加载中…
Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients.
Data Prism 是 ChatHome Skills 收录的 MCP 条目，来源为 Official MCP Registry，质量分 78/100。 作为 Model Context Protocol 服务器，它向 Claude、Cursor、Copilot 等兼容 MCP 的 LLM 客户端暴露可直接调用的工具，让 agent 的能力超出模型内置范围。 该条目由 ChatHome Skills 的每日抓取从官方 registry 和 GitHub 发现查询中收录，每次运行都会重新核验仓库事实、新鲜度信号和安装元数据。 质量分综合了官方 registry 收录情况、可用安装命令、许可证完整性、仓库活跃度和 GitHub star 趋势，完整算法说明见来源页。安装命令已列于上方，可直接复制使用。 在将 Data Prism 加入生产 agent 工作流前，请核对上方的最近更新日期和仓库状态——下方事实快照是最近一次抓取的时点值。
docker run -i --rm ghcr.io/aindriub/data-prism-server:0.7.1运行此命令前，请先核对上游源码。
{
"_meta": {
"io.modelcontextprotocol.registry/official": {
"status": "active",
"isLatest": true,
"updatedAt": "2026-10-22T11:11:57.174929Z",
"publishedAt": "2026-10-22T11:11:57.174929Z",
"statusChangedAt": "2026-10-22T11:11:57.174929Z"
}
},
"server": {
"name": "io.github.AindriuB/data-prism",
"title": "Data Prism",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "0.7.1",
"packages": [
{
"transport": {
"url": "http://localhost:8080/mcp",
"type": "streamable-http"
},
"identifier": "ghcr.io/aindriub/data-prism-server:0.7.1",
"runtimeHint": "docker",
"registryType": "oci",
"runtimeArguments": [
{
"name": "-v",
"type": "named",
"value": "{adapter_jar_host_path}:/app/adapters/{adapter_jar_name}",
"variables": {
"adapter_jar_name": {
"isRequired": true,
"description": "File name to expose for that jar inside /app/adapters"
},
"adapter_jar_host_path": {
"format": "filepath",
"isRequired": true,
"description": "Absolute host path to a reviewed DataSourceAdapter/IdentityResolver jar you built and reviewed yourself"
}
},
"isRepeated": true,
"isRequired": true,
"description": "Bind-mount at least one reviewed DataSourceAdapter/IdentityResolver jar into the loader path (LOADER_PATH=/app/adapters) for every dataprism.sources entry; absent this, DataPrismContractValidator refuses startup with MISSING_SOURCE_ADAPTER."
},
{
"name": "-v",
"type": "named",
"value": "{config_host_path}:/app/config/application.yaml",
"variables": {
"config_host_path": {
"format": "filepath",
"isRequired": true,
"description": "Absolute host path to your dataprism.* application.yaml"
}
},
"isRequired": true,
"description": "Bind-mount a deployment configuration YAML satisfying every required dataprism.* key in docs/configuration.md to the path Spring Boot auto-loads on startup; equivalent to, and combinable with, the DATAPRISM_* environment variables below. Absent both, DataPrismProperties.validate() refuses startup."
}
],
"environmentVariables": [
{
"name": "LOADER_PATH",
"default": "/app/adapters",
"isRequired": true,
"description": "Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)"
},
{
"name": "DATAPRISM_SECURITY_JWT_ISSUER",
"isRequired": true,
"description": "OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment"
},
{
"name": "DATAPRISM_SECURITY_JWT_AUDIENCE",
"isRequired": true,
"description": "Expected JWT audience claim for this deployment; required for every protected deployment"
},
{
"name": "DATAPRISM_SECURITY_JWT_JWK_SET_URI",
"isRequired": true,
"description": "HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both"
},
{
"name": "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI",
"description": "Alternative HTTPS OIDC issuer-discovery location; set this instead of DATAPRISM_SECURITY_JWT_JWK_SET_URI, never both"
},
{
"name": "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL",
"isRequired": true,
"description": "JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims"
},
{
"name": "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES",
"isRequired": true,
"description": "JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims"
},
{
"name": "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION",
"isRequired": true,
"description": "JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims"
},
{
"name": "DATAPRISM_SECURITY_POLICY_PURPOSES",
"isRequired": true,
"description": "Comma-separated list of permitted purposes; at least one is required"
},
{
"name": "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR",
"isRequired": true,
"description": "Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 4.1.1), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required"
},
{
"name": "DATAPRISM_PRIVACY_PROFILE",
"isRequired": true,
"description": "Name of the reviewed privacy profile implementation to apply; required"
},
{
"name": "DATAPRISM_PRIVACY_SCOPE_LIFETIME",
"isRequired": true,
"description": "Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required"
},
{
"name": "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID",
"isRequired": true,
"description": "Identifier of the pinned HMAC key used to derive synthetic identities; required"
},
{
"name": "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE",
"isRequired": true,
"description": "Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value"
},
{
"name": "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE",
"description": "Reference to an approved secret provider holding the HMAC key material; set this instead of DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE, never both"
},
{
"name": "DATAPRISM_AUDIT_SINK",
"isRequired": true,
"description": "Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op"
},
{
"name": "DATAPRISM_AUDIT_WRITER_ID",
"isRequired": true,
"description": "Writer/instance identity recorded on every audit entry; required"
},
{
"name": "DATAPRISM_AUDIT_FILE_PATH",
"description": "Path to the durable, hash-chained audit log; required when DATAPRISM_AUDIT_SINK=hash-chained, refused as MISSING_AUDIT_FILE_PATH if absent for that sink, ignored otherwise"
},
{
"name": "DATAPRISM_METRICS_SINK",
"isRequired": true,
"description": "Metrics sink binding, currently only micrometer; required in production, never the framework no-op"
},
{
"name": "DATAPRISM_HAZELCAST_TOPOLOGY",
"isRequired": true,
"description": "Cluster read-budget topology: embedded (shared across members that have joined one cluster; set cluster name and join mode) or single-node (enforced per process); required, never defaulted"
},
{
"name": "DATAPRISM_HAZELCAST_CLUSTERNAME",
"description": "Hazelcast cluster name; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded, never dev, refused if set with single-node"
},
{
"name": "DATAPRISM_HAZELCAST_JOIN_MODE",
"description": "How cluster members find each other: tcp-ip, kubernetes or none; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded (none is an explicit single member bound to 127.0.0.1), refused if set with single-node"
},
{
"name": "DATAPRISM_HAZELCAST_JOIN_MEMBERS",
"description": "Comma-separated member addresses (host or host:port); required when DATAPRISM_HAZELCAST_JOIN_MODE=tcp-ip, otherwise unused"
},
{
"name": "DATAPRISM_HAZELCAST_MEMBER_PORT",
"description": "Hazelcast member port, default 5701, never auto-incremented; must differ from the server, management and operator ports. Member traffic is unencrypted, so keep it on a private network. Optional"
},
{
"name": "DATAPRISM_OPERATOR_ENABLED",
"description": "Enables the operator surface; optional, off by default"
},
{
"name": "DATAPRISM_OPERATOR_PORT",
"description": "Port of the operator listener; required when DATAPRISM_OPERATOR_ENABLED=true, must differ from the server, management (OPERATOR_PORT_SHARED otherwise) and member ports, and has no fixed default (publish it explicitly)"
},
{
"name": "DATAPRISM_OPERATOR_REQUIREDAUDIENCE",
"description": "JWT audience an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true"
},
{
"name": "DATAPRISM_OPERATOR_REQUIREDSCOPE",
"description": "JWT scope an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true"
},
{
"name": "DATAPRISM_SOURCES_CUSTOMER_BASE_URL",
"isRequired": true,
"description": "Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required"
},
{
"name": "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT",
"isRequired": true,
"description": "Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL"
}
]
}
],
"repository": {
"id": "1361848414",
"url": "https://github.com/AindriuB/data-prism",
"source": "github"
},
"websiteUrl": "https://aindriub.github.io/data-prism/",
"description": "Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients."
}
}