system_informationLABSCO SUMMARY
One tool per subsystem, with the operation as an argument.
Grouping by subsystem keeps the tool list short enough for a model to hold, which matters on a platform this wide — key_management alone dispatches eighteen operations. Worth knowing before you deploy it: this is an independent project, not supported by Thales, and it acts with whatever privileges the CipherTrust account you give it holds, so a restricted admin profile is the sensible starting point.
What it is
A CipherTrust Manager server that wraps the ksctl CLI and groups the platform's surface into a few broad tools, each dispatching on an action name rather than exposing one tool per operation.
What you get
key_managementcovers the key lifecycle in one tool: list, create, get, delete, modify, archive, recover, revoke, reactivate, destroy, export, clone, generate_kcv and alias handlingcrypto_operationsruns encrypt, decrypt, reencrypt, sign, verify, hide and unhidesecrets_managementlists, creates, exports, versions and destroys secrets;vkeys_managementhandles versioned keysuser_management,group_management,groupmap_managementandpassword_policy_managementcover identitydomain_managementswitches domains and handles KEK listing, rotation and retry, plus syslog and log-forwarder redirection- CipherTrust Transparent Encryption gets its own family:
cte_client_management,cte_clientgroup_management,cte_policy_management,cte_profile_management,cte_process_set_management,cte_user_set_management,cte_resource_set_managementandcte_csi_storagegroup_management - Operations round it out —
system_information,service_management,licensing_management,network_management,ntp_management,properties_management,proxy_management,quorum_management,record_management,rotkey_management,scp_management,template_management,token_management,metrics_managementandakeyless_management
Requirements
Python 3.11 or higher with uv, plus access to a CipherTrust Manager instance. Set CIPHERTRUST_URL, CIPHERTRUST_USER and CIPHERTRUST_PASSWORD (CIPHERTRUST_NOSSLVERIFY for self-signed certs) in the environment or a .env file, then run uv run ciphertrust-mcp-server over stdio.
Setup effort
Build from source — git clone https://github.com/sanyambassi/ciphertrust-manager-mcp-server.git
USE CASES
01
Working the key lifecycle by asking
Create, rotate, archive or revoke keys and read back their aliases and labels without switching to the console.
02
Running a crypto operation on demand
Encrypt, decrypt, re-encrypt, sign or verify against a managed key from the conversation.
03
Managing CTE clients and guardpoints
Enrol clients, create and modify guardpoints, and manage the policies and resource sets behind them.
04
Checking the health of the appliance
Read system information, service state, licensing and audit records in one pass.
33 tools
Listed in project docs. Your client may show a different list.
key_managementuser_managementpassword_policy_managementgroup_managementdomain_managementcrypto_operationscte_clientgroup_managementcte_client_managementcte_csi_storagegroup_managementcte_policy_managementcte_profile_managementcte_process_set_managementcte_user_set_managementcte_resource_set_managementakeyless_managementgroupmap_managementkey_policy_managementlicensing_managementmetrics_managementnetwork_managementntp_managementproperties_managementproxy_managementquorum_managementrecord_managementrotkey_managementscp_managementsecrets_managementservice_managementtemplate_managementtoken_managementvkeys_managementBEFORE YOU INSTALL
What to know first
Tools you get
33 tools named in the project's documentation.
Requires
- uv
- Python 3.11 or later
- CIPHERTRUST_PASSWORD in your environment
- CIPHERTRUST_URL in your environment
- CIPHERTRUST_USER in your environment
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
TERMINAL
git clone https://github.com/sanyambassi/ciphertrust-manager-mcp-server.git
cd ciphertrust-manager-mcp-server
uv venv
uv pip install -e .MCP Clients
Claude Desktop, Cursor
JSON
{
"mcpServers": {
"ciphertrust": {
"command": "<YOUR_PATH_TO_CIPHERTRUST_MANAGER_MCP_SERVER>/.venv/bin/ciphertrust-mcp-server",
"env": {
"CIPHERTRUST_URL": "<YOUR_CIPHERTRUST_URL>",
"CIPHERTRUST_USER": "admin",
"CIPHERTRUST_PASSWORD": "<YOUR_CIPHERTRUST_PASSWORD>"
}
}
}
}<YOUR_PATH_TO_CIPHERTRUST_MANAGER_MCP_SERVER> is the full path of the ciphertrust-manager-mcp-server folder you cloned (on Windows the executable is .venv\Scripts\ciphertrust-mcp-server.exe). The three CIPHERTRUST_ values are your CipherTrust Manager URL and login; admin is the sample user. Add CIPHERTRUST_NOSSLVERIFY set to true for a self-signed certificate.
