A Model Context Protocol (MCP) server for Database EKM/TDE operations using CipherTrust Application Key Management (CAKM). - Resource-Based Management: Tools are organized by the database objects they manage (e.g., keys, encryption, wallets), not just by actions. - Operational Grouping: Each tool exposes multiple operations (e.g., create, list, rotate) for comprehensive lifecycle management. - Uni
Add this skill
npx mdskills install sanyambassi/thales-cdsp-cakm-mcp-serverComprehensive database TDE/EKM management with excellent Oracle detection logic and multi-platform support
A Model Context Protocol (MCP) server for Database EKM/TDE operations using CipherTrust Application Key Management (CAKM).
operations (e.g., create, list, rotate) for comprehensive lifecycle management.status_tde_ekm) provides health, compliance, and configuration monitoring across all supported databases.🎥 Watch Demo Video - See the MCP server in action managing database encryption
# Clone the repository
git clone https://github.com/sanyambassi/thales-cdsp-cakm-mcp-server.git
cd thales-cdsp-cakm-mcp-server
# Install dependencies
uv venv && source .venv/bin/activate # Linux/Mac
# uv venv && .venv\Scripts\activate # Windows
uv pip install -e .
# Configure (copy the example configuration)
# Note: Create your own .env file with database connection details
# See docs/PREREQUISITES.md for configuration examples
# Test connections
uv run python -m database_tde_server --test-connections
# Start the MCP server
uv run python -m database_tde_server
uvThis project uses uv to manage dependencies and run scripts. Please install it using one of the methods below.
Windows (PowerShell):
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
Linux, macOS, and other shells:
curl -LsSf https://astral.sh/uv/install.sh | sh
For more information, visit the uv installation guide.
list_database_connections(): Lists all configured database connections.status_tde_ekm(): Provides a unified interface to monitor the health, configuration, and compliance of TDE across both SQL Server and Oracle.manage_sql_ekm_objects(): Manages EKM providers, credentials, and their associated server logins.manage_sql_keys(): Manages the lifecycle of cryptographic keys (Asymmetric Master Keys and DEKs), including creation, listing, dropping, and rotation.manage_sql_encryption(): Encrypts or decrypts one or more SQL Server databases.manage_oracle_tde_deployment(): Handles high-level TDE deployment workflows like initial setup or migration to/from an HSM.manage_oracle_configuration(): Manages TDE-related database parameters.manage_oracle_wallet(): Performs all wallet-specific actions (open, close, backup, manage auto-login).manage_oracle_keys(): Manages the lifecycle of Master Encryption Keys (MEKs), including rotation and listing.manage_oracle_tablespace_encryption(): Manages the encryption and decryption of specific tablespaces.Add to your AI assistant configuration:
{
"mcpServers": {
"database-tde": {
"command": "uv",
"args": ["run", "python", "-m", "database_tde_server"],
"cwd": "/path/to/cakm-mcp-server-sql-oracle",
"env": {
"DB_TDE_SERVER_NAME": "database-tde-mcp",
"DB_TDE_LOG_LEVEL": "INFO",
"DB_TDE_DATABASE_CONNECTIONS": "[{\"name\":\"prod_sql\",\"db_type\":\"sqlserver\",\"host\":\"sql-prod.company.com\",\"port\":1433,\"username\":\"tde_admin\",\"password\":\"secure_password\"},{\"name\":\"oracle_cdb1\",\"db_type\":\"oracle\",\"host\":\"oracle-prod.company.com\",\"port\":1521,\"username\":\"sys\",\"password\":\"oracle_password\",\"oracle_config\":{\"oracle_home\":\"/u01/app/oracle/product/21.0.0/dbhome_1\",\"oracle_sid\":\"cdb1\",\"service_name\":\"orcl\",\"mode\":\"SYSDBA\",\"wallet_root\":\"/opt/oracle/wallet\"},\"ssh_config\":{\"host\":\"oracle-prod.company.com\",\"username\":\"oracle\",\"private_key_path\":\"/path/to/private-key.pem\",\"port\":22,\"timeout\":30}}]"
}
}
}
}
{
"mcpServers": {
"database-tde": {
"command": "uv",
"args": ["run", "python", "-m", "database_tde_server"],
"cwd": "/path/to/cakm-mcp-server-sql-oracle",
"env": {
"DB_TDE_SERVER_NAME": "database-tde-mcp",
"DB_TDE_LOG_LEVEL": "INFO",
"DB_TDE_DATABASE_CONNECTIONS": "[{\"name\":\"prod_sql\",\"db_type\":\"sqlserver\",\"host\":\"sql-prod.company.com\",\"port\":1433,\"username\":\"tde_admin\",\"password\":\"secure_password\"},{\"name\":\"oracle_cdb1\",\"db_type\":\"oracle\",\"host\":\"oracle-prod.company.com\",\"port\":1521,\"username\":\"sys\",\"password\":\"oracle_password\",\"oracle_config\":{\"oracle_home\":\"/u01/app/oracle/product/21.0.0/dbhome_1\",\"oracle_sid\":\"cdb1\",\"service_name\":\"orcl\",\"mode\":\"SYSDBA\",\"wallet_root\":\"/opt/oracle/wallet\"},\"ssh_config\":{\"host\":\"oracle-prod.company.com\",\"username\":\"oracle\",\"private_key_path\":\"/path/to/private-key.pem\",\"port\":22,\"timeout\":30}}]"
}
}
}
}
{
"mcpServers": {
"database-tde": {
"command": "uv",
"args": ["run", "python", "-m", "database_tde_server"],
"cwd": "/path/to/cakm-mcp-server-sql-oracle",
"env": {
"DB_TDE_SERVER_NAME": "database-tde-mcp",
"DB_TDE_LOG_LEVEL": "INFO",
"DB_TDE_DATABASE_CONNECTIONS": "[{\"name\":\"prod_sql\",\"db_type\":\"sqlserver\",\"host\":\"sql-prod.company.com\",\"port\":1433,\"username\":\"tde_admin\",\"password\":\"secure_password\"},{\"name\":\"oracle_cdb1\",\"db_type\":\"oracle\",\"host\":\"oracle-prod.company.com\",\"port\":1521,\"username\":\"sys\",\"password\":\"oracle_password\",\"oracle_config\":{\"oracle_home\":\"/u01/app/oracle/product/21.0.0/dbhome_1\",\"oracle_sid\":\"cdb1\",\"service_name\":\"orcl\",\"mode\":\"SYSDBA\",\"wallet_root\":\"/opt/oracle/wallet\"},\"ssh_config\":{\"host\":\"oracle-prod.company.com\",\"username\":\"oracle\",\"private_key_path\":\"/path/to/private-key.pem\",\"port\":22,\"timeout\":30}}]"
}
}
}
}
MCP Server ↔ Database Server ↔ CAKM Provider/Library ↔ CipherTrust Manager
Note: This MCP server communicates only with database servers. The CAKM providers installed on database servers handle all communication with CipherTrust Manager.
The server uses Oracle-documented logic to determine TDE status based on wallet configurations and TDE parameters:
✅ TDE is ENABLED when:
OPEN status AND Master Encryption Keys (MEKs) exist📊 Wallet Order Types (from Oracle V$ENCRYPTION_WALLET):
🔧 TDE Configuration Parameter Values:
📊 Supported TDE Scenarios:
🔍 Migration Detection Logic:
📋 Status Information:
The oracle_tde_deployment tool provides different operations for various TDE setup scenarios:
1. HSM-Only TDE Setup (No Auto-login)
{
"oracle_connection": "oracle_cdb2",
"operation": "setup_hsm_only",
"ciphertrust_username": "tdeuser",
"ciphertrust_password": "Thales123!",
"ciphertrust_domain": "TDE",
"auto_restart": true
}
2. Complete TDE Setup (HSM + Auto-login)
{
"oracle_connection": "oracle_cdb2",
"operation": "setup_hsm_with_autologin",
"ciphertrust_username": "tdeuser",
"ciphertrust_password": "Thales123!",
"ciphertrust_domain": "TDE",
"software_wallet_password": "Thales123!",
"auto_restart": true
}
3. Add Auto-login to Existing TDE
{
"oracle_connection": "oracle_cdb2",
"operation": "add_autologin",
"ciphertrust_username": "tdeuser",
"ciphertrust_password": "Thales123!",
"ciphertrust_domain": "TDE",
"software_wallet_password": "Thales123!",
"auto_restart": true
}
4. Check TDE Status
{
"oracle_connection": "oracle_cdb2",
"operation": "get_tde_status"
}
setup_hsm_onlysetup_hsm_with_autologinadd_autologinget_tde_status📚 References:
"Show me the TDE status of all my databases"
"For my 'prod_sql' connection, list all the asymmetric keys using the 'manage_sql_keys' tool"
"Rotate the master key on the 'Db05' database using the 'prod_sql' connection"
"Encrypt the 'SalesDB' database on my 'prod_sql' server"
"What is the wallet status for my 'oracle_cdb2' connection?"
"private_key_path": "/path/to/key.pem" in ssh_config"password": "your_ssh_password" in ssh_config (instead of private_key_path)This project is licensed under the MIT License - see the LICENSE file for details.
Install via CLI
npx mdskills install sanyambassi/thales-cdsp-cakm-mcp-serverThales CipherTrust Data Security Platform CAKM MCP Server is a free, open-source AI agent skill. A Model Context Protocol (MCP) server for Database EKM/TDE operations using CipherTrust Application Key Management (CAKM). - Resource-Based Management: Tools are organized by the database objects they manage (e.g., keys, encryption, wallets), not just by actions. - Operational Grouping: Each tool exposes multiple operations (e.g., create, list, rotate) for comprehensive lifecycle management. - Uni
Install Thales CipherTrust Data Security Platform CAKM MCP Server with a single command:
npx mdskills install sanyambassi/thales-cdsp-cakm-mcp-serverThis downloads the skill files into your project and your AI agent picks them up automatically.
Thales CipherTrust Data Security Platform CAKM MCP Server works with Claude Code, Claude Desktop, Cursor, Vscode Copilot, Windsurf, Continue Dev, Gemini Cli, Amp, Roo Code, Goose. Skills use the open SKILL.md format which is compatible with any AI coding agent that reads markdown instructions.