Thales CDSP CAKM MCP Server for Oracle & MSSQL

Overview

This MCP (Model Context Protocol) server acts as a lightweight bridge between Thales CDSP CAKM (centralized key manager) and on-premise Oracle and Microsoft SQL Server databases. It exposes a KMS-compatible interface that database engines and their key-management plugins can call, and translates those calls into CAKM API operations — enabling centralized key lifecycle, auditability and secure encryption without modifying the database itself.

For DBAs and security engineers, this makes it straightforward to apply centralized key policies (rotate, revoke, audit), meet compliance requirements, and consolidate encryption keys in Thales CDSP while preserving the native database encryption features such as Oracle TDE and MSSQL TDE/Always Encrypted.

Features

• KMS-proxy for Thales CDSP CAKM to support Oracle and MSSQL integrations
• RESTful/KMS-compatible interface that database key managers can target
• TLS support for encrypted transport between database and MCP server
• Configurable CAKM endpoint, credentials and key aliases
• Docker-friendly: run as a container or a standalone binary
• Logging, metrics hooks and pluggable authentication configuration
• Sample configuration files and deployment examples

Installation / Configuration

Prerequisites:

• Running Thales CDSP CAKM instance with API access
• Oracle or Microsoft SQL Server instance
• Docker engine (recommended) or Linux host with Go-built binary
• TLS certificates for secure communication (recommended)

Clone and build (if compiling locally):

git clone https://github.com/sanyambassi/thales-cdsp-cakm-mcp-server.git
cd thales-cdsp-cakm-mcp-server

# If Go project:
go build -o mcp-server ./cmd/mcp-server

Run with Docker:

# Build image (optional)
docker build -t thales-cakm-mcp-server .

# Run container (example)
docker run -d \
  --name mcp-server \
  -p 8443:8443 \
  -e CAKM_ENDPOINT=https://cakm.example.com/api \
  -e CAKM_CLIENT_ID=your-client-id \
  -e CAKM_CLIENT_SECRET=your-client-secret \
  -e MCP_TLS_CERT=/certs/server.crt \
  -e MCP_TLS_KEY=/certs/server.key \
  -v /path/to/certs:/certs:ro \
  thales-cakm-mcp-server

Sample YAML configuration (mcp-config.yml):

server:
  listen: 0.0.0.0:8443
  tls:
    cert: /certs/server.crt
    key: /certs/server.key

cakm:
  endpoint: "https://cakm.example.com/api"
  auth:
    type: client_secret
    client_id: "your-client-id"
    client_secret: "your-client-secret"

mappings:
  - db_provider: oracle
    key_alias: "oracle/tde/master"
  - db_provider: mssql
    key_alias: "mssql/tde/master"

Restart the server after updating configuration:

docker restart mcp-server
# or if running binary:
./mcp-server --config /etc/mcp/mcp-config.yml

Database-side configuration (conceptual):

• Oracle: configure your TDE/KMS provider to point at the MCP server URL and install the MCP server root certificate into the Oracle wallet or keystore.
• MSSQL: configure EKM/CNG provider or Always Encrypted key store to use the MCP server endpoint and trust its certificate.

Note: exact database steps depend on the database version and the chosen key-provider plugin. Use the database vendor docs to bind an external KMS and point it to the MCP server URL, port and certificate.

Available Resources

• Source code and issues: https://github.com/sanyambassi/thales-cdsp-cakm-mcp-server
• Sample configuration files: see the repo’s examples/ directory
• TLS certificate examples and scripts for generating test certs in the repo
• Logging/metrics endpoints (if enabled) described in repo README

Use Cases

1. Oracle TDE with centralized keys

   • Deploy MCP server in the DMZ or key-management network.
   • Configure Oracle TDE KMS integration to use the MCP endpoint and a mapped key alias (e.g., oracle/tde/master).
   • Rotate the CAKM master key centrally; Oracle continues to use its locally wrapped DEKs without direct access to raw master keys.

2. MSSQL TDE and Always Encrypted

   • Point MSSQL EKM/CNG provider to MCP server for database master key operations.
   • Use MCP to enforce key-rotation windows and centralized audit logging for encryption key usage.

3. Compliance and separation of duties

   • Security team manages keys in Thales CDSP CAKM.
   • DBAs manage schema and encryption configuration without direct access to master key material.
   • Audit trails and centralized key policies help satisfy regulatory requirements.

Integration Matrix

If you are new to integrating external key managers with databases, start by validating connectivity and TLS trust between the database host and the MCP server, then configure a non-production database to use the mapped key alias before moving to production. For specific database integration steps, consult your DB vendor’s documentation for external KMS or EKM/CNG provider configuration.