Summary

One tool per subsystem, with the operation as an argument.

Grouping by subsystem keeps the tool list short enough for a model to hold, which matters on a platform this wide — `key_management` alone dispatches eighteen operations. Worth knowing before you deploy it: this is an independent project, not supported by Thales, and it acts with whatever privileges the CipherTrust account you give it holds, so a restricted admin profile is the sensible starting point.

What it is

A CipherTrust Manager server that wraps the ksctl CLI and groups the platform's surface into a few broad tools, each dispatching on an action name rather than exposing one tool per operation.

What you get

`key_management` covers the key lifecycle in one tool: list, create, get, delete, modify, archive, recover, revoke, reactivate, destroy, export, clone, generate_kcv and alias handling
`crypto_operations` runs encrypt, decrypt, reencrypt, sign, verify, hide and unhide
`secrets_management` lists, creates, exports, versions and destroys secrets; `vkeys_management` handles versioned keys
`user_management`, `group_management`, `groupmap_management` and `password_policy_management` cover identity
`domain_management` switches domains and handles KEK listing, rotation and retry, plus syslog and log-forwarder redirection
CipherTrust Transparent Encryption gets its own family: `cte_client_management`, `cte_clientgroup_management`, `cte_policy_management`, `cte_profile_management`, `cte_process_set_management`, `cte_user_set_management`, `cte_resource_set_management` and `cte_csi_storagegroup_management`
Operations round it out — `system_information`, `service_management`, `licensing_management`, `network_management`, `ntp_management`, `properties_management`, `proxy_management`, `quorum_management`, `record_management`, `rotkey_management`, `scp_management`, `template_management`, `token_management`, `metrics_management` and `akeyless_management`

Requirements

Python 3.11 or higher with uv, plus access to a CipherTrust Manager instance. Set CIPHERTRUST_URL, CIPHERTRUST_USER and CIPHERTRUST_PASSWORD (CIPHERTRUST_NOSSLVERIFY for self-signed certs) in the environment or a .env file, then run `uv run ciphertrust-mcp-server` over stdio.

Setup effort

One command plus a key — Path to your project folder/ciphertrust-manager-mcp-server/.venv/bin/ciphertrust-mcp-server, then supply credentials