# MPC configuration

Use this page to understand the Multi-Party Computation (MPC) fields used by Vault configuration in Ripple Custody. The example shows one possible configuration shape; node endpoints, threshold policy, resource values, and network routing depend on your deployment.

For MPC deployment procedures, see [MPC overview](/products/custody/deployment/integrate-kms/mpc/overview), [MPC on AWS](/products/custody/deployment/integrate-kms/mpc/aws-deployment), and [MPC on Azure](/products/custody/deployment/integrate-kms/mpc/azure-deployment).

## What this config controls

MPC provides distributed key management. In the documented MPC model:

- Four MPC nodes hold key shares.
- No single node has the complete key.
- A 3-of-4 threshold is used for signing operations.
- Nodes 0 and 1 are hosted by Ripple.
- Nodes 2 and 3 are deployed by the customer.


The Vault connects to the MPC network through the Node 0 HTTP API.

## Vault fields

Location: `harmonize.vaults.<vault-id>`

| Parameter | Type | Required | Description |
|  --- | --- | --- | --- |
| `platform` | string | Yes | Set to `kms_mpc`. |
| `notary_public_key` | string | Yes | Notary public key used for Vault/Notary communication. |
| `kms_mpc.url` | string | Yes | URL of MPC Node 0. |
| `kms_mpc.threshold` | integer | Yes | Minimum number of MPC nodes required to participate in signing. |


### KMS MPC URL

The `kms_mpc.url` field points the Vault at MPC Node 0.

| Attribute | Value |
|  --- | --- |
| Format | `http://<node-0-host>:<port>` or `https://<node-0-host>:<port>` |
| Common port | `8888` |
| Target node | Node 0 |


Configure the Vault to connect to MPC Node 0. Do not point Vault at Nodes 1, 2, or 3.

### KMS MPC threshold

The `threshold` value sets how many MPC nodes must participate in a signing operation.

| Threshold | Fault tolerance | Availability trade-off |
|  --- | --- | --- |
| `2` of 4 | Two nodes can fail. | Lower participation requirement. |
| `3` of 4 | One node can fail. | Documented threshold for the standard 4-node model. |
| `4` of 4 | No nodes can fail. | Requires every node for signing. |


## Vault service fields

Location: `vault`

| Field | Description |
|  --- | --- |
| `env.VAULT_LOGLEVEL` | Vault logging level. Possible values shown in the draft reference: `debug`, `info`, `warn`, `error`. |
| `env.VAULT_ID` | Vault instance UUID. This matches the key in `harmonize.vaults`. |
| `resources.requests` | CPU and memory requests for Vault. |
| `resources.limits` | CPU and memory limits for Vault. |


Platform and internal sidecar addresses are managed by the release package unless explicitly exposed.

## Network relationship

The Vault must be able to reach MPC Node 0.

| Direction | Source | Destination | Common port | Protocol |
|  --- | --- | --- | --- | --- |
| Outbound | Vault pod | MPC Node 0 | `8888` | HTTP or HTTPS |


If Node 0 is in another network, the required routing, firewall, VPN, peering, and TLS decisions are deployment-specific.

## Example

This example shows a Vault configured to use MPC:


```yaml
harmonize:
  vaults:
    "00000000-0000-0000-0000-000000000000":
      enabled: true
      platform: kms_mpc
      notary_public_key: "ed25519:<notary-public-key>"
      kms_mpc:
        url: "https://mpc-node-0.example.com:8888"
        threshold: 3

vault:
  env:
    VAULT_LOGLEVEL: "info"
    VAULT_ID: "00000000-0000-0000-0000-000000000000"
  resources:
    requests:
      cpu: 500m
      memory: 256Mi
    limits:
      cpu: 2000m
      memory: 512Mi
```

## Related topics

- [MPC overview](/products/custody/deployment/integrate-kms/mpc/overview)
- [MPC on AWS](/products/custody/deployment/integrate-kms/mpc/aws-deployment)
- [MPC on Azure](/products/custody/deployment/integrate-kms/mpc/azure-deployment)
- [Key management planning](/products/custody/deployment/planning/key-management)
- [Vault configuration](/products/custody/deployment/reference/kms-vault)
- [Notary configuration](/products/custody/deployment/reference/kms-notary)
- [Networking configuration](/products/custody/deployment/reference/networking)