NestDaddy

Data Prism

io.github.AindriuB/data-prism · v0.7.1

Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients.

Connect Runs on your machine

Terminal
claude mcp add data-prism -e LOADER_PATH=<LOADER_PATH> -e DATAPRISM_SECURITY_JWT_ISSUER=<DATAPRISM_SECURITY_JWT_ISSUER> -e DATAPRISM_SECURITY_JWT_AUDIENCE=<DATAPRISM_SECURITY_JWT_AUDIENCE> -e DATAPRISM_SECURITY_JWT_JWK_SET_URI=<DATAPRISM_SECURITY_JWT_JWK_SET_URI> -e DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI=<DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI> -e DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL=<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL> -e DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES=<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES> -e DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION=<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION> -e DATAPRISM_SECURITY_POLICY_PURPOSES=<DATAPRISM_SECURITY_POLICY_PURPOSES> -e DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR=<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR> -e DATAPRISM_PRIVACY_PROFILE=<DATAPRISM_PRIVACY_PROFILE> -e DATAPRISM_PRIVACY_SCOPE_LIFETIME=<DATAPRISM_PRIVACY_SCOPE_LIFETIME> -e DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID=<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID> -e DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE=<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE> -e DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE=<DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE> -e DATAPRISM_AUDIT_SINK=<DATAPRISM_AUDIT_SINK> -e DATAPRISM_AUDIT_WRITER_ID=<DATAPRISM_AUDIT_WRITER_ID> -e DATAPRISM_AUDIT_FILE_PATH=<DATAPRISM_AUDIT_FILE_PATH> -e DATAPRISM_METRICS_SINK=<DATAPRISM_METRICS_SINK> -e DATAPRISM_HAZELCAST_TOPOLOGY=<DATAPRISM_HAZELCAST_TOPOLOGY> -e DATAPRISM_HAZELCAST_CLUSTERNAME=<DATAPRISM_HAZELCAST_CLUSTERNAME> -e DATAPRISM_HAZELCAST_JOIN_MODE=<DATAPRISM_HAZELCAST_JOIN_MODE> -e DATAPRISM_HAZELCAST_JOIN_MEMBERS=<DATAPRISM_HAZELCAST_JOIN_MEMBERS> -e DATAPRISM_HAZELCAST_MEMBER_PORT=<DATAPRISM_HAZELCAST_MEMBER_PORT> -e DATAPRISM_OPERATOR_ENABLED=<DATAPRISM_OPERATOR_ENABLED> -e DATAPRISM_OPERATOR_PORT=<DATAPRISM_OPERATOR_PORT> -e DATAPRISM_OPERATOR_REQUIREDAUDIENCE=<DATAPRISM_OPERATOR_REQUIREDAUDIENCE> -e DATAPRISM_OPERATOR_REQUIREDSCOPE=<DATAPRISM_OPERATOR_REQUIREDSCOPE> -e DATAPRISM_SOURCES_CUSTOMER_BASE_URL=<DATAPRISM_SOURCES_CUSTOMER_BASE_URL> -e DATAPRISM_SOURCES_CUSTOMER_TIMEOUT=<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT> -- docker run -i --rm ghcr.io/aindriub/data-prism-server:0.7.1
claude_desktop_config.json
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.7.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI": "<DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE": "<DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_AUDIT_FILE_PATH": "<DATAPRISM_AUDIT_FILE_PATH>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_HAZELCAST_CLUSTERNAME": "<DATAPRISM_HAZELCAST_CLUSTERNAME>",
        "DATAPRISM_HAZELCAST_JOIN_MODE": "<DATAPRISM_HAZELCAST_JOIN_MODE>",
        "DATAPRISM_HAZELCAST_JOIN_MEMBERS": "<DATAPRISM_HAZELCAST_JOIN_MEMBERS>",
        "DATAPRISM_HAZELCAST_MEMBER_PORT": "<DATAPRISM_HAZELCAST_MEMBER_PORT>",
        "DATAPRISM_OPERATOR_ENABLED": "<DATAPRISM_OPERATOR_ENABLED>",
        "DATAPRISM_OPERATOR_PORT": "<DATAPRISM_OPERATOR_PORT>",
        "DATAPRISM_OPERATOR_REQUIREDAUDIENCE": "<DATAPRISM_OPERATOR_REQUIREDAUDIENCE>",
        "DATAPRISM_OPERATOR_REQUIREDSCOPE": "<DATAPRISM_OPERATOR_REQUIREDSCOPE>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.7.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI": "<DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE": "<DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_AUDIT_FILE_PATH": "<DATAPRISM_AUDIT_FILE_PATH>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_HAZELCAST_CLUSTERNAME": "<DATAPRISM_HAZELCAST_CLUSTERNAME>",
        "DATAPRISM_HAZELCAST_JOIN_MODE": "<DATAPRISM_HAZELCAST_JOIN_MODE>",
        "DATAPRISM_HAZELCAST_JOIN_MEMBERS": "<DATAPRISM_HAZELCAST_JOIN_MEMBERS>",
        "DATAPRISM_HAZELCAST_MEMBER_PORT": "<DATAPRISM_HAZELCAST_MEMBER_PORT>",
        "DATAPRISM_OPERATOR_ENABLED": "<DATAPRISM_OPERATOR_ENABLED>",
        "DATAPRISM_OPERATOR_PORT": "<DATAPRISM_OPERATOR_PORT>",
        "DATAPRISM_OPERATOR_REQUIREDAUDIENCE": "<DATAPRISM_OPERATOR_REQUIREDAUDIENCE>",
        "DATAPRISM_OPERATOR_REQUIREDSCOPE": "<DATAPRISM_OPERATOR_REQUIREDSCOPE>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "data-prism": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.7.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI": "<DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE": "<DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_AUDIT_FILE_PATH": "<DATAPRISM_AUDIT_FILE_PATH>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_HAZELCAST_CLUSTERNAME": "<DATAPRISM_HAZELCAST_CLUSTERNAME>",
        "DATAPRISM_HAZELCAST_JOIN_MODE": "<DATAPRISM_HAZELCAST_JOIN_MODE>",
        "DATAPRISM_HAZELCAST_JOIN_MEMBERS": "<DATAPRISM_HAZELCAST_JOIN_MEMBERS>",
        "DATAPRISM_HAZELCAST_MEMBER_PORT": "<DATAPRISM_HAZELCAST_MEMBER_PORT>",
        "DATAPRISM_OPERATOR_ENABLED": "<DATAPRISM_OPERATOR_ENABLED>",
        "DATAPRISM_OPERATOR_PORT": "<DATAPRISM_OPERATOR_PORT>",
        "DATAPRISM_OPERATOR_REQUIREDAUDIENCE": "<DATAPRISM_OPERATOR_REQUIREDAUDIENCE>",
        "DATAPRISM_OPERATOR_REQUIREDSCOPE": "<DATAPRISM_OPERATOR_REQUIREDSCOPE>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
LOADER_PATH
Required
Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)
DATAPRISM_SECURITY_JWT_ISSUER
Required
OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment
DATAPRISM_SECURITY_JWT_AUDIENCE
Required
Expected JWT audience claim for this deployment; required for every protected deployment
DATAPRISM_SECURITY_JWT_JWK_SET_URI
Required
HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both
DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI
Optional
Alternative HTTPS OIDC issuer-discovery location; set this instead of DATAPRISM_SECURITY_JWT_JWK_SET_URI, never both
DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL
Required
JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims
DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES
Required
JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims
DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION
Required
JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims
DATAPRISM_SECURITY_POLICY_PURPOSES
Required
Comma-separated list of permitted purposes; at least one is required
DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR
Required
Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this propert…
DATAPRISM_PRIVACY_PROFILE
Required
Name of the reviewed privacy profile implementation to apply; required
DATAPRISM_PRIVACY_SCOPE_LIFETIME
Required
Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required
DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID
Required
Identifier of the pinned HMAC key used to derive synthetic identities; required
DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE
Required
Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value
DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE
Optional
Reference to an approved secret provider holding the HMAC key material; set this instead of DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE, never both
DATAPRISM_AUDIT_SINK
Required
Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op
DATAPRISM_AUDIT_WRITER_ID
Required
Writer/instance identity recorded on every audit entry; required
DATAPRISM_AUDIT_FILE_PATH
Optional
Path to the durable, hash-chained audit log; required when DATAPRISM_AUDIT_SINK=hash-chained, refused as MISSING_AUDIT_FILE_PATH if absent for that sink, ignored otherwise
DATAPRISM_METRICS_SINK
Required
Metrics sink binding, currently only micrometer; required in production, never the framework no-op
DATAPRISM_HAZELCAST_TOPOLOGY
Required
Cluster read-budget topology: embedded (shared across members that have joined one cluster; set cluster name and join mode) or single-node (enforced per process); required, never defaulted
DATAPRISM_HAZELCAST_CLUSTERNAME
Optional
Hazelcast cluster name; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded, never dev, refused if set with single-node
DATAPRISM_HAZELCAST_JOIN_MODE
Optional
How cluster members find each other: tcp-ip, kubernetes or none; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded (none is an explicit single member bound to 127.0.0.1), refused if set with single-node
DATAPRISM_HAZELCAST_JOIN_MEMBERS
Optional
Comma-separated member addresses (host or host:port); required when DATAPRISM_HAZELCAST_JOIN_MODE=tcp-ip, otherwise unused
DATAPRISM_HAZELCAST_MEMBER_PORT
Optional
Hazelcast member port, default 5701, never auto-incremented; must differ from the server, management and operator ports. Member traffic is unencrypted, so keep it on a private network. Optional
DATAPRISM_OPERATOR_ENABLED
Optional
Enables the operator surface; optional, off by default
DATAPRISM_OPERATOR_PORT
Optional
Port of the operator listener; required when DATAPRISM_OPERATOR_ENABLED=true, must differ from the server, management (OPERATOR_PORT_SHARED otherwise) and member ports, and has no fixed default (publish it explicitly)
DATAPRISM_OPERATOR_REQUIREDAUDIENCE
Optional
JWT audience an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true
DATAPRISM_OPERATOR_REQUIREDSCOPE
Optional
JWT scope an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true
DATAPRISM_SOURCES_CUSTOMER_BASE_URL
Required
Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required
DATAPRISM_SOURCES_CUSTOMER_TIMEOUT
Required
Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL

Details

Packageghcr.io/aindriub/data-prism-server:0.7.1 (OCI, streamable-http)
First published22 Oct 2026
Last updated22 Oct 2026
Registry nameio.github.AindriuB/data-prism

More ai and media servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.