io.github.mydatapass/mydatapass
Neutral escrow for customer-data offboarding (GDPR/EU Data Act): query MyDataPass facts.
Installation
Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).
claude mcp add --transport http mydatapass 'https://mcp.mydatapass.app/api/mcp'{
"mcpServers": {
"mydatapass": {
"type": "http",
"url": "https://mcp.mydatapass.app/api/mcp"
}
}
}Documentation
Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.
Sommaire
mydatapass-verify
Independently verify a MyDataPass export — without trusting us.
MyDataPass delivers customer data offboarding exports as encrypted, audit-logged packages. This repository contains everything a recipient (or their security team) needs to decrypt and verify an export with zero MyDataPass involvement: the package format specification and two standalone verifiers.
Why this repo exists
Our security model does not rely on secrecy of the format — it relies on the strength of the passphrase and standard, auditable cryptography. Publishing the format and the verification tooling means:
- Your security team can review exactly how packages are encrypted before signing anything.
- Recipients can decrypt and verify integrity offline, with no MyDataPass servers involved.
- If MyDataPass disappeared tomorrow, every delivered package would remain fully recoverable with the passphrase and this tooling.
Transparency log: retention and closure commitment
Every signed certificate's SHA-256 fingerprint is appended to the public transparency log at mydatapass.app/transparency. The log holds hashes only, no customer data.
- Retention: each log entry is kept for at least 5 years from the date it was added, and for as long as MyDataPass operates.
- If MyDataPass ceases operations: we will publish a final copy of the complete log in a public archive (this repository, or a public archive linked from it), so every certificate remains checkable against the log without us.
The full certificate record (with the names of the parties) is kept for a fixed period per service and then reduced to its hash; the periods are in our Terms (§ 8) and DPA (Annex 1). A signed certificate stays verifiable offline with its signature, qualified time stamp and anchor, so keep your own copy.
What's in an export package
A MyDataPass package is a JSON file with four fields:
| Field | Description |
|---|---|
ciphertext_b64 | AES-256-GCM ciphertext, Base64 |
iv_b64 | 12-byte random nonce, Base64 |
salt_b64 | 16-byte random KDF salt, Base64 |
hash_sha256 | SHA-256 hex digest of the original plaintext |
Encryption: AES-256-GCM. Key derivation: PBKDF2-HMAC-SHA256, 310,000 iterations, 32-byte key. Full details in docs/export-format.md.
Verify an export
Option A — browser, fully offline
Open verify.html in any modern browser (works from file://, no network requests are made). Select the package file, enter the passphrase, and the page decrypts via WebCrypto and checks the SHA-256 digest locally.
Option B — command line
Requires Python 3.9+ and the cryptography package:
pip install cryptography
python verify.py package.json --out exported-data.binThe script prompts for the passphrase, decrypts, and confirms the plaintext digest matches hash_sha256. Exit code 0 means the package is authentic and intact; any tampering with the ciphertext fails GCM authentication.
What this repo is NOT
This is not the MyDataPass product source code. It is the public, auditable surface: the delivery format, the verification tooling, and our security model. Questions or responsible disclosure: silvia@mydatapass.pro.
License
MIT — see LICENSE.
Questions fréquentes
Qu'est-ce que io.github.mydatapass/mydatapass ?
Neutral escrow for customer-data offboarding (GDPR/EU Data Act): query MyDataPass facts.
Comment installer io.github.mydatapass/mydatapass ?
Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http mydatapass 'https://mcp.mydatapass.app/api/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.
Faut-il une clé API pour io.github.mydatapass/mydatapass ?
Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.
io.github.mydatapass/mydatapass est-il open source ?
Oui. Son code est sur GitHub sous licence MIT.
Qui maintient io.github.mydatapass/mydatapass ?
Il est publié par mydatapass. AI.tn le référence sans le maintenir ni le recommander.
Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.