# sanyambassi/thales-cdsp-cakm-mcp-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/sanyambassi/thales-cdsp-cakm-mcp-server  
**GitHub Stars:** 3  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/sanyambassi-thales-cdsp-cakm-mcp-server

## Description
MCP server for Thales CDSP CAKM integration, enabling secure key management, cryptographic operations, and compliance monitoring through AI assistants for Ms SQL and Oracle Databases.

## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):

```json
"mcpServers": {
  "thales-cdsp-cakm-mcp-server": {
    "command": "npx",
    "args": ["-y","sanyambassi-thales-cdsp-cakm-mcp-server"],
    "env": {
      "DB_TDE_SERVER_NAME": "",
      "DB_TDE_LOG_LEVEL": "",
      "DB_TDE_DATABASE_CONNECTIONS": ""
    }
  }
}
```

**Requires environment variables:** `DB_TDE_SERVER_NAME`, `DB_TDE_LOG_LEVEL`, `DB_TDE_DATABASE_CONNECTIONS` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What sanyambassi/thales-cdsp-cakm-mcp-server MCP server does

The sanyambassi/thales-cdsp-cakm-mcp-server MCP server exposes database Encryption Key Management and Transparent Data Encryption operations through the Model Context Protocol. It supports Microsoft SQL Server and Oracle Database environments that use Thales CipherTrust Application Key Management and CAKM providers.

Its tools are arranged around managed database resources rather than isolated commands. Operations cover cryptographic keys, encryption state, wallets, EKM providers, database configuration, and TDE deployment. The server also provides a consolidated status and auditing tool for checking TDE health, configuration, and compliance information across supported databases.

For Oracle, the implementation examines wallet status, wallet order, wallet types, TDE configuration parameters, and the presence of master encryption keys. It can distinguish HSM-only configurations, FILE wallet configurations, auto-login arrangements, and forward or reverse migration states.

## How it works

The runtime communicates with database servers. Database-side CAKM providers and libraries handle communication with CipherTrust Manager, so the MCP process does not connect directly to CipherTrust Manager. The documented architecture is MCP server to database server, then to the CAKM provider or library and CipherTrust Manager.

Configured database connections identify the database type and connection details. Oracle entries can also include Oracle installation and instance settings, wallet locations, connection mode, and SSH details for access to the database host. SQL Server and Oracle operations are then selected through the corresponding MCP tools.

Oracle TDE status is determined from documented wallet and parameter combinations. TDE is treated as enabled when a wallet is open and master encryption keys are present. The implementation recognizes wallet order values such as SINGLE, PRIMARY, and SECONDARY, along with FILE, HSM, HSM|FILE, and FILE|HSM TDE configuration values.

## Setup and configuration

To run the sanyambassi/thales-cdsp-cakm-mcp-server MCP server, clone the repository, create a virtual environment with `uv`, install the project in editable mode, and start the Python module `database_tde_server`. The README also provides a connection test command before startup.

Configuration is supplied through environment variables. `DB_TDE_DATABASE_CONNECTIONS` contains a JSON array describing configured SQL Server and Oracle connections, including database credentials and, for Oracle, optional Oracle and SSH configuration. `DB_TDE_SERVER_NAME` sets the server name, while `DB_TDE_LOG_LEVEL` controls the logging level.

The repository includes example MCP configurations for Claude Desktop and Cursor. Their launch configuration runs `uv run python -m database_tde_server` from the cloned project directory. Paths, credentials, hosts, and connection values in those examples must be replaced with environment-specific values.

## Tools and capabilities

- List configured database connections with `list_database_connections`.
- Review combined TDE health, configuration, and compliance information with `status_tde_ekm`.
- Manage SQL Server EKM providers, credentials, and related logins with `manage_sql_ekm_objects`.
- Create, list, drop, and rotate SQL Server asymmetric master keys and database encryption keys with `manage_sql_keys`.
- Encrypt or decrypt SQL Server databases with `manage_sql_encryption`.
- Run Oracle TDE deployment and HSM migration workflows with `manage_oracle_tde_deployment`.
- Change Oracle TDE-related parameters, operate wallets, and manage Oracle master encryption keys.
- Encrypt or decrypt selected Oracle tablespaces.

## Limitations and notes

This server is specific to SQL Server and Oracle database TDE and EKM workflows. Its CipherTrust integration depends on CAKM providers being installed and configured on the database servers. The README does not describe a direct MCP connection to CipherTrust Manager.

The supplied setup examples contain placeholder paths and sample credentials; they are not runnable unchanged. Database access, Oracle privileges, CAKM installation, wallet configuration, and SSH access must be prepared separately. The provided material does not state a software license or describe support for additional database engines.

_Full upstream README: https://allmcps.com/mcp/sanyambassi-thales-cdsp-cakm-mcp-server/readme_