AgentHubAgentHub

Data Prism MCP Setup & Guide

MCP ServerMCP RegistryOfficial

io.github.AindriuB/data-prism · v0.3.1

Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients.

View on MCP Registry ↗Repository ↗

Copy the install config on this page first, then verify docs and permissions upstream.

Overview

Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients. Data Prism is a MCP Server listed from MCP Registry. Transports: streamable-http. This page includes an overview, setup tutorial, install commands, and use cases for Trae, Tongyi Lingma, Cursor, Claude Code, and VS Code.

Use cases

Code review & GitHubCursor essentials

AgentHub Verified AvailabilityTested & Ready

Automated pipeline validated install commands, protocol & client compatibility

Verified At2026-10-04
Install Snippets TestedCLI & JSON config syntax verified
Protocol Handshake ReadyComplies with JSON-RPC 2.0 specifications
Origin Registry ActiveSourced from official-mcp-registry
Verified ClientsClaude Code、Claude Desktop、Cursor 等
Security Tier: A+ 级 · 官方认证推荐 (A+)·Maintained by official/verified teams, audited for standard MCP protocol compliance.

Copy by platform

Choose your platform

  1. Open or create .cursor/mcp.json in your project root
  2. Click Copy config and paste; merge only this mcpServers entry if others exist
  3. Replace <placeholders> in env with real secrets (see Environment variables below)
  4. Save, then Cmd+Shift+P → Reload Window

Pre-fill Environment Variables (Optional)

Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Required
Privacy Guarantee: Keys are replaced 100% locally in your browser memory and are NEVER uploaded or stored on any server.
Click to copy snippet
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Setup tutorial

  1. Open the Data Prism page and confirm this MCP Server (source: MCP Registry).
  2. Copy the Cursor, Claude Code, or VS Code snippet.
  3. Merge it into mcpServers and replace env placeholders with real secrets.
  4. Reload the window, then call the MCP tools from your agent chat.

Install commands

Install commands and setup steps are in the HTML so search engines and no-JS browsers can read them without running client JavaScript.

Claude Code (local)

  1. Install Claude Code CLI
  2. Copy the command below, replace <placeholders> with real env values, then run in terminal
  3. See Environment variables below if listed
claude mcp add data-prism --env LOADER_PATH=<LOADER_PATH> --env DATAPRISM_SECURITY_JWT_ISSUER=<DATAPRISM_SECURITY_JWT_ISSUER> --env DATAPRISM_SECURITY_JWT_AUDIENCE=<DATAPRISM_SECURITY_JWT_AUDIENCE> --env DATAPRISM_SECURITY_JWT_JWK_SET_URI=<DATAPRISM_SECURITY_JWT_JWK_SET_URI> --env DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL=<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL> --env DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES=<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES> --env DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION=<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION> --env DATAPRISM_SECURITY_POLICY_PURPOSES=<DATAPRISM_SECURITY_POLICY_PURPOSES> --env DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR=<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR> --env DATAPRISM_PRIVACY_PROFILE=<DATAPRISM_PRIVACY_PROFILE> --env DATAPRISM_PRIVACY_SCOPE_LIFETIME=<DATAPRISM_PRIVACY_SCOPE_LIFETIME> --env DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID=<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID> --env DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE=<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE> --env DATAPRISM_AUDIT_SINK=<DATAPRISM_AUDIT_SINK> --env DATAPRISM_AUDIT_WRITER_ID=<DATAPRISM_AUDIT_WRITER_ID> --env DATAPRISM_METRICS_SINK=<DATAPRISM_METRICS_SINK> --env DATAPRISM_HAZELCAST_TOPOLOGY=<DATAPRISM_HAZELCAST_TOPOLOGY> --env DATAPRISM_SOURCES_CUSTOMER_BASE_URL=<DATAPRISM_SOURCES_CUSTOMER_BASE_URL> --env DATAPRISM_SOURCES_CUSTOMER_TIMEOUT=<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT> -- docker run -i --rm ghcr.io/aindriub/data-prism-server:0.3.1

Cursor — .cursor/mcp.json (local)

  1. Open or create .cursor/mcp.json in your project root
  2. Click Copy config and paste; merge only this mcpServers entry if others exist
  3. Replace <placeholders> in env with real secrets (see Environment variables below)
  4. Save, then Cmd+Shift+P → Reload Window
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

VS Code — .vscode/mcp.json (local)

  1. Install GitHub Copilot in VS Code with MCP support
  2. Open or create .vscode/mcp.json in your project root
  3. Click Copy config and paste; merge only this mcpServers entry if others exist
  4. Replace <placeholders> in env with real secrets
  5. Save and Developer: Reload Window
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Claude Desktop — claude_desktop_config.json (local)

  1. Open Claude Desktop claude_desktop_config.json (see remote guide for paths)
  2. Click Copy config and merge under mcpServers
  3. Replace <placeholders> in env with real secrets
  4. Fully quit and restart Claude Desktop
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Trae — .trae/mcp.json (local)

  1. Trae → Settings → MCP, or edit .trae/mcp.json / global mcp.json
  2. Click Copy config and merge mcpServers
  3. Replace <placeholders> in env with real secrets
  4. Save and reload Trae
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Cherry Studio — MCP settings (local)

  1. Cherry Studio → Settings → MCP Servers → Add (STDIO)
  2. Or import JSON: click Copy config and merge mcpServers
  3. Replace <placeholders> in env; ensure Node.js / uv (npx, uvx) are installed
  4. Enable the server and check tools load
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Tongyi Lingma — MCP config (local)

  1. Lingma Settings → MCP → + → STDIO or config file
  2. Click Copy config and merge mcpServers
  3. Replace <placeholders> in env; need Node.js 18+ (npx) or uv (uvx)
  4. Confirm connected before using tools in agent chat
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Windsurf — mcp_config.json (local)

  1. Edit ~/.codeium/windsurf/mcp_config.json
  2. Click Copy config and merge mcpServers (stdio same as Cursor)
  3. Replace <placeholders> in env, save, refresh Cascade
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Cline — MCP Servers (local)

  1. Cline panel → Settings → MCP Servers
  2. Click Copy config and merge
  3. Replace <placeholders> in env, then save
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

WorkBuddy — .workbuddy/mcp.json (local)

  1. Edit ~/.workbuddy/mcp.json (user) or project .workbuddy/mcp.json
  2. Or Plugins → MCP Servers → Configure MCP and paste the JSON below
  3. Replace <placeholders> in env; on Windows prefer absolute paths for command/scripts
  4. Save, restart WorkBuddy, confirm connector status is green
{
  "mcpServers": {
    "data-prism": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aindriub/data-prism-server:0.3.1"
      ],
      "env": {
        "LOADER_PATH": "<LOADER_PATH>",
        "DATAPRISM_SECURITY_JWT_ISSUER": "<DATAPRISM_SECURITY_JWT_ISSUER>",
        "DATAPRISM_SECURITY_JWT_AUDIENCE": "<DATAPRISM_SECURITY_JWT_AUDIENCE>",
        "DATAPRISM_SECURITY_JWT_JWK_SET_URI": "<DATAPRISM_SECURITY_JWT_JWK_SET_URI>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL": "<DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES": "<DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES>",
        "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION": "<DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION>",
        "DATAPRISM_SECURITY_POLICY_PURPOSES": "<DATAPRISM_SECURITY_POLICY_PURPOSES>",
        "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR": "<DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR>",
        "DATAPRISM_PRIVACY_PROFILE": "<DATAPRISM_PRIVACY_PROFILE>",
        "DATAPRISM_PRIVACY_SCOPE_LIFETIME": "<DATAPRISM_PRIVACY_SCOPE_LIFETIME>",
        "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID": "<DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID>",
        "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE": "<DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE>",
        "DATAPRISM_AUDIT_SINK": "<DATAPRISM_AUDIT_SINK>",
        "DATAPRISM_AUDIT_WRITER_ID": "<DATAPRISM_AUDIT_WRITER_ID>",
        "DATAPRISM_METRICS_SINK": "<DATAPRISM_METRICS_SINK>",
        "DATAPRISM_HAZELCAST_TOPOLOGY": "<DATAPRISM_HAZELCAST_TOPOLOGY>",
        "DATAPRISM_SOURCES_CUSTOMER_BASE_URL": "<DATAPRISM_SOURCES_CUSTOMER_BASE_URL>",
        "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT": "<DATAPRISM_SOURCES_CUSTOMER_TIMEOUT>"
      }
    }
  }
}

Troubleshooting & Common ErrorsFAQ

Common connection errors and verified fixes for Data Prism

Getting 'connection closed' or exit code 1 in Cursor / Claude Code for Data Prism?

Usually caused by missing runtime paths or IDE environment inheritance. Fix steps: 1. Verify Node.js 18+ (npx) or Python 3.10+ (uvx) is installed; 2. Run 'which npx' or 'which uvx' in terminal, and replace 'command' with absolute path; 3. Reload or restart the client window after modifying config.

Fix Snippet
# Check binary path in terminal:
which npx
node -v
Getting 'spawn npx ENOENT' or 'command not found'?

The editor background process does not inherit your full terminal PATH. Solution: Globally install the package, or set the absolute binary path (e.g. C:\Program Files\nodejs\npx.cmd on Windows, or /usr/local/bin/npx on macOS).

Missing required environment variable or authentication failure?

Data Prism requires environment variables (LOADER_PATH、DATAPRISM_SECURITY_JWT_ISSUER、DATAPRISM_SECURITY_JWT_AUDIENCE、DATAPRISM_SECURITY_JWT_JWK_SET_URI、DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL、DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES、DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION、DATAPRISM_SECURITY_POLICY_PURPOSES、DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR、DATAPRISM_PRIVACY_PROFILE、DATAPRISM_PRIVACY_SCOPE_LIFETIME、DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID、DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE、DATAPRISM_AUDIT_SINK、DATAPRISM_AUDIT_WRITER_ID、DATAPRISM_METRICS_SINK、DATAPRISM_HAZELCAST_TOPOLOGY、DATAPRISM_SOURCES_CUSTOMER_BASE_URL、DATAPRISM_SOURCES_CUSTOMER_TIMEOUT). Ensure you have added valid keys under the 'env' object in your config file without trailing whitespace.

Fix Snippet
// .cursor/mcp.json 或 claude_desktop_config.json
{
  "env": {
    "LOADER_PATH": "your_actual_key_here"
  }
}
Still not connecting? Read the MCP troubleshooting guide →

Tool Mock Playground

Sandbox

Data Prism Tool Interface Simulation · Preview tool schema & outputs without local runtime

Sandbox Ready
fn: data_prismExecute the core tool interface of Data Prism
Request ArgumentsJSON Schema
{
  "target": "Data Prism",
  "action": "execute",
  "options": {
    "mode": "standard",
    "timeoutMs": 5000
  }
}
💡Parameters generated dynamically by Agent runtime
Agent Tool Output

Click 'Run Mock' above

to preview the raw response returned to the LLM

Env: AgentHub Virtual SandboxJSON-RPC 2.0

Decision Guide: Why & When to Use

Assess suitability before installing to save trial-and-error time

Best Suited For
  • PR review
  • Changelog generation
  • Cross-repo issue search
When NOT to Use
  • Replacing human security audit
  • Unauthorized repo access
Recommended Workflow Pairing:View Scenario →

Data Prism + Scenario Prompt → Complete Agent Automation

MCP hands-on: install to visible results

Follow the full lab (expected UI/output + contrast checks). After installing this item, verify with the tutorial prompts.

Open tutorial →

Related resources

Often paired with

Keep exploring AgentHub

Most people compare similar tools or check scenario guides before installing—start here.

Browse more like thisSearch similarPick by scenarioPrompt playbooksMCP hands-onReviews & comparisons

Listing badge: put AgentHub on your site

Copy either snippet into your project homepage, docs, or GitHub README. The badge is a hotlinked SVG — nothing to host — and it links back to this page so visitors can find the install steps.

PreviewListed on AgentHub: Data Prism
HTML
<a href="https://myagenthub.cn/p/io.github.AindriuB/data-prism" title="Listed on AgentHub: Data Prism" target="_blank" rel="noopener">
  <img src="https://myagenthub.cn/badge/io.github.AindriuB/data-prism?lang=en" alt="Listed on AgentHub: Data Prism" height="20" style="border:0"/>
</a>
Markdown (GitHub README)
[![Listed on AgentHub: Data Prism](https://myagenthub.cn/badge/io.github.AindriuB/data-prism?lang=en)](https://myagenthub.cn/p/io.github.AindriuB/data-prism)

Badges are generated on the fly from /badge/<package-id>, so name and listing changes propagate automatically. Keep the link target unchanged — it is what counts as the referral.

Unified Manifest

{
  "id": "io.github.AindriuB/data-prism",
  "type": "mcp-server",
  "version": "0.3.1",
  "displayName": "Data Prism",
  "description": "Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients.",
  "repository": {
    "url": "https://github.com/AindriuB/data-prism",
    "source": "github"
  },
  "homepage": "https://aindriub.github.io/data-prism/",
  "distribution": {
    "packages": [
      {
        "registryType": "oci",
        "identifier": "ghcr.io/aindriub/data-prism-server:0.3.1",
        "runtimeHint": "docker",
        "transport": "streamable-http",
        "environmentVariables": [
          {
            "name": "LOADER_PATH",
            "description": "Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_ISSUER",
            "description": "OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_AUDIENCE",
            "description": "Expected JWT audience claim for this deployment; required for every protected deployment",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_JWK_SET_URI",
            "description": "HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI",
            "description": "Alternative HTTPS OIDC issuer-discovery location; set this instead of DATAPRISM_SECURITY_JWT_JWK_SET_URI, never both"
          },
          {
            "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL",
            "description": "JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES",
            "description": "JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION",
            "description": "JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITY_POLICY_PURPOSES",
            "description": "Comma-separated list of permitted purposes; at least one is required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR",
            "description": "Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 3.5.16), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_PRIVACY_PROFILE",
            "description": "Name of the reviewed privacy profile implementation to apply; required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_PRIVACY_SCOPE_LIFETIME",
            "description": "Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID",
            "description": "Identifier of the pinned HMAC key used to derive synthetic identities; required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE",
            "description": "Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE",
            "description": "Reference to an approved secret provider holding the HMAC key material; set this instead of DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE, never both"
          },
          {
            "name": "DATAPRISM_AUDIT_SINK",
            "description": "Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_AUDIT_WRITER_ID",
            "description": "Writer/instance identity recorded on every audit entry; required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_AUDIT_FILE_PATH",
            "description": "Path to the durable, hash-chained audit log; required when DATAPRISM_AUDIT_SINK=hash-chained, refused as MISSING_AUDIT_FILE_PATH if absent for that sink, ignored otherwise"
          },
          {
            "name": "DATAPRISM_METRICS_SINK",
            "description": "Metrics sink binding, currently only micrometer; required in production, never the framework no-op",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_HAZELCAST_TOPOLOGY",
            "description": "Cluster read-budget topology: embedded (shared across the cluster) or single-node (enforced per process); required, never defaulted",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SOURCES_CUSTOMER_BASE_URL",
            "description": "Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required",
            "isRequired": true
          },
          {
            "name": "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT",
            "description": "Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL",
            "isRequired": true
          }
        ]
      }
    ],
    "remotes": []
  },
  "dependencies": [],
  "installTargets": [
    "claude-code",
    "claude-desktop",
    "cursor",
    "vscode",
    "trae",
    "cherry-studio",
    "lingma",
    "windsurf",
    "cline",
    "workbuddy"
  ],
  "keywords": [],
  "provenance": {
    "origin": "official-mcp-registry",
    "originalId": "io.github.AindriuB/data-prism",
    "originalUrl": "https://registry.modelcontextprotocol.io/v0.1/servers/io.github.AindriuB%2Fdata-prism/versions/latest",
    "isOfficial": true,
    "status": "active"
  }
}