Secure LLM Data with FF3 Encryption

FPE Demo MCP - FF3 Format Preserving Encryption Server

FPE Demo MCP is a lightweight MCP (Model Context Protocol) server that demonstrates authentication and format‑preserving encryption (FF3 FPE) in a clean, readable implementation. MCP is a JSON-RPC protocol that enables LLMs to securely call external tools and services.

• ✅ FF3 FPE over digits (radix‑10)
• 🔐 Auth modes: authless, debug, test (shared secret or JWT), production (JWT only)
• 🏷️ ENC_FPE: prefix so encrypted values are obvious in logs/demos
• 🌐 Both stdio (local) and HTTP (web) transports

Demo Implementation: This shows how FF3 FPE + MCP authentication work together. Great for learning, prototyping, and understanding the concepts.

🚀 Quick Deploy

What this does: Deploys the MCP server to DigitalOcean App Platform with HTTPS, giving you a public URL for testing with web-based LLMs like ChatGPT or Claude web connectors.

Remote MCP URL: https://<your-app>.ondigitalocean.app/mcp

Auth modes:

• AUTH_MODE=authless for quick tests
• AUTH_MODE=test + header Authorization: Bearer <AUTH_TOKEN>
• AUTH_MODE=production + Bearer JWT

Note: App Platform terminates HTTPS; your app runs plain HTTP. Set HOST=0.0.0.0 and DO injects PORT.

Local Testing

MCP stdio (for LLM clients)

npm install
npm run build

# Start MCP server (stdio transport)
npm start
# or: AUTH_MODE=debug npm start

Perfect for: Claude Desktop, Claude Code, any local MCP-compatible tool.

HTTP server (for web testing)

# Basic HTTP server (no CORS)
npm run start:http

# With CORS for browser playground testing
CORS_ORIGIN=https://playground.ai.cloudflare.com npm run start:http

Server runs at http://127.0.0.1:8765/mcp using MCP Streamable HTTP protocol.

Both servers expose the same two tools:

• fpe_encrypt - encrypts a digit-domain string and returns ENC_FPE:...
• fpe_decrypt - decrypts a prior ENC_FPE:... payload

Try it (copy‑paste examples)

MCP stdio testing

Encrypt

echo '{
  "jsonrpc":"2.0","id":1,"method":"tools/call",
  "params":{"name":"fpe_encrypt","arguments":{"value":"123-45-6789"}}
}' | node dist/src/stdio-server.js

Decrypt

echo '{
  "jsonrpc":"2.0","id":2,"method":"tools/call",
  "params":{"name":"fpe_decrypt","arguments":{"value":"ENC_FPE:096616337"}}
}' | node dist/src/stdio-server.js

HTTP MCP testing

Initialize connection

curl -i http://127.0.0.1:8765/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl","version":"0"}}}'

List tools (use MCP-Session-ID from previous response)

curl -s http://127.0.0.1:8765/mcp \
  -H 'Content-Type: application/json' \
  -H 'MCP-Session-ID: <session-id>' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

Encrypt

curl -s http://127.0.0.1:8765/mcp \
  -H 'Content-Type: application/json' \
  -H 'MCP-Session-ID: <session-id>' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"fpe_encrypt","arguments":{"value":"123-45-6789"}}}'

Both servers normalize input to digits for radix‑10 before encryption.

Auth & Config

• AUTH_MODE: authless (default) | debug | test | production
• Shared secret (test mode): AUTH_TOKEN="demo-secret" → pass as {"user_token":"demo-secret"}
• JWT (test/production): Pass as {"user_token":"Bearer <jwt>"} or Authorization header
  • JWT Secret: Uses demo-secret by default, or set AUTH_JWT_SECRET for different signing key
  • JWT Algorithm: HS256 (symmetric key)
  • Optional Claims: Set AUTH_JWT_ISS for issuer validation, AUTH_JWT_AUD for audience validation

FPE Configuration (defaults provided):

export FPE_KEY=00112233445566778899aabbccddeeff    # 32-char hex key
export FPE_TWEAK=abcdef12345678                    # 14-char hex tweak

How it works (short version)

• MCP server: exposes fpe_encrypt / fpe_decrypt tools via stdio JSON-RPC.
• Auth:
  • authless/debug → skip
  • test → shared secret or JWT (HS256)
  • production → JWT only (for testing stricter auth)
• FPE (FF3):
  • Radix-10 cipher (digits only) using AES key + tweak.
  • Input normalized to digits (e.g., SSN 123-45-6789 → 123456789) before encryption.
  • Ciphertext returned as ENC_FPE:<digits> to be visually obvious in the demo.

Beyond this demo

This demo shows the core concepts. For real-world usage, you'd need:

• Key Management: KMS integration (AWS KMS, GCP KMS, HashiCorp Vault)
• Per-record tweaks: Unique tweaks per user/record to prevent pattern analysis
• Audit trails: Comprehensive logging for compliance (PCI, SOX, GDPR)
• Input validation: Schema enforcement and rate limiting
• Metadata tracking: Database fields to track encryption state, not string prefixes
• Infrastructure: Load balancing, monitoring, backup/recovery
• Compliance: Security reviews, penetration testing, certifications

FAQ

Why the ENC_ prefix?
It's a teaching aid - newcomers can see that a value is encrypted. In real systems, you'd likely omit it.

Why only digits?
FF3 operates over a radix. We start with radix-10 because it’s the clearest demo (SSNs, phones). You can extend to radix-36 (0-9a-z) if your library/config supports it.

Can I switch to RS256 JWT?
Yes - load a PEM public key and set the algorithm to RS256. The verification call stays the same.

Browser vs Remote Usage

For browser playground testing (like Cloudflare AI Playground), use the HTTP server with CORS:

CORS_ORIGIN=https://playground.ai.cloudflare.com npm run start:http

For remote server-to-server usage (ChatGPT, Claude via API, or production integrations), CORS is not needed:

npm run start:http

The MCP HTTP transport works with both browser-based and server-to-server clients. Browser clients require CORS headers, while server-to-server clients (like ChatGPT Actions or Claude's server integrations) don't need CORS.

For production deployment with web-based LLMs, see our Deployment Guide which covers DigitalOcean App Platform and other hosting options.

Docs

• Deployment Guide → docs/DEPLOYMENT.md
• Using with Claude/ChatGPT/others → docs/USAGE-LLMS.md
• Architecture → docs/ARCHITECTURE.md
• JSON Schemas → docs/SCHEMAS.md
• FF3 limitations → docs/LIMITATIONS.md

BSL 1.1 - see LICENSE.md.