Zero-Trust Model Context Protocol (MCP) Integration Server

A lightweight, local-first Model Context Protocol (MCP) server built in Python that enforces zero-trust data privacy for AI agents.

By intercepting tool calls prior to cloud transmission, this server encrypts payloads locally using AES-256-GCM and persists them to a local SQLite database. Sensitive contextual data stays encrypted at rest, gated behind an access token, and every access attempt is actively logged.

🔑 Key Features

• Model Context Protocol (MCP) Native: Exposes secure tools over standard I/O (stdio) via FastMCP.

• Zero-Trust Encryption: AES-256-GCM with random 96-bit nonces for authenticated local encryption.

• Password-Derived Keys: The encryption key is derived from a master password via scrypt, using a salt persisted in the database — ensuring the vault survives server restarts.

• Access Control: Every tool call (secure_store, secure_retrieve, audit_recent) requires a valid HMAC access token, verified in constant time to resist timing attacks.

• Audit Logging: Every store/retrieve attempt — successful or not — is written to an append-only audit_log table to ensure complete observability.

• Live Security Dashboard: Includes a lightweight FastAPI web interface to visually monitor the SQLite audit trail in real-time.

• AI Client Simulator: An async Python client (ai_client.py) demonstrating programmatic tool-calling over the MCP standard, including rejected-token handling.

Related MCP server: llm-localfirst

📁 Repository Structure

├── crypto_engine.py      # AES-256-GCM + scrypt key derivation
├── access_control.py     # Constant-time access token verification
├── audit_log.py          # Append-only audit trail logic
├── mcp_server.py         # FastMCP protocol server & SQLite DB logic
├── ai_client.py          # Async AI Agent simulator acting as an MCP client
├── dashboard.py          # FastAPI web UI for visualizing security logs
├── test_mcp.py           # Unit tests for crypto, access control, and audit logs
├── .env.example          # Template for required environment variables
├── .gitignore            # Git ignore rules
└── requirements.txt      # Core dependencies

🧠 Threat Model

What this protects against:

• Data at Rest Theft: Secrets sitting in vault.db are unreadable if the file alone is stolen (they're AES-256-GCM ciphertext, keyed off a password never written to disk).

• Tampered Ciphertext: GCM is authenticated — tampering causes decryption to fail loudly rather than silently returning garbage.

• Unauthorized Tool Calls: No access token, no data.

What this does not protect against:

• A compromised local environment that already holds the master password and access token in memory.

• Multi-tenant isolation — right now there is one shared secret vault, not per-agent scoped secrets.

• Network-level threats — this is a local stdio server, not exposed over a network by default.

🛠️ Setup & Usage

1. Install Dependencies

python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -r requirements.txt

2. Configure Environment Create a .env file in the root directory and add your passwords (the scripts will auto-load this using python-dotenv):

ZTMCP_MASTER_PASSWORD=your_secure_password
ZTMCP_ACCESS_TOKEN=your_secure_token

3. Run the AI Client Simulator Watch the automated client connect to the MCP server, authenticate, and securely process data.

python ai_client.py

4. View the Audit Dashboard Launch the FastAPI server to view real-time access logs.

uvicorn dashboard:app --reload --port 8000
# Open http://127.0.0.1:8000 in your browser

5. Run the Test Suite

python -m unittest test_mcp.py -v

🚀 Roadmap

• Per-Agent Identity: Transition from one shared token to agent-specific tokens to log which agent accessed what.

• Secret Expiry / TTL: Allow secure_store to take an optional expires_at timestamp.

• Rate Limiting: Throttle brute-force loops against secure_retrieve.

• Key Rotation: Build a rotate_key tool that re-encrypts all secrets under a new password/salt.

• OS Keyring Integration: Swap SQLite salt storage for OS keyring integration (e.g. via the keyring package).