Kiteworks MCP Server for Secure LLM Integration

Overview

The Kiteworks MCP Server implements the Model Context Protocol (MCP) to let LLM-based assistants interact with a Kiteworks deployment in a secure, auditable way. It provides a controlled command-and-data channel so AI agents can list, search, read and manage Kiteworks files, folders and Secure Data Forms without being given raw credentials or unfettered access to the host system.

Designed for both single-user desktop integrations and centralized multi-user environments, the server supports native binaries for Windows, Linux and macOS, an HTTPS server deployment (Docker / systemd) and a local STDIO mode used by desktop assistants such as Claude. Enterprise features include OAuth 2.1 authentication, FIPS 140‑3 mode, TLS validation (with custom CA support) and configurable rate limits.

Features

• File operations: upload, download, get metadata, rename, move and delete (single or batch)
• Folder operations: create, rename, move, delete, navigate hierarchies and filtered searches
• Secure Data Forms: generate and preview forms from templates
• Search: by name or by content across files and folders
• User context: access current user details and authentication status
• Dual deployment modes: Local STDIO (single-user) and Remote HTTPS (multi-user)
• OAuth 2.1 with Dynamic Client Registration and Authorization Code + PKCE
• JWT access/refresh tokens with automatic refresh
• FIPS 140‑3 mode and NIST-approved crypto primitives, plus hybrid quantum-resistant TLS key exchange
• TLS certificate validation with option to supply a Root CA chain
• Configurable rate limiting (global, per-user, per-session)
• Native binaries for Windows, Linux, macOS; Docker-ready for server deployments

Installation / Configuration

Clone and releases:

git clone https://github.com/kiteworks/mcp.git
# Or download platform-specific binary from the repository releases

Run local STDIO mode (example: Claude Code integration)

# Windows
claude mcp add --transport stdio kiteworks C:\Path\To\kiteworks-mcp.exe start https://your.kiteworks.domain

# macOS / Linux
claude mcp add --transport stdio kiteworks /path/to/kiteworks-mcp start https://your.kiteworks.domain

Start HTTPS server using Docker (example)

docker run -d \
  --name kiteworks-mcp \
  -p 443:8443 \
  -e MCP_SERVER_URL=https://mcp.example.com \
  -e KITEWORKS_BASE_URL=https://kiteworks.example.com \
  -v /opt/mcp/certs:/etc/mcp/certs \
  kiteworks/mcp:latest

Systemd service example (simplified)

[Unit]
Description=Kiteworks MCP Server
After=network.target

[Service]
ExecStart=/usr/local/bin/kiteworks-mcp serve --config /etc/mcp/config.yml
Restart=on-failure

[Install]
WantedBy=multi-user.target

Common runtime flags

--ca-cert /path/to/ca_chain.pem         # Provide Root CA chain for Kiteworks TLS validation
--insecure-absolute-paths                # Allow absolute paths (disabled by default)
--enable-destructive-tools               # Enable move/delete operations (disabled by default)

Environment toggles

# Enable strict FIPS 140-3 mode
export GODEBUG=fips140=only

# If embedding into Claude Code with a self-signed CA
export NODE_EXTRA_CA_CERTS=/path/to/ca_chain.pem

Credentials and secrets are stored in the OS encrypted keystore; the MCP server never exposes raw credentials to the LLM context.

Deployment Modes

Available Resources

• GitHub repository (code, releases, docs): https://github.com/kiteworks/mcp
• Usage examples: docs/USAGE_EXAMPLES.md (composite workflows)
• Tool list: docs/AVAILABLE_TOOLS.md
• Deployment architecture and guide: docs/DEPLOYMENT_ARCHITECTURE.md and docs/DEPLOYMENT_GUIDE.md

Use Cases

1. Compliance review with forms

   • Create Secure Data Forms from templates to capture review notes and approvals.
   • Use search-by-content to locate relevant documents, attach forms, and record reviewer responses.

2. Sensitive data audit

   • Run content searches to surface files with regulated PII.
   • Generate audit-ready exports and attach a Secure Data Form for remediation workflow.

3. Project handover / deliverables collection

   • Collect files across project folders, batch-download deliverables and populate a checklist form for sign-off.
   • Use folder operations to restructure or archive completed projects securely.

4. Remote user support

   • Administrators authenticate via OAuth, inspect user metadata and session state, and provide guided assistance without SQL or credential exposure.

Security-first defaults, mandatory TLS validation and the separation of command vs. data channels make Kiteworks MCP Server suitable for enterprise LLM integrations where auditability and data protection are required. For developer-focused examples and tool references, see the linked repository docs.