{"id":49250671,"url":"https://github.com/solomonneas/sophos-mcp","last_synced_at":"2026-04-25T00:03:34.878Z","repository":{"id":339103203,"uuid":"1152370232","full_name":"solomonneas/sophos-mcp","owner":"solomonneas","description":"MCP server for Sophos Central — endpoint management, EDR/XDR detections, alerts, Live Discover queries, and security policies","archived":false,"fork":false,"pushed_at":"2026-04-20T22:55:37.000Z","size":17486,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-21T00:38:20.933Z","etag":null,"topics":["ai-agents","api","endpoint-protection","integration","mcp","model-context-protocol","security","sophos"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/solomonneas.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"solomonneas","ko_fi":"solomonneas","buy_me_a_coffee":"solomonneas"}},"created_at":"2026-02-07T19:19:50.000Z","updated_at":"2026-04-20T22:58:50.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/solomonneas/sophos-mcp","commit_stats":null,"previous_names":["solomonneas/sophos-mcp"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/solomonneas/sophos-mcp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solomonneas%2Fsophos-mcp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solomonneas%2Fsophos-mcp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solomonneas%2Fsophos-mcp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solomonneas%2Fsophos-mcp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/solomonneas","download_url":"https://codeload.github.com/solomonneas/sophos-mcp/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solomonneas%2Fsophos-mcp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32245157,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-24T13:21:15.438Z","status":"ssl_error","status_checked_at":"2026-04-24T13:21:15.005Z","response_time":64,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","api","endpoint-protection","integration","mcp","model-context-protocol","security","sophos"],"created_at":"2026-04-25T00:03:31.201Z","updated_at":"2026-04-25T00:03:34.870Z","avatar_url":"https://github.com/solomonneas.png","language":"TypeScript","funding_links":["https://github.com/sponsors/solomonneas","https://ko-fi.com/solomonneas","https://buymeacoffee.com/solomonneas"],"categories":[],"sub_categories":[],"readme":"# Sophos Central MCP Server\n\n[![TypeScript 5.7](https://img.shields.io/badge/TypeScript-5.7-blue?logo=typescript)](https://www.typescriptlang.org/)\n[![Node.js](https://img.shields.io/badge/Node.js-20%2B-green?logo=node.js)](https://nodejs.org/)\n[![MCP SDK](https://img.shields.io/badge/MCP-1.x-purple)](https://modelcontextprotocol.io)\n[![Sophos](https://img.shields.io/badge/Sophos-Central-blue)](https://www.sophos.com/en-us/products/sophos-central)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n\nA [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that provides AI assistants with access to [Sophos Central](https://www.sophos.com/en-us/products/sophos-central), a unified cloud security management platform. Manage endpoints, investigate alerts, analyze EDR/XDR detections, run Live Discover queries, and audit security policies.\n\n## Features\n\n### Endpoints\n- List, search, and inspect endpoints by hostname, IP, OS, health status\n- Network isolation and un-isolation for incident response\n- On-demand scan triggering\n- Software inventory retrieval\n\n### Alerts\n- List and filter alerts by severity, category, product, date range\n- Acknowledge and resolve alerts with actions taken\n- View available response actions per alert\n\n### EDR/XDR Detections\n- List detections with MITRE ATT\u0026CK technique mappings\n- Threat case management (grouped related detections)\n- Detection-to-case correlation\n\n### Security Events\n- Search events by type, severity, endpoint, date range\n- Event type catalog (malware, PUA, web filter, etc.)\n- Admin audit log access\n\n### Policies\n- List endpoint, server, and firewall policies\n- Inspect individual policy configurations\n- Review global and policy-specific exclusions\n\n### Tenant Management\n- Multi-tenant listing (MSP/partner view)\n- Tenant details and license information\n- Overall tenant security health scoring\n\n### Live Discover (osquery)\n- Execute Live Discover queries on endpoints\n- Saved query library management\n- Query result retrieval\n- Query category browsing\n\n## Architecture\n\n```text\n┌────────────────────────────────────────┐\n│           MCP Client (LLM)             │\n└──────────────┬─────────────────────────┘\n               │ MCP Protocol (stdio)\n┌──────────────▼─────────────────────────┐\n│          sophos-mcp server             │\n│                                        │\n│  ┌──────────┐  ┌────────────────────┐  │\n│  │ Prompts  │  │    Resources       │  │\n│  │ 4 guides │  │ queries, policies, │  │\n│  │          │  │ MITRE mappings     │  │\n│  └──────────┘  └────────────────────┘  │\n│                                        │\n│  ┌──────────────────────────────────┐  │\n│  │            Tools                  │  │\n│  │  endpoints │ alerts │ detections  │  │\n│  │  events │ policies │ tenants     │  │\n│  │  live-discover                    │  │\n│  └──────────────┬───────────────────┘  │\n│                 │                       │\n│  ┌──────────────▼───────────────────┐  │\n│  │      Sophos Central API Client   │  │\n│  │      (OAuth2 + REST)             │  │\n│  └──────────────┬───────────────────┘  │\n└──────────────────┼─────────────────────┘\n                   │ HTTPS\n┌──────────────────▼─────────────────────┐\n│       Sophos Central Platform API      │\n│  https://api.central.sophos.com        │\n└────────────────────────────────────────┘\n```\n\n## Installation\n\n```bash\ngit clone https://github.com/solomonneas/sophos-mcp.git\ncd sophos-mcp\nnpm install\nnpm run build\n```\n\n## Configuration\n\nSophos Central uses OAuth2 with client credentials. Set environment variables:\n\n```bash\nexport SOPHOS_CLIENT_ID=\"your-client-id\"\nexport SOPHOS_CLIENT_SECRET=\"your-client-secret\"\nexport SOPHOS_TENANT_ID=\"your-tenant-id\"   # optional for single-tenant\n```\n\nOr use a `.env` file:\n\n```env\nSOPHOS_CLIENT_ID=your-client-id\nSOPHOS_CLIENT_SECRET=your-client-secret\nSOPHOS_TENANT_ID=your-tenant-id\n```\n\n### Getting API Credentials\n\n1. Log in to [Sophos Central](https://central.sophos.com)\n2. Go to **Global Settings \u003e API Credentials Management**\n3. Click **Add Credential** and assign a role\n4. Copy the Client ID and Client Secret\n\n## MCP Client Configuration\n\n### Claude Desktop\n\n```json\n{\n  \"mcpServers\": {\n    \"sophos\": {\n      \"command\": \"node\",\n      \"args\": [\"path/to/sophos-mcp/dist/index.js\"],\n      \"env\": {\n        \"SOPHOS_CLIENT_ID\": \"your-client-id\",\n        \"SOPHOS_CLIENT_SECRET\": \"your-client-secret\"\n      }\n    }\n  }\n}\n```\n\n### OpenClaw\n\nAdd to your `openclaw.json`:\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"sophos\": {\n        \"type\": \"stdio\",\n        \"command\": \"node\",\n        \"args\": [\"/path/to/sophos-mcp/dist/index.js\"],\n        \"env\": {\n          \"SOPHOS_CLIENT_ID\": \"your-client-id\",\n          \"SOPHOS_CLIENT_SECRET\": \"your-client-secret\"\n        }\n      }\n    }\n  }\n}\n```\n\n## Tool Reference\n\n| Tool | Description |\n|------|-------------|\n| `list_endpoints` | Search endpoints by hostname, IP, health, OS, group |\n| `get_endpoint` | Full endpoint details with agent info and products |\n| `isolate_endpoint` | Network isolate an endpoint (incident response) |\n| `unisolate_endpoint` | Remove network isolation |\n| `scan_endpoint` | Trigger on-demand scan |\n| `get_endpoint_software` | List installed software on endpoint |\n| `list_alerts` | Get alerts with severity/category/product filters |\n| `get_alert` | Full alert details with description |\n| `acknowledge_alert` | Mark alert as acknowledged |\n| `resolve_alert` | Resolve/close alert with action taken |\n| `get_alert_actions` | List available response actions |\n| `list_detections` | EDR/XDR detections with filters |\n| `get_detection` | Full detection with MITRE ATT\u0026CK mapping |\n| `get_threat_cases` | Grouped related detections |\n| `get_case_detections` | All detections in a threat case |\n| `update_case_status` | Update threat case status |\n| `search_events` | Search security events by type/severity/date |\n| `get_event` | Full event details |\n| `list_event_types` | Available event type catalog |\n| `get_audit_logs` | Admin audit trail |\n| `list_policies` | List endpoint/server/firewall policies |\n| `get_policy` | Full policy configuration |\n| `get_policy_settings` | Specific settings within a policy |\n| `list_exclusions` | Global and policy-specific exclusions |\n| `list_tenants` | List managed tenants (MSP view) |\n| `get_tenant` | Tenant details and license info |\n| `get_tenant_health` | Overall tenant security health score |\n| `run_query` | Execute Live Discover query on endpoints |\n| `list_saved_queries` | List saved Live Discover queries |\n| `get_query_results` | Retrieve completed query results |\n| `list_query_categories` | Available query categories |\n\n## Live Discover Query Examples\n\n```sql\n-- Running processes\nSELECT pid, name, path, cmdline, start_time FROM processes WHERE name = 'suspicious.exe';\n\n-- Listening ports (non-standard)\nSELECT pid, port, address, protocol FROM listening_ports WHERE port NOT IN (80, 443, 22);\n\n-- Scheduled tasks\nSELECT name, action, path, enabled FROM scheduled_tasks WHERE enabled = 1;\n\n-- Installed software from unknown publishers\nSELECT name, version, publisher FROM programs WHERE publisher LIKE '%unknown%';\n\n-- Active network connections to suspicious port\nSELECT pid, remote_address, remote_port, state FROM socket_events WHERE remote_port = 4444;\n\n-- File hash lookup\nSELECT path, sha256 FROM hash WHERE path = '/usr/bin/suspicious';\n\n-- Recently modified executables\nSELECT path, filename, size, mtime FROM file WHERE path LIKE '/tmp/%' AND filename LIKE '%.exe';\n```\n\n## Prompts\n\n| Prompt | Description |\n|--------|-------------|\n| `investigate-endpoint` | Guided endpoint investigation workflow |\n| `threat-hunt` | Hunt for IOCs across endpoints via Live Discover |\n| `incident-response` | Step-by-step IR: contain, investigate, remediate |\n| `health-audit` | Review tenant/endpoint security posture |\n\n## Resources\n\n| URI | Description |\n|-----|-------------|\n| `sophos://live-discover-queries` | Built-in Live Discover query library |\n| `sophos://policy-reference` | Policy settings reference |\n| `sophos://mitre-mappings` | MITRE ATT\u0026CK technique mappings |\n\n## Development\n\n```bash\nnpm run build    # Compile TypeScript\nnpm run dev      # Watch mode\nnpm run test     # Run tests\nnpm run lint     # Lint check\n```\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsolomonneas%2Fsophos-mcp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsolomonneas%2Fsophos-mcp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsolomonneas%2Fsophos-mcp/lists"}