Thales CipherTrust Manager MCP Server for ksctl Integration

Overview

This MCP (Model Context Protocol) server provides a lightweight bridge between Thales CipherTrust Manager and AI assistant workflows (for example, Claude, Cursor) and developer tooling such as ksctl. By implementing the MCP surface, the server exposes CipherTrust Manager resources in a standardized, machine-readable way so AI assistants and automation tools can discover and reference keys, secrets, and policies during prompts, actions, or pipeline runs.

Why this is useful: many AI assistants and modern control-plane tools expect a model context endpoint to enumerate available resources. This server translates CipherTrust Manager concepts into that expected MCP format, handling authentication, pagination, and basic filtering. That lets ksctl (and other clients) integrate CipherTrust-backed secrets and keys without embedding CipherTrust-specific APIs into those tools.

Repository: https://github.com/sanyambassi/ciphertrust-manager-mcp-server

Features

• MCP-compliant HTTP API to list and describe CipherTrust Manager resources
• Authentication proxying to the CipherTrust Manager (API key / token)
• Health and metrics endpoints for observability
• Pagination and filtering for large secret/key inventories
• JSON response schemas compatible with AI assistant context ingestion
• Lightweight Go-based server suitable for container deployment

Installation / Configuration

The server is distributed as a simple Go binary and is typically deployed as a container. Below are steps to build, run, and configure the service.

Build locally (requires Go):

git clone https://github.com/sanyambassi/ciphertrust-manager-mcp-server.git
cd ciphertrust-manager-mcp-server
go build -o ciphertrust-mcp-server ./cmd/server

Run with environment variables:

export CTM_ENDPOINT="https://ciphertrust.example.com"
export CTM_API_KEY="your-ciphertrust-api-key"
export MCP_BIND_ADDR="0.0.0.0:8080"
./ciphertrust-mcp-server

Docker image (build and run):

docker build -t ciphertrust-mcp-server:latest .
docker run -e CTM_ENDPOINT=https://ciphertrust.example.com \
           -e CTM_API_KEY=your-ciphertrust-api-key \
           -p 8080:8080 \
           ciphertrust-mcp-server:latest

Example Kubernetes Deployment (manifest excerpt):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ciphertrust-mcp-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ciphertrust-mcp
  template:
    metadata:
      labels:
        app: ciphertrust-mcp
    spec:
      containers:
      - name: mcp-server
        image: registry.example.com/ciphertrust-mcp-server:latest
        env:
        - name: CTM_ENDPOINT
          value: "https://ciphertrust.example.com"
        - name: CTM_API_KEY
          valueFrom:
            secretKeyRef:
              name: ciphertrust-creds
              key: apiKey
        ports:
        - containerPort: 8080
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080

Common configuration environment variables:

• CTM_ENDPOINT — CipherTrust Manager base URL
• CTM_API_KEY — API key or token used to authenticate to CipherTrust
• MCP_BIND_ADDR — address to bind MCP server (default :8080)
• LOG_LEVEL — debug/info/warn/error

Available Resources

The server exposes MCP-style resources via HTTP. Typical endpoints:

• GET /mcp/v1/resources — list resources (supports query params: type, limit, offset)
• GET /mcp/v1/resources/{id} — retrieve a single resource
• GET /healthz — liveness probe
• GET /metrics — Prometheus metrics

Supported resource types (returned as part of resource JSON):

Example: list secrets (curl)

curl -s "http://localhost:8080/mcp/v1/resources?type=secret&limit=50" \
  -H "Authorization: Bearer <mcp-client-token>" | jq

Typical resource JSON (abridged):

{
  "id": "secret-1234",
  "type": "secret",
  "name": "db-credentials",
  "metadata": {
    "created_at": "2025-01-20T12:34:56Z",
    "owner": "platform-team"
  },
  "data_ref": {
    "ciphertrust_id": "CT-abc-123"
  }
}

Use Cases

1. AI assistant context enrichment:

   • When an assistant is building or troubleshooting infrastructure-as-code, it can query the MCP server to discover available CipherTrust secrets and suggest correct resource names or IDs in generated manifests.

2. ksctl secret management:

   • ksctl can be configured to use the MCP server as a discovery layer. For example, a ksctl connector can ask the MCP server for a list of CipherTrust-managed keys and then create Kubernetes Secret resources referencing those keys.

3. CI/CD pipelines:

   • Build or deploy pipelines can query the MCP endpoint to fetch metadata about keys or secrets (without returning raw secret material), enabling secure runtime decisions, feature toggles, or key rotation checks.

4. Observability and audit:

   • Combined with the /metrics endpoint and health checks, teams can monitor MCP availability and usage patterns as part of their platform observability stack.

Getting Help / Contributing

For issues, feature requests, or to contribute code, open an issue or PR on the GitHub repository: https://github.com/sanyambassi/ciphertrust-manager-mcp-server. Follow the project’s contribution guidelines and include environment/configuration details when reporting bugs.