Data Prism

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-10-22T11:11:57.174929Z",
      "publishedAt": "2026-10-22T11:11:57.174929Z",
      "statusChangedAt": "2026-10-22T11:11:57.174929Z"
    }
  },
  "server": {
    "name": "io.github.AindriuB/data-prism",
    "title": "Data Prism",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.7.1",
    "packages": [
      {
        "transport": {
          "url": "http://localhost:8080/mcp",
          "type": "streamable-http"
        },
        "identifier": "ghcr.io/aindriub/data-prism-server:0.7.1",
        "runtimeHint": "docker",
        "registryType": "oci",
        "runtimeArguments": [
          {
            "name": "-v",
            "type": "named",
            "value": "{adapter_jar_host_path}:/app/adapters/{adapter_jar_name}",
            "variables": {
              "adapter_jar_name": {
                "isRequired": true,
                "description": "File name to expose for that jar inside /app/adapters"
              },
              "adapter_jar_host_path": {
                "format": "filepath",
                "isRequired": true,
                "description": "Absolute host path to a reviewed DataSourceAdapter/IdentityResolver jar you built and reviewed yourself"
              }
            },
            "isRepeated": true,
            "isRequired": true,
            "description": "Bind-mount at least one reviewed DataSourceAdapter/IdentityResolver jar into the loader path (LOADER_PATH=/app/adapters) for every dataprism.sources entry; absent this, DataPrismContractValidator refuses startup with MISSING_SOURCE_ADAPTER."
          },
          {
            "name": "-v",
            "type": "named",
            "value": "{config_host_path}:/app/config/application.yaml",
            "variables": {
              "config_host_path": {
                "format": "filepath",
                "isRequired": true,
                "description": "Absolute host path to your dataprism.* application.yaml"
              }
            },
            "isRequired": true,
            "description": "Bind-mount a deployment configuration YAML satisfying every required dataprism.* key in docs/configuration.md to the path Spring Boot auto-loads on startup; equivalent to, and combinable with, the DATAPRISM_* environment variables below. Absent both, DataPrismProperties.validate() refuses startup."
          }
        ],
        "environmentVariables": [
          {
            "name": "LOADER_PATH",
            "default": "/app/adapters",
            "isRequired": true,
            "description": "Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)"
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_ISSUER",
            "isRequired": true,
            "description": "OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment"
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_AUDIENCE",
            "isRequired": true,
            "description": "Expected JWT audience claim for this deployment; required for every protected deployment"
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_JWK_SET_URI",
            "isRequired": true,
            "description": "HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both"
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI",
            "description": "Alternative HTTPS OIDC issuer-discovery location; set this instead of DATAPRISM_SECURITY_JWT_JWK_SET_URI, never both"
          },
          {
            "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL",
            "isRequired": true,
            "description": "JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims"
          },
          {
            "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES",
            "isRequired": true,
            "description": "JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims"
          },
          {
            "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION",
            "isRequired": true,
            "description": "JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims"
          },
          {
            "name": "DATAPRISM_SECURITY_POLICY_PURPOSES",
            "isRequired": true,
            "description": "Comma-separated list of permitted purposes; at least one is required"
          },
          {
            "name": "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR",
            "isRequired": true,
            "description": "Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 4.1.1), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required"
          },
          {
            "name": "DATAPRISM_PRIVACY_PROFILE",
            "isRequired": true,
            "description": "Name of the reviewed privacy profile implementation to apply; required"
          },
          {
            "name": "DATAPRISM_PRIVACY_SCOPE_LIFETIME",
            "isRequired": true,
            "description": "Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required"
          },
          {
            "name": "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID",
            "isRequired": true,
            "description": "Identifier of the pinned HMAC key used to derive synthetic identities; required"
          },
          {
            "name": "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE",
            "isRequired": true,
            "description": "Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value"
          },
          {
            "name": "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE",
            "description": "Reference to an approved secret provider holding the HMAC key material; set this instead of DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE, never both"
          },
          {
            "name": "DATAPRISM_AUDIT_SINK",
            "isRequired": true,
            "description": "Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op"
          },
          {
            "name": "DATAPRISM_AUDIT_WRITER_ID",
            "isRequired": true,
            "description": "Writer/instance identity recorded on every audit entry; required"
          },
          {
            "name": "DATAPRISM_AUDIT_FILE_PATH",
            "description": "Path to the durable, hash-chained audit log; required when DATAPRISM_AUDIT_SINK=hash-chained, refused as MISSING_AUDIT_FILE_PATH if absent for that sink, ignored otherwise"
          },
          {
            "name": "DATAPRISM_METRICS_SINK",
            "isRequired": true,
            "description": "Metrics sink binding, currently only micrometer; required in production, never the framework no-op"
          },
          {
            "name": "DATAPRISM_HAZELCAST_TOPOLOGY",
            "isRequired": true,
            "description": "Cluster read-budget topology: embedded (shared across members that have joined one cluster; set cluster name and join mode) or single-node (enforced per process); required, never defaulted"
          },
          {
            "name": "DATAPRISM_HAZELCAST_CLUSTERNAME",
            "description": "Hazelcast cluster name; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded, never dev, refused if set with single-node"
          },
          {
            "name": "DATAPRISM_HAZELCAST_JOIN_MODE",
            "description": "How cluster members find each other: tcp-ip, kubernetes or none; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded (none is an explicit single member bound to 127.0.0.1), refused if set with single-node"
          },
          {
            "name": "DATAPRISM_HAZELCAST_JOIN_MEMBERS",
            "description": "Comma-separated member addresses (host or host:port); required when DATAPRISM_HAZELCAST_JOIN_MODE=tcp-ip, otherwise unused"
          },
          {
            "name": "DATAPRISM_HAZELCAST_MEMBER_PORT",
            "description": "Hazelcast member port, default 5701, never auto-incremented; must differ from the server, management and operator ports. Member traffic is unencrypted, so keep it on a private network. Optional"
          },
          {
            "name": "DATAPRISM_OPERATOR_ENABLED",
            "description": "Enables the operator surface; optional, off by default"
          },
          {
            "name": "DATAPRISM_OPERATOR_PORT",
            "description": "Port of the operator listener; required when DATAPRISM_OPERATOR_ENABLED=true, must differ from the server, management (OPERATOR_PORT_SHARED otherwise) and member ports, and has no fixed default (publish it explicitly)"
          },
          {
            "name": "DATAPRISM_OPERATOR_REQUIREDAUDIENCE",
            "description": "JWT audience an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true"
          },
          {
            "name": "DATAPRISM_OPERATOR_REQUIREDSCOPE",
            "description": "JWT scope an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true"
          },
          {
            "name": "DATAPRISM_SOURCES_CUSTOMER_BASE_URL",
            "isRequired": true,
            "description": "Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required"
          },
          {
            "name": "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT",
            "isRequired": true,
            "description": "Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL"
          }
        ]
      }
    ],
    "repository": {
      "id": "1361848414",
      "url": "https://github.com/AindriuB/data-prism",
      "source": "github"
    },
    "websiteUrl": "https://aindriub.github.io/data-prism/",
    "description": "Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients."
  }
}