Skip to main content
Glama
sanyambassi

thales-cdsp-csm-mcp-server

by sanyambassi

manage_dfc_keys

Manage DFC encryption keys: create, update, delete, list, enable/disable, and rotate, with auto-rotation and certificate generation.

Instructions

DFC KEY MANAGEMENT TOOL - Advanced encryption key management and lifecycle

SUPPORTED ACTIONS: • create: Create new DFC keys with encryption algorithms (AES128GCM, AES256GCM, RSA2048, etc.) • update: Modify DFC key properties, tags, and metadata • delete: Delete DFC keys with proper cleanup • list: List DFC keys in directory with filtering • set_state: Enable/disable DFC keys for access control • rotate: Rotate DFC keys on demand with new certificates and key data

ADVANCED FEATURES: • Auto-rotation with configurable intervals (7-365 days) • Customer fragment encryption for enhanced security • Self-signed certificate generation with X.509 support • Split levels (3 or 4 fragments) for key distribution • Expiration and rotation event notifications • Comprehensive metadata and configuration support

SECURITY CAPABILITIES: • Enterprise-grade key management with audit trails • Access control and delete protection • Customer fragment integration • Certificate lifecycle management • Compliance and governance reporting

Example: Create an AES256GCM DFC key with auto-rotation for application encryption

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
jsonNoSet output format to JSON
nameNoDFC key name/path (required for create, update, delete, set_state)
pathNoPath to list keys from (for list action)
tagsNoList of tags attached to this DFC key
actionYesDFC key management action to perform. SUPPORTED ACTIONS: 'create' (create new DFC keys with encryption algorithms), 'update' (modify DFC key properties), 'delete' (delete DFC keys), 'list' (list DFC keys in directory), 'set_state' (enable/disable DFC keys), 'rotate' (rotate DFC keys on demand)
rm_tagsNoTags to remove (for update)
versionNoVersion to delete (-1 for all versions)
add_tagsNoTags to add (for update)
key_typeNo🔐 ENCRYPTION KEY MANAGEMENT: Encryption algorithm (AES128GCM, AES256GCM, RSA2048, etc.) - choose based on your security requirementsAES256GCM
metadataNoAdditional metadata in JSON format
new_nameNoNew name for the key (for update)
filter_byNoFilter keys by pattern (for list action)
auto_rotateNoEnable auto-rotation (None = use API default, 'true'/'false')
descriptionNoHuman-readable description of the key
split_levelNoNumber of fragments (3 or 4)
max_versionsNoMaximum number of versions (for update)
new_key_dataNoNew base64 encoded value for classic keys (bring-your-own-key)
accessibilityNoAccessibility levelregular
desired_stateNoDesired state: 'Enabled' or 'Disabled' (capitalized, for set_state)
conf_file_dataNoConfiguration file data
delete_in_daysNoSoft delete retention period in days
protection_keyNoCustomer fragment ID (full UUID or partial - system automatically searches for full match)
certificate_ttlNoCertificate TTL in days (1-365)
delete_protectionNoProtection from accidental deletion
new_cert_pem_dataNoNew PEM encoded certificate for classic keys (bring-your-own-key)
rotation_event_inNoDays before rotation to notify
rotation_intervalNoDays between rotations (7-365, only used if auto_rotate is 'true')
certificate_formatNoCertificate format (PEM, DER, etc.)
delete_immediatelyNoDelete immediately (bypass soft delete)
certificate_countryNoCertificate country code
expiration_event_inNoDays before expiration to notify
certificate_localityNoCertificate locality/city
certificate_provinceNoCertificate province/state
certificate_common_nameNoCertificate common name
certificate_digest_algoNoCertificate digest algorithm (for RSA keys, only 'sha256' is supported)
certificate_organizationNoCertificate organization
generate_self_signed_certificateNoWhether to generate a self signed certificate with the key. If set, certificate_ttl must be provided.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the transparency burden. It discloses several behavioral traits like auto-rotation, soft delete, delete protection, and audit trails, but does not explain side effects (e.g., irreversibility of delete, access-control impact of set_state) or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Structured into clear sections and bullet points, but it is verbose with marketing-like phrases ('Enterprise-grade key management with audit trails', 'Compliance and governance reporting') and all-caps headings that add noise. The supported actions list partially duplicates the action parameter's schema description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite 37 parameters, the schema has 100% coverage and an output schema exists, so the description need not explain return values. The description covers major capabilities (auto-rotation, self-signed certificates, split levels, notification events) adequately, giving an agent enough context to operate the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by giving concrete algorithm examples (AES128GCM, AES256GCM, RSA2048), rotation interval range (7-365 days), and clarifying concepts like split levels and customer fragments, which supplement the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states it is a 'DFC KEY MANAGEMENT TOOL' and enumerates concrete actions (create, update, delete, list, set_state, rotate), clearly specifying the resource (DFC keys) and the lifecycle scope. This distinguishes it from sibling manage_* tools like manage_secrets or manage_roles.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool: for DFC key lifecycle management, with a concrete example and list of supported actions. It does not explicitly mention alternatives or when-not-to-use, but the title and action list make the scope obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/sanyambassi/thales-cdsp-csm-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server