This project is an MCP server for Thales CipherTrust RESTful Data Protection (CRDP), used to let AI applications and large language models securely protect and reveal sensitive data through the CRDP service.
Main capabilities:
- Data protection: Protect sensitive data using data protection policies defined on Thales CipherTrust Manager.
- Data reveal: Securely reveal protected data under appropriate authorization (username/JWT).
- Batch operations: Process multiple data items in a single batch operation.
- Version support: Handle externally versioned, internally versioned, and versioning-disabled protection policies.
- Monitoring: Health checks and metrics collection.
- Multiple transports: Support stdio and HTTP transports.
Usage:
- Prerequisites: Node.js (v18 or higher), npm, globally installed TypeScript, and a running CRDP container registered with CipherTrust Manager.
- Clone the repository, install dependencies, build the project, and start the server.
- Configure environment variables (no specific variable list is provided).
- Integration through AI assistants: Use the unified mcp.json configuration, after which natural language commands can be used, for example:
- "Protect my email address john.doe@example.com using the email_policy"
- "Reveal the protected data abc123def456 for user admin using protection policy ssn_policy"
- "Check the health of my CRDP service"
- n8n integration: Provides two workflow templates (crdp_demo_mcp_server.json and crdp_demo_mcp_client.json). You need to import the JSON files, configure OpenAI credentials, activate the workflows, and then use the chat interface. Conversational AI functionality requires an OpenAI API key.
Available tools:
- Data protection tools: Protect a single data item (parameters: data, protection_policy_name, jwt optional); batch protect (parameter: request_data).
- Data reveal tools: Reveal a single data item (parameters: protected_data, protection_policy_name, external_version optional, at least one of username and jwt must be provided); batch reveal (parameters: username, external_version optional, jwt optional).
- Monitoring tools: Get CRDP service metrics, check health status, check liveness status.
Version support types:
- External versioning: Returns protected data and an external version.
- Internal versioning: Returns protected data with an embedded version.
- Versioning disabled: Returns only protected data.
Security considerations: All sensitive data is processed through the CRDP service; all reveal operations require user authorization; the server does not store sensitive data locally; only CRDP running in no-tls mode is supported.
Limitations:
- Only CRDP in no-tls mode is supported.
- No specific environment variable list is provided.
- No specific free or paid pricing information is provided.
- No specific platform support scope is provided.
