Data Prism

io.github.AindriuB/data-prism

Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients.

View repository →Homepage →

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.7.1"
      ],
      "env": {
        "LOADER_PATH": "<your LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<your DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<your DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<your DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<your DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<your DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<your DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<your DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<your DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<your DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<your DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<your DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<your DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<your DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<your DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<your DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<your DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<your DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<your DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}
Environment variables
  • LOADER_PATHrequiredDirectory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)
  • DATAPRISM_SECURITY_JWT_ISSUERrequiredOAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment
  • DATAPRISM_SECURITY_JWT_AUDIENCErequiredExpected JWT audience claim for this deployment; required for every protected deployment
  • DATAPRISM_SECURITY_JWT_JWK_SET_URIrequiredHTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both
  • DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPALrequiredJWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims
  • DATAPRISM_SECURITY_CALLER_CLAIMS_ROLESrequiredJWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims
  • DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATIONrequiredJWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims
  • DATAPRISM_SECURITY_POLICY_PURPOSESrequiredComma-separated list of permitted purposes; at least one is required
  • DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATORrequiredExample only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 4.1.1), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required
  • DATAPRISM_PRIVACY_PROFILErequiredName of the reviewed privacy profile implementation to apply; required
  • DATAPRISM_PRIVACY_SCOPE_LIFETIMErequiredPositive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required
  • DATAPRISM_PRIVACY_HMAC_KEY_KEY_IDrequiredIdentifier of the pinned HMAC key used to derive synthetic identities; required
  • DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLErequiredName of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value
  • DATAPRISM_AUDIT_SINKrequiredAudit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op
  • DATAPRISM_AUDIT_WRITER_IDrequiredWriter/instance identity recorded on every audit entry; required
  • DATAPRISM_METRICS_SINKrequiredMetrics sink binding, currently only micrometer; required in production, never the framework no-op
  • DATAPRISM_HAZELCAST_TOPOLOGYrequiredCluster read-budget topology: embedded (shared across members that have joined one cluster; set cluster name and join mode) or single-node (enforced per process); required, never defaulted
  • DATAPRISM_SOURCES_CUSTOMER_BASE_URLrequiredExample only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required
  • DATAPRISM_SOURCES_CUSTOMER_TIMEOUTrequiredExample only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
AI & ML
Version
0.7.1
Registry
active
Published
10/22/2026

More AI & ML servers

Browse all AI & ML →

Local LLM Guard for Ollama / llama.cpp

AIops-tools

Governed local-LLM observability: model policy, prompt scanner, capture proxy, 21 tools.

AI & MLAdded 2 days ago

Inference AIops

AIops-tools

Governed GPU inference ops (vLLM + Ray Serve): latency RCA, scaling, drain, 39 tools.

AI & MLAdded 1 week ago

x402 Agent Tollbooth

ak10082247-max

On-chain DeFi smart contract auditor, arbitrage scanner, and agent tollbooth via x402 on Base.

AI & MLAdded 3 weeks ago

AI Firewall MCP

Akhilucky

Multi-agent LLM security layer detecting prompt injection and jailbreaks.

AI & MLAdded 5 months ago

AIMarket — live agent marketplace

alexar76

Search and invoke real AI capabilities on modelmarket.dev. Free trial, then a prepaid key.

AI & MLAdded 1 month ago

NeuralBrain

alexcurpan-cloud

NeuralBrain MCP Server - RAG, Vector Memory, LLM Routing, Agent Identity, x402 Payments

AI & MLAdded 4 months ago

Add the badge to your site

Show visitors that Data Prism is listed here — it’s also the link we check for a free listing.

Data Prism — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-aindriub-data-prism?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="Data Prism — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![Data Prism — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-aindriub-data-prism?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.