{
  "slug": "io-github-aindriub-data-prism",
  "name": "io.github.AindriuB/data-prism",
  "title": "Data Prism",
  "description": "Fail-closed privacy layer that pseudonymises enterprise API data for LLM agents and MCP clients.",
  "version": "0.7.1",
  "publishedAt": "2026-10-22T11:11:57.174929Z",
  "updatedAt": "2026-10-22T11:11:57.174929Z",
  "repoUrl": "https://github.com/AindriuB/data-prism",
  "websiteUrl": "https://aindriub.github.io/data-prism/",
  "namespace": {
    "type": "github",
    "owner": "AindriuB"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "oci",
      "identifier": "ghcr.io/aindriub/data-prism-server:0.7.1",
      "version": null,
      "transport": "streamable-http",
      "runtimeHint": "docker"
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "LOADER_PATH",
      "isSecret": false,
      "isRequired": true,
      "description": "Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)"
    },
    {
      "name": "DATAPRISM_SECURITY_JWT_ISSUER",
      "isSecret": false,
      "isRequired": true,
      "description": "OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment"
    },
    {
      "name": "DATAPRISM_SECURITY_JWT_AUDIENCE",
      "isSecret": false,
      "isRequired": true,
      "description": "Expected JWT audience claim for this deployment; required for every protected deployment"
    },
    {
      "name": "DATAPRISM_SECURITY_JWT_JWK_SET_URI",
      "isSecret": false,
      "isRequired": true,
      "description": "HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both"
    },
    {
      "name": "DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI",
      "isSecret": false,
      "isRequired": false,
      "description": "Alternative HTTPS OIDC issuer-discovery location; set this instead of DATAPRISM_SECURITY_JWT_JWK_SET_URI, never both"
    },
    {
      "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL",
      "isSecret": false,
      "isRequired": true,
      "description": "JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims"
    },
    {
      "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES",
      "isSecret": false,
      "isRequired": true,
      "description": "JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims"
    },
    {
      "name": "DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION",
      "isSecret": false,
      "isRequired": true,
      "description": "JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims"
    },
    {
      "name": "DATAPRISM_SECURITY_POLICY_PURPOSES",
      "isSecret": false,
      "isRequired": true,
      "description": "Comma-separated list of permitted purposes; at least one is required"
    },
    {
      "name": "DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR",
      "isSecret": false,
      "isRequired": true,
      "description": "Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 4.1.1), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required"
    },
    {
      "name": "DATAPRISM_PRIVACY_PROFILE",
      "isSecret": false,
      "isRequired": true,
      "description": "Name of the reviewed privacy profile implementation to apply; required"
    },
    {
      "name": "DATAPRISM_PRIVACY_SCOPE_LIFETIME",
      "isSecret": false,
      "isRequired": true,
      "description": "Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required"
    },
    {
      "name": "DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID",
      "isSecret": false,
      "isRequired": true,
      "description": "Identifier of the pinned HMAC key used to derive synthetic identities; required"
    },
    {
      "name": "DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE",
      "isSecret": false,
      "isRequired": true,
      "description": "Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value"
    },
    {
      "name": "DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE",
      "isSecret": false,
      "isRequired": false,
      "description": "Reference to an approved secret provider holding the HMAC key material; set this instead of DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE, never both"
    },
    {
      "name": "DATAPRISM_AUDIT_SINK",
      "isSecret": false,
      "isRequired": true,
      "description": "Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op"
    },
    {
      "name": "DATAPRISM_AUDIT_WRITER_ID",
      "isSecret": false,
      "isRequired": true,
      "description": "Writer/instance identity recorded on every audit entry; required"
    },
    {
      "name": "DATAPRISM_AUDIT_FILE_PATH",
      "isSecret": false,
      "isRequired": false,
      "description": "Path to the durable, hash-chained audit log; required when DATAPRISM_AUDIT_SINK=hash-chained, refused as MISSING_AUDIT_FILE_PATH if absent for that sink, ignored otherwise"
    },
    {
      "name": "DATAPRISM_METRICS_SINK",
      "isSecret": false,
      "isRequired": true,
      "description": "Metrics sink binding, currently only micrometer; required in production, never the framework no-op"
    },
    {
      "name": "DATAPRISM_HAZELCAST_TOPOLOGY",
      "isSecret": false,
      "isRequired": true,
      "description": "Cluster read-budget topology: embedded (shared across members that have joined one cluster; set cluster name and join mode) or single-node (enforced per process); required, never defaulted"
    },
    {
      "name": "DATAPRISM_HAZELCAST_CLUSTERNAME",
      "isSecret": false,
      "isRequired": false,
      "description": "Hazelcast cluster name; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded, never dev, refused if set with single-node"
    },
    {
      "name": "DATAPRISM_HAZELCAST_JOIN_MODE",
      "isSecret": false,
      "isRequired": false,
      "description": "How cluster members find each other: tcp-ip, kubernetes or none; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded (none is an explicit single member bound to 127.0.0.1), refused if set with single-node"
    },
    {
      "name": "DATAPRISM_HAZELCAST_JOIN_MEMBERS",
      "isSecret": false,
      "isRequired": false,
      "description": "Comma-separated member addresses (host or host:port); required when DATAPRISM_HAZELCAST_JOIN_MODE=tcp-ip, otherwise unused"
    },
    {
      "name": "DATAPRISM_HAZELCAST_MEMBER_PORT",
      "isSecret": false,
      "isRequired": false,
      "description": "Hazelcast member port, default 5701, never auto-incremented; must differ from the server, management and operator ports. Member traffic is unencrypted, so keep it on a private network. Optional"
    },
    {
      "name": "DATAPRISM_OPERATOR_ENABLED",
      "isSecret": false,
      "isRequired": false,
      "description": "Enables the operator surface; optional, off by default"
    },
    {
      "name": "DATAPRISM_OPERATOR_PORT",
      "isSecret": false,
      "isRequired": false,
      "description": "Port of the operator listener; required when DATAPRISM_OPERATOR_ENABLED=true, must differ from the server, management (OPERATOR_PORT_SHARED otherwise) and member ports, and has no fixed default (publish it explicitly)"
    },
    {
      "name": "DATAPRISM_OPERATOR_REQUIREDAUDIENCE",
      "isSecret": false,
      "isRequired": false,
      "description": "JWT audience an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true"
    },
    {
      "name": "DATAPRISM_OPERATOR_REQUIREDSCOPE",
      "isSecret": false,
      "isRequired": false,
      "description": "JWT scope an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true"
    },
    {
      "name": "DATAPRISM_SOURCES_CUSTOMER_BASE_URL",
      "isSecret": false,
      "isRequired": true,
      "description": "Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required"
    },
    {
      "name": "DATAPRISM_SOURCES_CUSTOMER_TIMEOUT",
      "isSecret": false,
      "isRequired": true,
      "description": "Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL"
    }
  ],
  "category": "search-web",
  "subcategory": "apis",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/AindriuB/data-prism"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for no secrets"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account AindriuB"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "info",
      "detail": "oci packages are not read yet"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (oci)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"data-prism\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\",\n        \"-i\",\n        \"--rm\",\n        \"-e\",\n        \"LOADER_PATH\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_JWT_ISSUER\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_JWT_AUDIENCE\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_JWT_JWK_SET_URI\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION\",\n        \"-e\",\n        \"DATAPRISM_SECURITY_POLICY_PURPOSES\",\n        \"-e\",\n        \"DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR\",\n        \"-e\",\n        \"DATAPRISM_PRIVACY_PROFILE\",\n        \"-e\",\n        \"DATAPRISM_PRIVACY_SCOPE_LIFETIME\",\n        \"-e\",\n        \"DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID\",\n        \"-e\",\n        \"DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE\",\n        \"-e\",\n        \"DATAPRISM_AUDIT_SINK\",\n        \"-e\",\n        \"DATAPRISM_AUDIT_WRITER_ID\",\n        \"-e\",\n        \"DATAPRISM_METRICS_SINK\",\n        \"-e\",\n        \"DATAPRISM_HAZELCAST_TOPOLOGY\",\n        \"-e\",\n        \"DATAPRISM_SOURCES_CUSTOMER_BASE_URL\",\n        \"-e\",\n        \"DATAPRISM_SOURCES_CUSTOMER_TIMEOUT\",\n        \"ghcr.io/aindriub/data-prism-server:0.7.1\"\n      ],\n      \"env\": {\n        \"LOADER_PATH\": \"<your value>\",\n        \"DATAPRISM_SECURITY_JWT_ISSUER\": \"<your value>\",\n        \"DATAPRISM_SECURITY_JWT_AUDIENCE\": \"<your value>\",\n        \"DATAPRISM_SECURITY_JWT_JWK_SET_URI\": \"<your value>\",\n        \"DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL\": \"<your value>\",\n        \"DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES\": \"<your value>\",\n        \"DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION\": \"<your value>\",\n        \"DATAPRISM_SECURITY_POLICY_PURPOSES\": \"<your value>\",\n        \"DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR\": \"<your value>\",\n        \"DATAPRISM_PRIVACY_PROFILE\": \"<your value>\",\n        \"DATAPRISM_PRIVACY_SCOPE_LIFETIME\": \"<your value>\",\n        \"DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID\": \"<your value>\",\n        \"DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE\": \"<your value>\",\n        \"DATAPRISM_AUDIT_SINK\": \"<your value>\",\n        \"DATAPRISM_AUDIT_WRITER_ID\": \"<your value>\",\n        \"DATAPRISM_METRICS_SINK\": \"<your value>\",\n        \"DATAPRISM_HAZELCAST_TOPOLOGY\": \"<your value>\",\n        \"DATAPRISM_SOURCES_CUSTOMER_BASE_URL\": \"<your value>\",\n        \"DATAPRISM_SOURCES_CUSTOMER_TIMEOUT\": \"<your value>\"\n      }\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 1,
  "archived": false,
  "pushedAt": "2026-10-29T03:21:09Z",
  "health": {
    "score": 45,
    "parts": {
      "popularity": 0.06998985735858865,
      "activity": 0.6,
      "issues": null,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 1,
      "forks": 0,
      "downloads": null,
      "hn": null,
      "issuesOpen": 0,
      "issuesClosed": 0,
      "prsMerged": 161,
      "commits90": 0,
      "release": "2026-10-22T08:14:34Z",
      "pushed": "2026-10-29T03:21:09Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:35:52.424Z"
  }
}