JupiterOne MCP Server

A Model Context Protocol (MCP) server that provides access to JupiterOne tools. This server enables AI assistants and other MCP clients to interact with JupiterOne's data.

Configuration

Prerequisites

1. JupiterOne Account: You need an active JupiterOne account
2. API Key: Generate an API key from your JupiterOne account settings
3. Account ID: Your JupiterOne account identifier
4. Working node installation with a version >= 18 (See https://nodejs.org/en/download and click one of the green buttons)

Installation with Claude Desktop

To use this MCP server with Claude Desktop, you need to add it to your Claude configuration file.

Option 1: Using npx (Recommended)

Add the following configuration to your Claude Desktop configuration file:

{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here",
        "JUPITERONE_BASE_URL": "https://graphql.us.jupiterone.io"
      }
    }
  }
}

Option 2: Global Installation (For nvm users or troubleshooting)

If you're using nvm or experiencing issues with Option 1, first install the package globally:

npm install -g @jupiterone/jupiterone-mcp

Then add this configuration to your Claude Desktop config file:

{
  "mcpServers": {
    "jupiterone": {
      "command": "/usr/local/bin/node",
      "args": ["/usr/local/bin/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here",
        "JUPITERONE_BASE_URL": "https://graphql.us.jupiterone.io"
      }
    }
  }
}

Note: You may need to adjust the paths in Option 2 based on your Node.js installation:

• For Homebrew Node.js: /usr/local/bin/node and /usr/local/bin/jupiterone-mcp
• For nvm: ~/.nvm/versions/node/v[version]/bin/node and ~/.nvm/versions/node/v[version]/bin/jupiterone-mcp

Installation with Cursor

For Cursor IDE, add the same configuration to your Cursor settings:

1. Open Cursor Settings
2. Navigate to "Features" → "Model Context Protocol"
3. Add the server configuration using either Option 1 or Option 2 from above

Environment Variables

Replace the placeholder values with your actual JupiterOne credentials:

• JUPITERONE_API_KEY: Your JupiterOne API key (required)
• JUPITERONE_ACCOUNT_ID: Your JupiterOne account ID (required).
• JUPITERONE_BASE_URL: JupiterOne GraphQL endpoint (optional, defaults to https://graphql.us.jupiterone.io)
• JUPITERONE_SKIP_QUERY_VALIDATION: Set to true to bypass the local J1QL syntax gate and send every query straight to the backend (optional). Escape hatch for the rare case where an older release's bundled grammar rejects syntax the JupiterOne query service has since added — if a query fails locally but works in the JupiterOne UI, set this and update the package.

Getting Your JupiterOne Credentials

1. API Key:

   • Log into your JupiterOne account
   • Go to Settings → API Keys
   • Create a new API key or use an existing one

2. Account ID:

   • This can be retrieved by either of the following:
   • Navigating to https://j1dev.apps.us.jupiterone.io/settings/account-management
   • Run the following query in your JupiterOne account: find jupiterone_account as x return x.accountId

Features

Rules Management

• list-rules - List all rules with optional limit parameter
• get-rule-details - Get detailed information about a specific rule by ID
• create-inline-question-rule - Create new inline question-based rules with operations and actions
• update-inline-question-rule - Update existing inline question rule instances
• preview-rule-actions - Render what a saved or draft rule's actions would send (Slack message with its envelope, Jira ticket, email, webhook body) against a sample of its current query results or fixture rows, and flag what would fail or mislead: the Slack body cap, a missing description, reads that found nothing, malformed recipients. Sends and saves nothing
• evaluate-rule - Trigger on-demand evaluation of a specific rule
• delete-rule - Delete a rule (destructive; does not dismiss alerts it already raised)

Rule Evaluations

• list-rule-evaluations - Get historical evaluation data for a rule with optional time filtering
• get-rule-evaluation-details - Get detailed evaluation information including query, condition, and action results
• get-rule-evaluation-query-results - The entities a rule evaluation matched, or (format: "downloadUrl") a signed link to download the whole set

Alert Monitoring

• get-active-alerts - Get all currently active alerts with optional limit parameter

Dashboard Management

• get-dashboards - List all dashboards in your account
• create-dashboard - Create new dashboards
• get-dashboard-details - Get detailed dashboard information including widgets and layouts
• update-dashboard - Arrange a dashboard's widgets (autoLayout or a hand-placed layouts grid)
• create-dashboard-widget - Add a widget whose queries are checked against the chart's render contract before the write
• update-dashboard-widget - Replace a widget's definition
• delete-dashboard-widget - Remove one widget
• delete-dashboard - Delete a dashboard

Integration Management

• get-integration-definitions - List available integration definitions with optional configuration details
• get-integration-instances - Get integration instances with optional filtering by definition ID
• get-integration-jobs - List integration jobs with optional filtering by status, instance, or definition, or read one job by its id
• get-integration-events - Get events for a specific integration job with pagination support

Account Management

• test-connection - Test connection to JupiterOne API and get account information
• list-accounts - The accounts the caller can access (multi-tenant connections only)

Query Execution

• execute-j1ql-query - Execute a J1QL query, paged by cursor; long queries return a handle
• get-query-results - Collect a query still running from its handle
• get-graph-context - Where to start: the entity classes and types the account holds, with counts, and its asset criticality levels with the filters that select each

Reference

• get-reference - One reference manual on demand: j1ql-language, j1ql-discovery, widget-types, widget-settings, dashboard-layout, rule-authoring, rule-templates, compliance-model, compliance-fields, framework-authoring, asset-criticality. Tool descriptions carry only each tool's contract and point here for the rest.

Asset Criticality

• get-asset-criticality - The account's asset criticality config: its ordered levels, the J1QL queries that fill each, assets per level, and the latest runs
• update-asset-criticality - Set up the config or change it: add, rename, reorder or remove levels, and create, change, move or remove their queries in one save, with each query checked against the save contract and counted after

The levels also reach agents without these tools: get-graph-context returns them, a J1QL query that reads criticality returns them beside its rows, and the jupiterone://asset-criticality resource serves them as Markdown. Reading the config needs Assets: Admin, Vulnerabilities: Admin or full admin; changing it needs Assets: Admin or full admin.

Threat Intelligence (Emerging Exposures)

• get-threat - Decision-grade threat brief for a CVE (compact by default; full with detail: true)
• get-threat-trending - The trending/recently-escalated threats region (cached)
• check-threat-exposure - Whether this account's own graph is exposed to given CVEs (scanner-confirmed match)

These tools require the account's VulnerabilityManagement entitlement and vulnerability read permission. One guided prompt is also exposed: Check trending threats (check-trending-threats).

Compliance (CCM)

• get-compliance-summary - Framework scorecards (health percentage, passing and failing requirements and controls), a chosen set of frameworks (frameworkIds), one framework's sections, failing requirements and full requirement list (includeRequirements), imports in flight, and attestations about to expire
• list-controls - Controls filtered by status, state, framework, organizational unit (id or name), owner, attestation and more, with test counts, why each failing control fails, framework names, and the controls whose test names match a search
• get-control - One control by id, identifier or name: why it passes or fails, its tests with their latest evaluation (and, on a draft, how many ran and failed), and its requirements and attestations
• create-attestation - Attest a LIVE control with a subject and expiry (returns the existing attestation rather than a duplicate)
• update-attestation - Change or renew an attestation
• revoke-attestation - Revoke an attestation (permanent)

Framework authoring (2.7.0): an agent builds a customer's compliance program incrementally, everything landing DRAFT for review, and promotes it explicitly.

• check-compliance-coverage - Whether a standard is loaded, importable from JupiterOne's library or absent, and which existing controls already address a topic
• import-framework - Queue a prebuilt library framework (CIS, SOC 2, ISO 27001, NIST, PCI DSS, DORA) by source and sourceId
• create-framework - An empty framework for the customer's own program
• create-requirements - A batch of requirements (1–50) under a framework, deduped against the ones it has
• create-controls - A batch of controls (1–25) under a requirement, in the customer's words, deduped by name
• link-controls - Attach existing controls (JupiterOne-managed or the customer's) to a requirement instead of duplicating them
• update-control - Change a control's fields and the requirements it serves (requirementIds set, add or remove)
• create-control-test / update-control-test / delete-control-test - One J1QL test per call, parsed and run before it is saved, with resultsAre GOOD or BAD
• transition-controls - Move controls between DRAFT, REVIEW, LIVE and RETIRED in a batch, by id or for a whole framework, with every hop explained
• evaluate-controls - Run controls' tests now (how a draft proves its tests before promotion)
• delete-control - Delete a control created by mistake while authoring
• create-exemptions / revoke-exemptions - Exempt specific assets from a control test with a justification and optional expiry, and withdraw exemptions by decision or entity

Two guided prompts walk through the flow: Author a compliance framework (author-compliance-framework) and Promote a compliance framework (promote-compliance-framework); the same text is served as Skills over MCP to clients that support them.

These tools require the account's Compliance (CCM) entitlement and control read permission. Writes need edit permission on the control's resource group (framework creates need framework create permission), and listing attestations account-wide needs CCM read-admin.

Available Tools

Rules Management

| Tool | Description | Parameters | | ----------------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | list-rules | List all rules in the account | limit (optional): Number of rules to return (1-1000) | | get-rule-details | Get detailed rule information | ruleId: ID of the rule | | create-inline-question-rule | Create new inline question rule | name, description, pollingInterval, outputs, specVersion (use 1), question (queries[]), operations, labels; optional notifyOnFailure, triggerActionsOnNewEntitiesOnly, ignorePreviousResults, templates, tags (legacy) | | update-inline-question-rule | Update existing rule | id, name, description, notifyOnFailure, triggerActionsOnNewEntitiesOnly, ignorePreviousResults, pollingInterval, outputs, specVersion, version, tags, templates, labels, resourceGroupId, remediationSteps, question, operations | | evaluate-rule | Trigger rule evaluation | ruleId: ID of the rule to evaluate | | preview-rule-actions | Render actions, sending nothing | ruleId for a saved rule, or question, operations and optional templates for a draft | | delete-rule | Delete a rule permanently | ruleId: ID of the rule to delete |

Rule Evaluations

| Tool | Description | Parameters | | ----------------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | list-rule-evaluations | Get rule evaluation history | ruleId, beginTimestamp (optional), endTimestamp (optional), limit (optional), tag (optional) | | get-rule-evaluation-details | Get detailed evaluation results | ruleId, timestamp | | get-rule-evaluation-query-results | Query results from an evaluation, or a download link for the whole set | rawDataKey, limit (optional, 1–250), format (optional: rows, downloadUrl) |

Alert Monitoring

| Tool | Description | Parameters | | ------------------- | ------------------ | ------------------------------------------------------- | | get-active-alerts | List active alerts | limit (optional): Number of alerts to return (1-1000) |

Dashboard Management

| Tool | Description | Parameters | | ------------------------- | ------------------------------ | ----------------------------------------------------- | | get-dashboards | List all dashboards | None | | create-dashboard | Create new dashboard | name, type | | get-dashboard-details | Get dashboard details | dashboardId | | update-dashboard | Arrange a dashboard's widgets | dashboardId; exactly one of autoLayout, layouts | | create-dashboard-widget | Create a widget on a dashboard | dashboardId, input | | update-dashboard-widget | Replace a widget's definition | dashboardId, widgetId, input | | delete-dashboard-widget | Remove one widget | dashboardId, widgetId | | delete-dashboard | Delete a dashboard | dashboardId |

Integration Management

| Tool | Description | Parameters | | ----------------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | get-integration-definitions | List integration definitions | includeConfig (optional): Include configuration fields | | get-integration-instances | Get integration instances | definitionId (optional), limit (optional) | | get-integration-jobs | List integration jobs, or read one by id | integrationJobId (optional, with integrationInstanceId), status (optional), integrationInstanceId (optional), integrationDefinitionId (optional), integrationInstanceIds (optional), size (optional), cursor (optional) | | get-integration-events | Get events for a specific integration job | jobId, integrationInstanceId, cursor (optional), size (optional) |

Account Management

| Tool | Description | Parameters | | ----------------- | ------------------------------------------------------------------ | ---------- | | test-connection | Test connection to JupiterOne API and get account information | None | | list-accounts | The accounts the caller can access (multi-tenant connections only) | None |

Query Execution

| Tool | Description | Parameters | | -------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | execute-j1ql-query | Execute a J1QL query | query, variables (optional), cursor (optional), includeDeleted (optional), flags (optional), scopeFilters (optional) | | get-query-results | Collect a query still running from its handle | resultsUrl, waitSeconds (optional) | | get-graph-context | Entity classes and types with counts, and the asset criticality levels | None |

Reference

| Tool | Description | Parameters | | --------------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | get-reference | One reference manual on demand | topic: j1ql-language, j1ql-discovery, widget-types, widget-settings, dashboard-layout, rule-authoring, rule-templates, compliance-model, compliance-fields, framework-authoring, asset-criticality |

Asset Criticality

| Tool | Description | Parameters | | -------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | get-asset-criticality | The levels, their queries, assets per level and the latest runs | None | | update-asset-criticality | Set up or change the levels and their queries | At least one of levels[] (the whole ladder, 2–6: name; slug to keep a level), upsertQueries[] (≤50: id to change; level, name, j1ql, enabled), removeQueryIds[] (≤50) |

Threat Intelligence (Emerging Exposures)

| Tool | Description | Parameters | | ----------------------- | ------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | get-threat | Decision-grade threat brief for a CVE | cveId; assetExposure (optional: public/internal); detail (optional: full brief) | | get-threat-trending | Trending/recently-escalated threats (cached ~30 min) | limit (optional) | | check-threat-exposure | This account's own exposure per CVE (scanner-confirmed) | cveIds (1–25) |

Requires the account's VulnerabilityManagement entitlement and vulnerability read permission. check-threat-exposure returning scannerConfirmedAssetCount: 0 means "none found," not "not affected."

Compliance (CCM)

| Tool | Description | Parameters | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | get-compliance-summary | Framework scorecards, one framework's failing requirements and requirement list, imports in flight, expiring attestations | At most one of frameworkId, frameworkName, frameworkIds (1–25); includeRequirements (optional, with a drill); attestationsExpiringWithinDays (optional, 1–365, default 30) | | list-controls | Filtered, paginated list of controls, with failReason per failing row and testNameMatches for a search | All optional: search, status, states, effectiveness, hasValidAttestation, owner, frameworkId, catalogs, mitreTechniques, source, orgUnit, sort, limit, cursor, includeDeleted | | get-control | One control with its status explanation, tests, latest evaluations, requirements and attestations | One of controlId, identifier, controlName; includeDeleted (optional) | | create-attestation | Attest a LIVE control | controlId, subject, expiresOn (ISO 8601 or epoch ms); description, owner, documentLink (optional) | | update-attestation | Change or renew an attestation | attestationId; at least one of subject, expiresOn, description, owner, documentLink | | revoke-attestation | Revoke an attestation (permanent) | attestationId | | check-compliance-coverage | Is a standard loaded, importable or absent; which controls already cover a topic | At least one of framework, topic | | import-framework | Queue a prebuilt library framework import | source (J1, UCF), sourceId; resourceGroupId (optional) | | create-framework | Create an empty framework | title, description; owner, resourceGroupId (optional) | | create-requirements | Add requirements to a framework in a batch | frameworkId, requirements[] (1–50: title; description, identifier, section, priority optional) | | create-controls | Create controls under a requirement in a batch | requirementId, controls[] (1–25: name; description, identifier, owner, remediation, exceptionProcess, mitreTechnique, catalog, resourceGroupId optional) | | link-controls | Attach existing controls to a requirement | requirementId, controlIds[] (1–25) | | update-control | Change a control's fields or the requirements it serves | controlId; at least one of controlName, description, identifier, catalog, owner, remediation, exceptionProcess, mitreTechnique, resourceGroupId, requirementIds (set, add or remove) | | create-control-test | Add one J1QL test to a control, parsed and run first | controlId, testName, query, resultsAre (GOOD, BAD); description (optional) | | update-control-test | Change a test's query, verdict, name or description | controlTestId; at least one of testName, query, resultsAre, description | | delete-control-test | Remove a test from a control | controlTestId | | transition-controls | Move controls between lifecycle states in a batch | Exactly one of controlIds[] (1–25), frameworkId (with fromStates, default DRAFT and REVIEW); targetState; note (optional) | | evaluate-controls | Run controls' tests now | controlIds[] (1–25) | | delete-control | Delete a control created by mistake | controlId | | create-exemptions | Exempt assets from a control test | controlTestId, entities[] (1–50), exemptionReason, justification; expiresOn (optional) | | revoke-exemptions | Withdraw exemptions on a control test | controlTestId; at least one of groupId, entityIds[] (1–50) |

Requires the account's Compliance (CCM) entitlement and control read permission; writes need edit permission on the control's resource group, and framework creates need framework create permission. expiringAttestations: 'unavailable' means the caller cannot list attestations account-wide (CCM read-admin), not that none are expiring.

Deployment

deploy.yml publishes this package to npm when a merge to main carries a package.json version that differs from the published one. It does not bump the version itself, so a PR that should ship must bump it.

A successful publish dispatches npm-package-published to the JupiterOne Remote MCP server, whose auto-bump-core workflow opens a review-gated pull request pinning the new version — patch and minor alike. A maintainer merges that PR; it must carry the patch label or the remote's deploy does not run.