Thales Cdsp Cakm MCP Server

What sanyambassi/thales-cdsp-cakm-mcp-server MCP server does

The sanyambassi/thales-cdsp-cakm-mcp-server MCP server exposes database Encryption Key Management and Transparent Data Encryption operations through the Model Context Protocol. It supports Microsoft SQL Server and Oracle Database environments that use Thales CipherTrust Application Key Management and CAKM providers.

Its tools are arranged around managed database resources rather than isolated commands. Operations cover cryptographic keys, encryption state, wallets, EKM providers, database configuration, and TDE deployment. The server also provides a consolidated status and auditing tool for checking TDE health, configuration, and compliance information across supported databases.

For Oracle, the implementation examines wallet status, wallet order, wallet types, TDE configuration parameters, and the presence of master encryption keys. It can distinguish HSM-only configurations, FILE wallet configurations, auto-login arrangements, and forward or reverse migration states.

How it works

The runtime communicates with database servers. Database-side CAKM providers and libraries handle communication with CipherTrust Manager, so the MCP process does not connect directly to CipherTrust Manager. The documented architecture is MCP server to database server, then to the CAKM provider or library and CipherTrust Manager.

Configured database connections identify the database type and connection details. Oracle entries can also include Oracle installation and instance settings, wallet locations, connection mode, and SSH details for access to the database host. SQL Server and Oracle operations are then selected through the corresponding MCP tools.

Oracle TDE status is determined from documented wallet and parameter combinations. TDE is treated as enabled when a wallet is open and master encryption keys are present. The implementation recognizes wallet order values such as SINGLE, PRIMARY, and SECONDARY, along with FILE, HSM, HSM|FILE, and FILE|HSM TDE configuration values.

Setup and configuration

To run the sanyambassi/thales-cdsp-cakm-mcp-server MCP server, clone the repository, create a virtual environment with uv, install the project in editable mode, and start the Python module database_tde_server. The README also provides a connection test command before startup.

Configuration is supplied through environment variables. DB_TDE_DATABASE_CONNECTIONS contains a JSON array describing configured SQL Server and Oracle connections, including database credentials and, for Oracle, optional Oracle and SSH configuration. DB_TDE_SERVER_NAME sets the server name, while DB_TDE_LOG_LEVEL controls the logging level.

The repository includes example MCP configurations for Claude Desktop and Cursor. Their launch configuration runs uv run python -m database_tde_server from the cloned project directory. Paths, credentials, hosts, and connection values in those examples must be replaced with environment-specific values.

Tools and capabilities

• List configured database connections with list_database_connections.
• Review combined TDE health, configuration, and compliance information with status_tde_ekm.
• Manage SQL Server EKM providers, credentials, and related logins with manage_sql_ekm_objects.
• Create, list, drop, and rotate SQL Server asymmetric master keys and database encryption keys with manage_sql_keys.
• Encrypt or decrypt SQL Server databases with manage_sql_encryption.
• Run Oracle TDE deployment and HSM migration workflows with manage_oracle_tde_deployment.
• Change Oracle TDE-related parameters, operate wallets, and manage Oracle master encryption keys.
• Encrypt or decrypt selected Oracle tablespaces.

Limitations and notes

This server is specific to SQL Server and Oracle database TDE and EKM workflows. Its CipherTrust integration depends on CAKM providers being installed and configured on the database servers. The README does not describe a direct MCP connection to CipherTrust Manager.

The supplied setup examples contain placeholder paths and sample credentials; they are not runnable unchanged. Database access, Oracle privileges, CAKM installation, wallet configuration, and SSH access must be prepared separately. The provided material does not state a software license or describe support for additional database engines.