A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/sanyambassi/thales-cdsp-cakm-mcp-server below:

sanyambassi/thales-cdsp-cakm-mcp-server: MCP Server to manage encryption for Ms SQL and Oracle databases using Thales CAKM connector

Thales CipherTrust Data Security Platform CAKM MCP Server

A Model Context Protocol (MCP) server for Database EKM/TDE operations using CipherTrust Application Key Management (CAKM).

🎥 Watch Demo Video - See the MCP server in action managing database encryption

# Clone the repository
git clone https://github.com/sanyambassi/thales-cdsp-cakm-mcp-server.git
cd thales-cdsp-cakm-mcp-server
# Install dependencies
uv venv && source .venv/bin/activate  # Linux/Mac
# uv venv && .venv\Scripts\activate   # Windows
uv pip install -e .

# Configure (copy the example configuration)
# Note: Create your own .env file with database connection details
# See docs/PREREQUISITES.md for configuration examples

# Test connections
uv run python -m database_tde_server --test-connections
# Start the MCP server
uv run python -m database_tde_server

This project uses uv to manage dependencies and run scripts. Please install it using one of the methods below.

Windows (PowerShell):

powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Linux, macOS, and other shells:

curl -LsSf https://astral.sh/uv/install.sh | sh

For more information, visit the uv installation guide.

🤖 AI Assistant Integration

Add to your AI assistant configuration:

{
  "mcpServers": {
    "database-tde": {
      "command": "uv",
      "args": ["run", "python", "-m", "database_tde_server"],
      "cwd": "/path/to/cakm-mcp-server-sql-oracle",
      "env": {
        "DB_TDE_SERVER_NAME": "database-tde-mcp",
        "DB_TDE_LOG_LEVEL": "INFO",
        "DB_TDE_DATABASE_CONNECTIONS": "[{\"name\":\"prod_sql\",\"db_type\":\"sqlserver\",\"host\":\"sql-prod.company.com\",\"port\":1433,\"username\":\"tde_admin\",\"password\":\"secure_password\"},{\"name\":\"oracle_cdb1\",\"db_type\":\"oracle\",\"host\":\"oracle-prod.company.com\",\"port\":1521,\"username\":\"sys\",\"password\":\"oracle_password\",\"oracle_config\":{\"oracle_home\":\"/u01/app/oracle/product/21.0.0/dbhome_1\",\"oracle_sid\":\"cdb1\",\"service_name\":\"orcl\",\"mode\":\"SYSDBA\",\"wallet_root\":\"/opt/oracle/wallet\"},\"ssh_config\":{\"host\":\"oracle-prod.company.com\",\"username\":\"oracle\",\"private_key_path\":\"/path/to/private-key.pem\",\"port\":22,\"timeout\":30}}]"
      }
    }
  }
}
{
  "mcpServers": {
    "database-tde": {
      "command": "uv",
      "args": ["run", "python", "-m", "database_tde_server"],
      "cwd": "/path/to/cakm-mcp-server-sql-oracle",
      "env": {
        "DB_TDE_SERVER_NAME": "database-tde-mcp",
        "DB_TDE_LOG_LEVEL": "INFO",
        "DB_TDE_DATABASE_CONNECTIONS": "[{\"name\":\"prod_sql\",\"db_type\":\"sqlserver\",\"host\":\"sql-prod.company.com\",\"port\":1433,\"username\":\"tde_admin\",\"password\":\"secure_password\"},{\"name\":\"oracle_cdb1\",\"db_type\":\"oracle\",\"host\":\"oracle-prod.company.com\",\"port\":1521,\"username\":\"sys\",\"password\":\"oracle_password\",\"oracle_config\":{\"oracle_home\":\"/u01/app/oracle/product/21.0.0/dbhome_1\",\"oracle_sid\":\"cdb1\",\"service_name\":\"orcl\",\"mode\":\"SYSDBA\",\"wallet_root\":\"/opt/oracle/wallet\"},\"ssh_config\":{\"host\":\"oracle-prod.company.com\",\"username\":\"oracle\",\"private_key_path\":\"/path/to/private-key.pem\",\"port\":22,\"timeout\":30}}]"
      }
    }
  }
}
Gemini CLI (settings.json) 
{
  "mcpServers": {
    "database-tde": {
      "command": "uv",
      "args": ["run", "python", "-m", "database_tde_server"],
      "cwd": "/path/to/cakm-mcp-server-sql-oracle",
      "env": {
        "DB_TDE_SERVER_NAME": "database-tde-mcp",
        "DB_TDE_LOG_LEVEL": "INFO",
        "DB_TDE_DATABASE_CONNECTIONS": "[{\"name\":\"prod_sql\",\"db_type\":\"sqlserver\",\"host\":\"sql-prod.company.com\",\"port\":1433,\"username\":\"tde_admin\",\"password\":\"secure_password\"},{\"name\":\"oracle_cdb1\",\"db_type\":\"oracle\",\"host\":\"oracle-prod.company.com\",\"port\":1521,\"username\":\"sys\",\"password\":\"oracle_password\",\"oracle_config\":{\"oracle_home\":\"/u01/app/oracle/product/21.0.0/dbhome_1\",\"oracle_sid\":\"cdb1\",\"service_name\":\"orcl\",\"mode\":\"SYSDBA\",\"wallet_root\":\"/opt/oracle/wallet\"},\"ssh_config\":{\"host\":\"oracle-prod.company.com\",\"username\":\"oracle\",\"private_key_path\":\"/path/to/private-key.pem\",\"port\":22,\"timeout\":30}}]"
      }
    }
  }
}
MCP Server ↔ Database Server ↔ CAKM Provider/Library ↔ CipherTrust Manager

Note: This MCP server communicates only with database servers. The CAKM providers installed on database servers handle all communication with CipherTrust Manager.

Oracle TDE Enablement Logic

The server uses Oracle-documented logic to determine TDE status based on wallet configurations and TDE parameters:

✅ TDE is ENABLED when:

📊 Wallet Order Types (from Oracle V$ENCRYPTION_WALLET):

🔧 TDE Configuration Parameter Values:

📊 Supported TDE Scenarios:

  1. HSM-only TDE: HSM wallet OPEN (SINGLE), TDE_CONFIGURATION=HSM
  2. HSM with Auto-login (Migrated): HSM wallet OPEN (PRIMARY), auto-login wallet OPEN (SECONDARY), TDE_CONFIGURATION=HSM|FILE
  3. HSM with Auto-login (Not Migrated): HSM wallet OPEN (PRIMARY), auto-login wallet OPEN_NO_MASTER_KEY (SECONDARY), TDE_CONFIGURATION=HSM|FILE
  4. FILE wallet TDE: PASSWORD wallet OPEN (SINGLE), TDE_CONFIGURATION=FILE
  5. FILE with Auto-login (Reverse Migrated): PASSWORD wallet OPEN (PRIMARY), auto-login wallet OPEN (SECONDARY), TDE_CONFIGURATION=FILE|HSM
  6. FILE with Auto-login: PASSWORD wallet OPEN (PRIMARY), auto-login wallet OPEN (SECONDARY), TDE_CONFIGURATION=FILE

🔍 Migration Detection Logic:

📋 Status Information:

🔧 Oracle TDE Operations Guide

The oracle_tde_deployment tool provides different operations for various TDE setup scenarios:

Operation Types & Use Cases

1. HSM-Only TDE Setup (No Auto-login)

{
  "oracle_connection": "oracle_cdb2",
  "operation": "setup_hsm_only",
  "ciphertrust_username": "tdeuser",
  "ciphertrust_password": "Thales123!",
  "ciphertrust_domain": "TDE",
  "auto_restart": true
}

2. Complete TDE Setup (HSM + Auto-login)

{
  "oracle_connection": "oracle_cdb2",
  "operation": "setup_hsm_with_autologin",
  "ciphertrust_username": "tdeuser", 
  "ciphertrust_password": "Thales123!",
  "ciphertrust_domain": "TDE",
  "software_wallet_password": "Thales123!",
  "auto_restart": true
}

3. Add Auto-login to Existing TDE

{
  "oracle_connection": "oracle_cdb2",
  "operation": "add_autologin",
  "ciphertrust_username": "tdeuser",
  "ciphertrust_password": "Thales123!", 
  "ciphertrust_domain": "TDE",
  "software_wallet_password": "Thales123!",
  "auto_restart": true
}

4. Check TDE Status

{
  "oracle_connection": "oracle_cdb2",
  "operation": "get_tde_status"
}

📚 References:

"Show me the TDE status of all my databases"
"For my 'prod_sql' connection, list all the asymmetric keys using the 'manage_sql_keys' tool"
"Rotate the master key on the 'Db05' database using the 'prod_sql' connection"
"Encrypt the 'SalesDB' database on my 'prod_sql' server"
"What is the wallet status for my 'oracle_cdb2' connection?"
  1. Fork the repository
  2. Create a feature branch
  3. Make your changes
  4. Add tests for new functionality
  5. Ensure all tests pass
  6. Submit a pull request

This project is licensed under the MIT License - see the LICENSE file for details.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4