How nibsbin/opentdf-mcp works
This Go application offers OpenTDF operations through two entry points: a command-line interface and an MCP server over stdio. Both configure an SDK client against an OpenTDF platform, then support encrypted-data creation and consumption, while the CLI also requests entity entitlements and lists policy attributes; MCP exposes attribute listing as a tool. Encryption produces TDF or nanoTDF files, and decryption returns plaintext. The excerpts show the CLI dispatch and major SDK calls; MCP excerpts are partial, so only documented tool registration and visible operations are mapped.
Main entry points: cmd/main.go CLI dispatcher · mcp-server/main.go MCP server · encrypt.go Encrypt command · decrypt.go Decrypt command
Components 20
CLI
- CLI dispatcher
cmd/main.go - Encrypt command
cmd/encrypt.go - Decrypt command
cmd/decrypt.go - Entitlements command
cmd/entitlements.go - Attributes command
cmd/attributes.go
MCP Server
- MCP server
mcp-server/main.go - Encrypt tool
mcp-server/main.go - Decrypt tool
mcp-server/main.go - Attributes tool
mcp-server/main.go - MCP configuration
mcp-server/config.go
SDK and Platform
- OpenTDF SDK
- OpenTDF platform
- Key Access Server
Local Data
- Plaintext input
- Encrypted file
- Plaintext output
- Entitlements result
- Attribute results
Other components
- CLI user
- MCP client
Connections 30
- CLI user → CLI dispatcher: runs commands
- CLI dispatcher → Encrypt command: dispatches
- CLI dispatcher → Decrypt command: dispatches
- CLI dispatcher → Entitlements command: dispatches
- CLI dispatcher → Attributes command: dispatches
- Encrypt command → OpenTDF SDK: creates nanoTDF
- Decrypt command → OpenTDF SDK: reads or loads
- Entitlements command → OpenTDF SDK: requests entitlements
- Attributes command → OpenTDF SDK: lists policy data
- Encrypt command → Plaintext input: reads plaintext
- Encrypt command → Encrypted file: writes encrypted data
- Decrypt command → Encrypted file: reads encrypted data
- Decrypt command → Plaintext output: writes plaintext
- Entitlements command → Entitlements result: prints JSON
- Attributes command → Attribute results: prints listings
- MCP client → MCP server: connects over stdio
- MCP server → Encrypt tool: registers tool
- MCP server → Decrypt tool: registers tool
- MCP server → Attributes tool: registers tool
- MCP server → MCP configuration: loads settings
- Encrypt tool → OpenTDF SDK: creates TDF
- Decrypt tool → OpenTDF SDK: reads or loads
- Attributes tool → OpenTDF SDK: lists policy data
- Encrypt tool → Plaintext input: reads input
- Encrypt tool → Encrypted file: writes encrypted data
- Decrypt tool → Encrypted file: reads encrypted data
- Decrypt tool → Plaintext output: returns plaintext
- Attributes tool → Attribute results: returns listings
- OpenTDF SDK → OpenTDF platform: calls platform APIs
- OpenTDF SDK → Key Access Server: uses key services