Overview

This project is an MCP (Model Context Protocol) server that integrates with Thales CDSP to manage CipherTrust CRDP data protection operations via RESTful APIs. It acts as an intermediary between context-aware applications (for example, LLM-based agents or data pipelines) and Thales CDSP, exposing a consistent HTTP interface to perform encryption, decryption, tokenization, key retrieval, and policy-driven masking operations.

By centralizing CRDP interactions behind an MCP-compatible API, the server simplifies secure handling of sensitive data in developer workflows. It reduces the effort required to call CDSP directly from multiple services, enables consistent audit and logging of protection operations, and supports configuration options such as authentication, TLS, and request/response mapping for common developer scenarios.

Features

RESTful MCP endpoints for common CRDP operations (encrypt, decrypt, tokenize, detokenize, mask, unmask)
Adapter to call Thales CDSP REST APIs with configurable base URL and credentials
Docker-ready: run as a container for easy deployment
Configurable authentication to CDSP (API key, basic auth, or token)
Health and metrics endpoints (liveness, readiness, Prometheus metrics)
Request/response transformation and logging for auditability
Support for TLS and configurable ports
Simple JSON/YAML configuration for mapping MCP operations to CDSP endpoints

Installation / Configuration

Clone the repository and run with Docker. Replace environment variables with values for your CDSP instance.

git clone https://github.com/sanyambassi/thales-cdsp-crdp-mcp-server.git
cd thales-cdsp-crdp-mcp-server

Build and run using Docker:

# Build (if a Dockerfile is provided)
docker build -t thales-cdsp-mcp-server .

# Run container (example)
docker run -d \
  --name thales-cdsp-mcp \
  -p 8080:8080 \
  -e CDSP_BASE_URL=https://cdsp.example.com/api \
  -e CDSP_API_KEY=your_api_key_here \
  -e MCP_PORT=8080 \
  thales-cdsp-mcp-server:latest

Or use docker-compose:

version: "3.7"
services:
  mcp-server:
    image: thales-cdsp-mcp-server:latest
    ports:
      - "8080:8080"
    environment:
      CDSP_BASE_URL: "https://cdsp.example.com/api"
      CDSP_API_KEY: "your_api_key_here"
      MCP_PORT: "8080"
      LOG_LEVEL: "info"
    restart: unless-stopped

Configuration file (example config.yml):

server:
  port: 8080
  tls: false

cdsp:
  baseUrl: "https://cdsp.example.com/api"
  auth:
    type: "apiKey"
    apiKey: "YOUR_API_KEY"

operations:
  encrypt: "/crdp/encrypt"
  decrypt: "/crdp/decrypt"
  tokenize: "/crdp/tokenize"
  detokenize: "/crdp/detokenize"
  mask: "/crdp/mask"

Common environment variables

Variable	Purpose
CDSP_BASE_URL	Base URL for Thales CDSP REST API
CDSP_API_KEY	API key or token used to authenticate to CDSP
MCP_PORT	Port to expose the MCP server on
LOG_LEVEL	Logging verbosity (debug, info, warn, error)
TLS_CERT / TLS_KEY	Optional TLS cert and key for HTTPS

Available Resources

Repository: https://github.com/sanyambassi/thales-cdsp-crdp-mcp-server
Thales CipherTrust CDSP documentation: consult your Thales support portal or product docs for the exact CRDP REST API reference
MCP / integration guidelines: Review any organization-specific MCP expectations (authentication header formats, request metadata, and audit fields)

Health and utility endpoints (typical)

Endpoint	Purpose
GET /health	Basic liveness/readiness
GET /metrics	Prometheus-style metrics
POST /mcp/v1/operation	Generic MCP operation endpoint (body selects action)

Use Cases

Tokenize user PII before storing in a vector database
- Flow: application sends PII via the MCP server to the tokenize operation → server calls CDSP tokenization endpoint → returns token to store in DB. Later, detokenize only when needed by authorized services.
- Example curl:
```
curl -X POST http://localhost:8080/mcp/v1/operation \
  -H "Content-Type: application/json" \
  -d '{"action":"tokenize","payload":{"field":"email","value":"[email protected]"}}'
```
Mask sensitive fields before passing to an LLM
- Flow: pre-processing step calls MCP mask to apply CRDP masking policies, then sends masked content to LLM to avoid exposing PII to third-party models.
Decrypting data within a secure pipeline
- Flow: data encrypted with CRDP is pulled from storage, sent to the MCP server’s decrypt operation, which performs authorization and calls CDSP to return plaintext to an internal service. Access is logged for audit.
Centralized key retrieval for server-side operations
- Flow: an application requests decryption keys or key metadata (respecting policy) via the MCP server rather than calling CDSP directly, simplifying secret management and reducing credential sprawl.

Tips & Troubleshooting

Ensure the CDSP_BASE_URL is reachable from the MCP server and that any required certificates are installed.
Use LOG_LEVEL=debug when integrating for the first time to inspect mapped requests and responses (avoid logging secrets in production).
Validate CDSP credentials with a simple direct curl to the CDSP health or token endpoint before using the MCP adapter.
Confirm network egress rules or proxy settings if running in a restricted environment.

For code-level examples and the latest instructions, consult the repository README and examples on GitHub.

Thales CDSP CRDP MCP Server – CipherTrust Integration