Sysdig MCP Server for Secure Product

A Model Context Protocol server that exposes Sysdig Secure API capabilities as agent-callable tools. Used by the Bloom skill plugins.

Tools

Customer & User

| Tool | Endpoint | Description | |------|----------|-------------| | get_customer_settings | GET /ui/customerSettings | Fetch all Secure settings for the current customer (which product features are enabled) | | get_current_user | GET /api/users/me | Fetch the user profile of the currently authenticated principal | | get_user_permissions | GET /api/users/me/permissions | Fetch the permissions granted to the current principal in their active team (with customer/user/team IDs) |

Threats Engine

| Tool | Endpoint | Description | |------|----------|-------------| | list_threats_engine_groups | GET /api/v1/threatsEngine/groups | List threat groups with filters (time, status, type, zones, query expression) | | get_threats_engine_group | GET /api/v1/threatsEngine/groups/{groupId} | Get a single threat group by ID | | get_threats_engine_threat | GET /api/v1/threatsEngine/threats/{threatId} | Get a single threat occurrence by ID | | list_threats_engine_threats_by_group | GET /api/v1/threatsEngine/groups/{groupId}/threats | List the threat occurrences inside a group | | list_threats_engine_rules_by_group | GET /api/v1/threatsEngine/groups/{groupId}/rules | List the detection rules that triggered within a group | | list_threats_engine_resources_by_group | GET /api/v1/threatsEngine/groups/{groupId}/resources | List the infrastructure resources involved in a group |

Runtime Security Events

| Tool | Endpoint | Description | |------|----------|-------------| | list_runtime_events | GET /secure/events/v1/events | List runtime security events (Falco + ML detections) from the last N hours | | get_event_info | GET /secure/events/v1/events/{event_id} | Retrieve full details for a specific security event by ID | | get_event_process_tree | GET /api/process-tree/v1/process-branches/{event_id} + GET /api/process-tree/v1/process-trees/{event_id} | Retrieve the process tree (branches + full tree) for a security event |

Threat Intelligence

| Tool | Endpoint | Description | |------|----------|-------------| | fetch_threat_intelligence_feed | GET /api/secure/threat-center/v1/articles | Fetch the daily Sysdig threat intelligence feed (CVEs, zero-days, active attacks) |

Vulnerability Scan Results

| Tool | Endpoint | Description | |------|----------|-------------| | list_runtime_scan_results | GET /secure/vulnerability/v1/runtime-results | List vulnerability scan results for runtime workloads | | get_scan_result | GET /secure/vulnerability/v1/results/{resultId} | Retrieve the full vulnerability scan report for a given resultId |

Vulnerability Findings

| Tool | Endpoint | Description | |------|----------|-------------| | list_vulnerability_findings | GET /api/secure/analytics/v1/data/vulnerabilities/findings | List vulnerability findings, optionally filtered by zone and severity | | list_vulnerability_findings_by_image | GET /api/secure/analytics/v1/data/vulnerabilities/findings/by-image | List vulnerability findings for a specific container image | | list_vulnerability_findings_by_resource | GET /api/secure/analytics/v1/data/vulnerabilities/findings/by-resource | List vulnerability findings affecting a specific resource (host, workload, …) |

Posture

| Tool | Endpoint | Description | |------|----------|-------------| | list_posture_resource_kinds | GET /api/cspm/v1/policy/controls/resource-template/kinds | List the resource kinds supported by Posture custom controls | | get_posture_resource_template | GET /api/cspm/v1/policy/controls/resource-template/view/{resource_kind} | Fetch the sample input fixture for a resource kind | | test_posture_rego | POST /api/cspm/v1/policy/controls/test-rego | Compile and evaluate a Rego rule against the sample fixture | | list_posture_controls | GET /api/cspm/v1/policy/controls/search | List Posture controls (custom by default; built-in via is_custom: false) | | list_posture_policies | GET /api/cspm/v1/policy/policies/list | List Posture policies (custom by default; built-in via is_custom: false) |

CloudAuth

| Tool | Endpoint | Description | |------|----------|-------------| | list_cloud_accounts | GET /api/cloudauth/v1/accounts | List onboarded cloud accounts (AWS / Azure / GCP / Okta / GitHub / IBM Cloud / Oracle Cloud), with provider/organization/feature filters | | get_cloud_account | GET /api/cloudauth/v1/accounts/{accountId} | Get a single cloud account by UUID (optionally with decrypted credentials) | | get_cloud_account_feature | GET /api/cloudauth/v1/accounts/{accountId}/feature/{featureType} | Get the configuration of a specific feature on an account | | validate_cloud_account | POST /api/cloudauth/v1/accounts/{accountId}/validate | Trigger a fresh validation of the account (bypasses cache) and persist the result |

Remediation Jobs

| Tool | Endpoint | Description | |------|----------|-------------| | list_remediation_jobs | GET /api/next/cp/jobs | List existing remediation jobs | | get_remediation_job | GET /api/next/cp/jobs/{job_id} | Retrieve a single remediation job by ID | | update_remediation_job | PUT /api/next/cp/jobs/{job_id} | Update a remediation job (status, assignee, notes) | | list_candidate_remediation_jobs | GET /api/next/cp/candidate_jobs | List candidate jobs that could be added to a remediation plan |

Remediation Plans

| Tool | Endpoint | Description | |------|----------|-------------| | list_plans | GET /api/next/cp/plans | List remediation plans | | get_plan | GET /api/next/cp/plans/{plan_id} | Retrieve a single remediation plan by ID | | create_plan | POST /api/next/cp/plans | Create a new remediation plan | | update_plan | PUT /api/next/cp/plans/{plan_id} | Update an existing remediation plan | | delete_plan | DELETE /api/next/cp/plans/{plan_id} | Delete a remediation plan | | duplicate_plan | POST /api/next/cp/plans/{plan_id}/duplicate | Duplicate an existing remediation plan | | list_plan_remediation_jobs | GET /api/next/cp/plans/{plan_id}/jobs | List the remediation jobs attached to a plan | | get_plan_target_measure | GET /api/next/cp/plans/{plan_id}/target_measure | Get the target-measure time series for a plan | | batch_plan_target_measures | POST /api/next/cp/plans/target_measures | Batch-fetch target measures across multiple plans | | list_scope_labels | GET /api/next/cp/scope/labels | List the scope label keys available for plan targeting |

Zones

| Tool | Endpoint | Description | |------|----------|-------------| | list_zones | GET /api/v2/zones | List the zones configured for the current customer |

SysQL

| Tool | Endpoint | Description | |------|----------|-------------| | run_sysql | GET /api/sysql/v2/query | Execute a SysQL query against the Sysdig API | | generate_sysql | GET /api/sage/sysql/generate | Translate a natural-language question into a SysQL query |

Bloom Skill State

| Tool | Endpoint | Description | |------|----------|-------------| | get_skill_state | GET /api/bloom/{skill_state} | Read the persisted state of a Bloom skill | | save_skill_state | POST /api/bloom/{skill_state} | Persist the state of a Bloom skill | | delete_skill_state | DELETE /api/bloom/{skill_state} | Delete the persisted state of a Bloom skill |

Transports

The server supports two transport modes, selected via SYSDIG_MCP_TRANSPORT:

| Mode | Value | How credentials are passed | |------|-------|---------------------------| | stdio (default) | stdio | SYSDIG_SECURE_API_TOKEN and SYSDIG_SECURE_URL env vars (or the MCP-specific overrides — see Environment Variables) | | HTTP | http | Authorization: Bearer <token> and X-Sysdig-Host: <url> request headers |

In HTTP mode the server listens on port 8808 by default (override with SYSDIG_MCP_PORT).

Running

Via npx (no clone needed)

The easiest way to use the server locally — npx downloads and builds it on first run:

SYSDIG_SECURE_API_TOKEN=<your-token> \
SYSDIG_SECURE_URL=https://us2.app.sysdig.com \
npx -y @sysdig/secure-mcp-server

From source

npm install
npm run build

stdio:

SYSDIG_SECURE_API_TOKEN=<your-token> \
SYSDIG_SECURE_URL=https://us2.app.sysdig.com \
node dist/index.js

HTTP:

SYSDIG_MCP_TRANSPORT=http SYSDIG_MCP_PORT=8808 node dist/index.js

Health check: GET /health · MCP endpoint: POST /mcp

Claude Code Configuration

One-liner via claude mcp add (stdio)

claude mcp add sysdig-extended \
  --transport stdio \
  --env SYSDIG_SECURE_API_TOKEN=<your-token> \
  --env SYSDIG_SECURE_URL=https://us2.app.sysdig.com \
  -- npx -y @sysdig/secure-mcp-server

Pin a tag/branch with @sysdig/secure-mcp-server#<ref>.

stdio via npx (manual .mcp.json)

{
  "mcpServers": {
    "sysdig-extended": {
      "command": "npx",
      "args": ["@sysdig/secure-mcp-server"],
      "env": {
        "SYSDIG_SECURE_API_TOKEN": "${SYSDIG_SECURE_API_TOKEN}",
        "SYSDIG_SECURE_URL": "${SYSDIG_SECURE_URL}"
      }
    }
  }
}

stdio from local clone

{
  "mcpServers": {
    "sysdig-extended": {
      "command": "node",
      "args": ["/path/to/secure-mcp-server/dist/index.js"],
      "env": {
        "SYSDIG_SECURE_API_TOKEN": "${SYSDIG_SECURE_API_TOKEN}",
        "SYSDIG_SECURE_URL": "${SYSDIG_SECURE_URL}"
      }
    }
  }
}

HTTP (hosted instance)

{
  "mcpServers": {
    "sysdig-extended": {
      "type": "http",
      "url": "http://<host>:8808/mcp",
      "headers": {
        "Authorization": "Bearer ${SYSDIG_SECURE_API_TOKEN}",
        "X-Sysdig-Host": "${SYSDIG_SECURE_URL}"
      }
    }
  }
}

Environment Variables

| Variable | Required | Default | Description | |----------|----------|---------|-------------| | SYSDIG_SECURE_API_TOKEN | Yes (stdio)¹ | — | Sysdig API token (standard generic name, shared with the Sysdig CLI / Terraform provider) | | SYSDIG_SECURE_URL | No | https://app.sysdigcloud.com | Sysdig instance URL (standard generic name) | | SYSDIG_MCP_API_TOKEN | No | — | MCP-specific override for the API token. Wins over SYSDIG_SECURE_API_TOKEN when both are set | | SYSDIG_MCP_API_HOST | No | — | MCP-specific override for the instance URL. Wins over SYSDIG_SECURE_URL when both are set | | SYSDIG_MCP_TRANSPORT | No | stdio | Transport mode: stdio or http | | SYSDIG_MCP_PORT | No | 8808 | HTTP listen port (HTTP mode only) | | SYSDIG_MCP_BASE_PATH | No | — | Base path prefix when mounting the HTTP server behind a reverse proxy | | SYSDIG_AUTH_SERVER | No | http://localhost:9000 | OAuth2 authorization server URL (HTTP mode only) |

¹ Either SYSDIG_SECURE_API_TOKEN or SYSDIG_MCP_API_TOKEN must be set in stdio mode. The same applies to the host: either SYSDIG_SECURE_URL or SYSDIG_MCP_API_HOST.