# nibsbin/opentdf-mcp architecture

> Architecture diagram of the GitHub repository nibsbin/opentdf-mcp, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nibsbin/opentdf-mcp
- Repository: https://github.com/nibsbin/opentdf-mcp

## Overview

This Go application offers OpenTDF operations through two entry points: a command-line interface and an MCP server over stdio. Both configure an SDK client against an OpenTDF platform, then support encrypted-data creation and consumption, while the CLI also requests entity entitlements and lists policy attributes; MCP exposes attribute listing as a tool. Encryption produces TDF or nanoTDF files, and decryption returns plaintext. The excerpts show the CLI dispatch and major SDK calls; MCP excerpts are partial, so only documented tool registration and visible operations are mapped.

Main entry points: [`cmd/main.go`](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/main.go) (CLI dispatcher), [`mcp-server/main.go`](https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go) (MCP server), [`cmd/encrypt.go`](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/encrypt.go) (Encrypt command), [`cmd/decrypt.go`](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/decrypt.go) (Decrypt command)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI"]
  node_cli_entry["CLI dispatcher<br/>[main.go]"]
  node_cli_encrypt["Encrypt command<br/>[encrypt.go]"]
  node_cli_decrypt["Decrypt command<br/>[decrypt.go]"]
  node_cli_entitlements["Entitlements command<br/>[entitlements.go]"]
  node_cli_attributes["Attributes command<br/>[attributes.go]"]
end

subgraph group_mcp["MCP Server"]
  node_mcp_server["MCP server<br/>[main.go]"]
  node_mcp_encrypt["Encrypt tool<br/>[main.go]"]
  node_mcp_decrypt["Decrypt tool<br/>[main.go]"]
  node_mcp_attributes["Attributes tool<br/>[main.go]"]
  node_mcp_config["MCP configuration<br/>[config.go]"]
end

subgraph group_sdk_platform["SDK and Platform"]
  node_opentdf_sdk["OpenTDF SDK"]
  node_platform["OpenTDF platform"]
  node_kas["Key Access Server"]
end

subgraph group_local_data["Local Data"]
  node_input_data["Plaintext input"]
  node_encrypted_file["Encrypted file"]
  node_plaintext_output["Plaintext output"]
  node_entitlement_result["Entitlements result"]
  node_attribute_result["Attribute results"]
end

node_cli_user(("CLI user"))
node_mcp_client(("MCP client"))

node_cli_user -->|"runs commands"| node_cli_entry
node_cli_entry -->|"dispatches"| node_cli_encrypt
node_cli_entry -->|"dispatches"| node_cli_decrypt
node_cli_entry -->|"dispatches"| node_cli_entitlements
node_cli_entry -->|"dispatches"| node_cli_attributes
node_cli_encrypt -->|"creates nanoTDF"| node_opentdf_sdk
node_cli_decrypt -->|"reads or loads"| node_opentdf_sdk
node_cli_entitlements -->|"requests entitlements"| node_opentdf_sdk
node_cli_attributes -->|"lists policy data"| node_opentdf_sdk
node_cli_encrypt -->|"reads plaintext"| node_input_data
node_cli_encrypt -->|"writes encrypted data"| node_encrypted_file
node_cli_decrypt -->|"reads encrypted data"| node_encrypted_file
node_cli_decrypt -->|"writes plaintext"| node_plaintext_output
node_cli_entitlements -->|"prints JSON"| node_entitlement_result
node_cli_attributes -->|"prints listings"| node_attribute_result
node_mcp_client -->|"connects over stdio"| node_mcp_server
node_mcp_server -->|"registers tool"| node_mcp_encrypt
node_mcp_server -->|"registers tool"| node_mcp_decrypt
node_mcp_server -->|"registers tool"| node_mcp_attributes
node_mcp_server -->|"loads settings"| node_mcp_config
node_mcp_encrypt -->|"creates TDF"| node_opentdf_sdk
node_mcp_decrypt -->|"reads or loads"| node_opentdf_sdk
node_mcp_attributes -->|"lists policy data"| node_opentdf_sdk
node_mcp_encrypt -->|"reads input"| node_input_data
node_mcp_encrypt -->|"writes encrypted data"| node_encrypted_file
node_mcp_decrypt -->|"reads encrypted data"| node_encrypted_file
node_mcp_decrypt -->|"returns plaintext"| node_plaintext_output
node_mcp_attributes -->|"returns listings"| node_attribute_result
node_opentdf_sdk -->|"calls platform APIs"| node_platform
node_opentdf_sdk -->|"uses key services"| node_kas

click node_cli_entry "https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/main.go"
click node_cli_encrypt "https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/encrypt.go"
click node_cli_decrypt "https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/decrypt.go"
click node_cli_entitlements "https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/entitlements.go"
click node_cli_attributes "https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/attributes.go"
click node_mcp_server "https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go"
click node_mcp_encrypt "https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go"
click node_mcp_decrypt "https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go"
click node_mcp_attributes "https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go"
click node_mcp_config "https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/config.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli_entry,node_cli_encrypt,node_cli_decrypt,node_cli_entitlements,node_cli_attributes,node_cli_user,node_mcp_client toneBlue
class node_mcp_server,node_mcp_encrypt,node_mcp_decrypt,node_mcp_attributes,node_mcp_config toneAmber
class node_opentdf_sdk,node_platform,node_kas toneMint
class node_input_data,node_encrypted_file,node_plaintext_output,node_entitlement_result,node_attribute_result toneRose
```

## Components

### CLI

- [CLI dispatcher](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/main.go): `cmd/main.go`
- [Encrypt command](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/encrypt.go): `cmd/encrypt.go`
- [Decrypt command](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/decrypt.go): `cmd/decrypt.go`
- [Entitlements command](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/entitlements.go): `cmd/entitlements.go`
- [Attributes command](https://github.com/nibsbin/opentdf-mcp/blob/main/cmd/attributes.go): `cmd/attributes.go`

### MCP Server

- [MCP server](https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go): `mcp-server/main.go`
- [Encrypt tool](https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go): `mcp-server/main.go`
- [Decrypt tool](https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go): `mcp-server/main.go`
- [Attributes tool](https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/main.go): `mcp-server/main.go`
- [MCP configuration](https://github.com/nibsbin/opentdf-mcp/blob/main/mcp-server/config.go): `mcp-server/config.go`

### SDK and Platform

- **OpenTDF SDK**
- **OpenTDF platform**
- **Key Access Server**

### Local Data

- **Plaintext input**
- **Encrypted file**
- **Plaintext output**
- **Entitlements result**
- **Attribute results**

### Other components

- **CLI user**
- **MCP client**

## Connections

- CLI user → CLI dispatcher: runs commands
- CLI dispatcher → Encrypt command: dispatches
- CLI dispatcher → Decrypt command: dispatches
- CLI dispatcher → Entitlements command: dispatches
- CLI dispatcher → Attributes command: dispatches
- Encrypt command → OpenTDF SDK: creates nanoTDF
- Decrypt command → OpenTDF SDK: reads or loads
- Entitlements command → OpenTDF SDK: requests entitlements
- Attributes command → OpenTDF SDK: lists policy data
- Encrypt command → Plaintext input: reads plaintext
- Encrypt command → Encrypted file: writes encrypted data
- Decrypt command → Encrypted file: reads encrypted data
- Decrypt command → Plaintext output: writes plaintext
- Entitlements command → Entitlements result: prints JSON
- Attributes command → Attribute results: prints listings
- MCP client → MCP server: connects over stdio
- MCP server → Encrypt tool: registers tool
- MCP server → Decrypt tool: registers tool
- MCP server → Attributes tool: registers tool
- MCP server → MCP configuration: loads settings
- Encrypt tool → OpenTDF SDK: creates TDF
- Decrypt tool → OpenTDF SDK: reads or loads
- Attributes tool → OpenTDF SDK: lists policy data
- Encrypt tool → Plaintext input: reads input
- Encrypt tool → Encrypted file: writes encrypted data
- Decrypt tool → Encrypted file: reads encrypted data
- Decrypt tool → Plaintext output: returns plaintext
- Attributes tool → Attribute results: returns listings
- OpenTDF SDK → OpenTDF platform: calls platform APIs
- OpenTDF SDK → Key Access Server: uses key services