports**: Support for stdio and HTTP transports
Prerequisites
Before installing and running the CRDP MCP Server, ensure you have the following prerequisites installed:
- **Node.js** (v18 or higher)
- **npm** (comes with Node.js)
- **TypeScript** (installed globally)
- **CRDP container running and registered with CipherTrust Manager**
See prerequisites for detailed installation instructions.
Quick Start
1. Clone the Repository
2. Install Dependencies
3. Build the Project
4. Start the Server
For stdio transport (default):
For HTTP transport:
Configuration
Environment Variables
| Variable | Description | Default |
|----------|-------------|---------|
| CRDP_SERVICE_URL | CRDP service endpoint for protect/reveal operations | http://localhost:8090 |
| CRDP_PROBES_URL | CRDP service endpoint for monitoring operations | http://localhost:8080 |
| MCP_TRANSPORT | Transport type (stdio or streamable-http) | stdio |
| MCP_PORT | HTTP port (when using streamable-http) | 3000 |
Setting Environment Variables
**Windows (PowerShell):**
**Windows (CMD):**
**Linux/macOS:**
Available Tools
Data Protection Tools
protect_data
Protect a single piece of sensitive data.
**Parameters:**
- data (required): The sensitive data to protect
- protection_policy_name (required): CRDP protection policy name
- jwt (optional, required if CRDP is running with JWT verification enabled): JWT token for authorization
> **Note:** If CRDP is running with JWT verification enabled, 'jwt' is required.
**Example:**
protect_bulk
Protect multiple data items in a single batch operation.
**Parameters:**
- request_data (required): Array of protection request objects
- jwt (optional, required if CRDP is running with JWT verification enabled): JWT token for authorization
> **Note:** If CRDP is running with JWT verification enabled, 'jwt' is required.
**Example:**
Data Revelation Tools
reveal_data
Reveal a single piece of protected data.
**Parameters:**
- protected_data (required): The protected data to reveal
- protection_policy_name (required): Policy name used for protection
- external_version (optional): Version information for the protected data
- username (conditionally required): User identity for authorization (required if 'jwt' is not provided)
- jwt (conditionally required): JWT token for authorization (required if 'username' is not provided)
> **Note:** At least one of 'username' or 'jwt' is required for reveal operations.
**Example:**
reveal_bulk
Reveal multiple protected data items in a single batch operation.