Please use the following configuration to add the KOI-MCP-Server into your IDE environment.

{
  "mcpServers": {
    "koi": {
      "timeout": 60,
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "koi-mcp-server"
      ],
      "env": {
        "KOI_API_KEY": "your-api-key"
      }
    }
  }
}

Tools & API Reference

koi_list_alerts

Retrieve a paginated list of security alerts from the KOI platform. Alerts are OCSF Detection Finding events (class_uid: 2004, OCSF v1.3.0).

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number for pagination (default: 1) | | page_size | Number of alerts per page (default: 100, max: 1000) | | start_time | Filter alerts from this time (ISO 8601 format, e.g., 2024-01-01T00:00:00Z) | | end_time | Filter alerts until this time (ISO 8601 format, e.g., 2024-12-31T23:59:59Z) | | severity | Filter by severity level (e.g., critical, high, medium, low, informational) | | status | Filter by alert status (e.g., new, in_progress, resolved) |

koi_list_approval_requests

Retrieve a list of software approval requests from the KOI platform.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | status | Filter by status (e.g., pending, approved, rejected) |

koi_list_audit_logs

Retrieve a paginated list of audit logs from the KOI platform. Logs track actions such as software installations, uninstalls, and blocks across devices.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | start_time | Filter from this time (ISO 8601, e.g., 2024-01-01T00:00:00Z) | | end_time | Filter until this time (ISO 8601, e.g., 2024-12-31T23:59:59Z) | | type | Filter by log type (e.g., extensions, packages) | | action | Filter by action (e.g., installed, uninstalled, blocked) | | hostname | Filter by device hostname | | marketplace | Filter by marketplace (e.g., chrome, npm, chocolatey) |

koi_list_devices

Retrieve a list of all devices registered in the KOI platform, including hostname, OS, status, last seen time, and last logged-on user.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | os | Filter by operating system (e.g., windows, mac, linux) | | status | Filter by device status (e.g., active, inactive) | | group_id | Filter by device group ID | | hostname | Search by hostname |

koi_list_findings

Retrieve a paginated list of security findings from the KOI platform. Findings represent detected risks or threats with descriptions and risk scores.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | risk_level | Filter by risk level (e.g., critical, high, medium, low) | | search | Search findings by name or description |

koi_list_groups

Retrieve a list of all device groups in the KOI platform, including the devices in each group.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) |

koi_list_inventory

Retrieve a paginated list of software/packages installed across your organization's endpoints. Supports filtering by marketplace, platform, risk level, publisher, and name search.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | marketplace | Filter by marketplace (e.g., chrome, npm, chocolatey, hugging_face, vscode) | | platform | Filter by platform | | risk_level | Filter by risk level (e.g., critical, high, medium, low) | | publisher | Filter by publisher name | | search | Search by item name | | view | Predefined view / marketplace group filter |

koi_list_policies

Retrieve a paginated list of all security policies configured in the KOI platform (block, alert, allow policies for software).

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | enabled | Filter by enabled status (true or false) | | action | Filter by policy action (e.g., block, alert, allow) |

koi_list_remediations

Retrieve a list of remediation suggestions from the KOI platform. Remediations identify software that should be removed or addressed on specific devices.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | status | Filter by status (e.g., open, dismissed, resolved) | | risk_level | Filter by risk level (e.g., critical, high, medium, low) | | platform | Filter by platform (e.g., chrome, npm, hugging_face) | | device_id | Filter by device ID (UUID) | | hostname | Filter by device hostname |

koi_create_report

Create an async inventory report job on the KOI platform. Returns a report_id to poll with koi_get_report_status.

Parameters

| Parameter | Description | | :--- | :--- | | report_type | Required. Type of report to generate.• 'inventory_by_extension' — one row per unique extension/package.• 'inventory_by_instance' — one row per installation instance on each device. |

koi_get_report_status

Check the status of a KOI report job created with koi_create_report. When status is 'completed', a download_url is available to retrieve the report file.

Parameters

| Parameter | Description | | :--- | :--- | | report_id | Required. Report ID returned by koi_create_report |

koi_list_users

Retrieve a list of all users in the KOI platform, including their roles and statuses.

Parameters

| Parameter | Description | | :--- | :--- | | page | Page number (default: 1) | | page_size | Items per page (default: 100, max: 1000) | | role | Filter by role (e.g., Admin, User) | | status | Filter by status (e.g., enabled, disabled) |