Sophos Central MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to Sophos Central, a unified cloud security management platform. Manage endpoints, investigate alerts, analyze EDR/XDR detections, run Live Discover queries, and audit security policies.

Features

Endpoints

• List, search, and inspect endpoints by hostname, IP, OS, health status
• Network isolation and un-isolation for incident response
• On-demand scan triggering
• Software inventory retrieval

Alerts

• List and filter alerts by severity, category, product, date range
• Acknowledge and resolve alerts with actions taken
• View available response actions per alert

EDR/XDR Detections

• List detections with MITRE ATT&CK technique mappings
• Threat case management (grouped related detections)
• Detection-to-case correlation

Security Events

• Search events by type, severity, endpoint, date range
• Event type catalog (malware, PUA, web filter, etc.)
• Admin audit log access

Policies

• List endpoint, server, and firewall policies
• Inspect individual policy configurations
• Review global and policy-specific exclusions

Tenant Management

• Multi-tenant listing (MSP/partner view)
• Tenant details and license information
• Overall tenant security health scoring

Live Discover (osquery)

• Execute Live Discover queries on endpoints
• Saved query library management
• Query result retrieval
• Query category browsing

Architecture

┌────────────────────────────────────────┐
│           MCP Client (LLM)             │
└──────────────┬─────────────────────────┘
               │ MCP Protocol (stdio)
┌──────────────▼─────────────────────────┐
│          sophos-mcp server             │
│                                        │
│  ┌──────────┐  ┌────────────────────┐  │
│  │ Prompts  │  │    Resources       │  │
│  │ 4 guides │  │ queries, policies, │  │
│  │          │  │ MITRE mappings     │  │
│  └──────────┘  └────────────────────┘  │
│                                        │
│  ┌──────────────────────────────────┐  │
│  │            Tools                  │  │
│  │  endpoints │ alerts │ detections  │  │
│  │  events │ policies │ tenants     │  │
│  │  live-discover                    │  │
│  └──────────────┬───────────────────┘  │
│                 │                       │
│  ┌──────────────▼───────────────────┐  │
│  │      Sophos Central API Client   │  │
│  │      (OAuth2 + REST)             │  │
│  └──────────────┬───────────────────┘  │
└──────────────────┼─────────────────────┘
                   │ HTTPS
┌──────────────────▼─────────────────────┐
│       Sophos Central Platform API      │
│  https://api.central.sophos.com        │
└────────────────────────────────────────┘

Installation

git clone https://github.com/solomonneas/sophos-mcp.git
cd sophos-mcp
npm install
npm run build

Configuration

Sophos Central uses OAuth2 with client credentials. Set environment variables:

export SOPHOS_CLIENT_ID="your-client-id"
export SOPHOS_CLIENT_SECRET="your-client-secret"
export SOPHOS_TENANT_ID="your-tenant-id"   # optional for single-tenant

Or use a .env file:

SOPHOS_CLIENT_ID=your-client-id
SOPHOS_CLIENT_SECRET=your-client-secret
SOPHOS_TENANT_ID=your-tenant-id

Getting API Credentials

1. Log in to Sophos Central
2. Go to Global Settings > API Credentials Management
3. Click Add Credential and assign a role
4. Copy the Client ID and Client Secret

MCP Client Configuration

Claude Desktop

{
  "mcpServers": {
    "sophos": {
      "command": "node",
      "args": ["path/to/sophos-mcp/dist/index.js"],
      "env": {
        "SOPHOS_CLIENT_ID": "your-client-id",
        "SOPHOS_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

OpenClaw

Add to your openclaw.json:

{
  "mcp": {
    "servers": {
      "sophos": {
        "type": "stdio",
        "command": "node",
        "args": ["/path/to/sophos-mcp/dist/index.js"],
        "env": {
          "SOPHOS_CLIENT_ID": "your-client-id",
          "SOPHOS_CLIENT_SECRET": "your-client-secret"
        }
      }
    }
  }
}

Tool Reference

| Tool | Description | |------|-------------| | list_endpoints | Search endpoints by hostname, IP, health, OS, group | | get_endpoint | Full endpoint details with agent info and products | | isolate_endpoint | Network isolate an endpoint (incident response) | | unisolate_endpoint | Remove network isolation | | scan_endpoint | Trigger on-demand scan | | get_endpoint_software | List installed software on endpoint | | list_alerts | Get alerts with severity/category/product filters | | get_alert | Full alert details with description | | acknowledge_alert | Mark alert as acknowledged | | resolve_alert | Resolve/close alert with action taken | | get_alert_actions | List available response actions | | list_detections | EDR/XDR detections with filters | | get_detection | Full detection with MITRE ATT&CK mapping | | get_threat_cases | Grouped related detections | | get_case_detections | All detections in a threat case | | update_case_status | Update threat case status | | search_events | Search security events by type/severity/date | | get_event | Full event details | | list_event_types | Available event type catalog | | get_audit_logs | Admin audit trail | | list_policies | List endpoint/server/firewall policies | | get_policy | Full policy configuration | | get_policy_settings | Specific settings within a policy | | list_exclusions | Global and policy-specific exclusions | | list_tenants | List managed tenants (MSP view) | | get_tenant | Tenant details and license info | | get_tenant_health | Overall tenant security health score | | run_query | Execute Live Discover query on endpoints | | list_saved_queries | List saved Live Discover queries | | get_query_results | Retrieve completed query results | | list_query_categories | Available query categories |

Live Discover Query Examples

-- Running processes
SELECT pid, name, path, cmdline, start_time FROM processes WHERE name = 'suspicious.exe';

-- Listening ports (non-standard)
SELECT pid, port, address, protocol FROM listening_ports WHERE port NOT IN (80, 443, 22);

-- Scheduled tasks
SELECT name, action, path, enabled FROM scheduled_tasks WHERE enabled = 1;

-- Installed software from unknown publishers
SELECT name, version, publisher FROM programs WHERE publisher LIKE '%unknown%';

-- Active network connections to suspicious port
SELECT pid, remote_address, remote_port, state FROM socket_events WHERE remote_port = 4444;

-- File hash lookup
SELECT path, sha256 FROM hash WHERE path = '/usr/bin/suspicious';

-- Recently modified executables
SELECT path, filename, size, mtime FROM file WHERE path LIKE '/tmp/%' AND filename LIKE '%.exe';

Prompts

| Prompt | Description | |--------|-------------| | investigate-endpoint | Guided endpoint investigation workflow | | threat-hunt | Hunt for IOCs across endpoints via Live Discover | | incident-response | Step-by-step IR: contain, investigate, remediate | | health-audit | Review tenant/endpoint security posture |

Resources

| URI | Description | |-----|-------------| | sophos://live-discover-queries | Built-in Live Discover query library | | sophos://policy-reference | Policy settings reference | | sophos://mitre-mappings | MITRE ATT&CK technique mappings |

Development

npm run build    # Compile TypeScript
npm run dev      # Watch mode
npm run test     # Run tests
npm run lint     # Lint check

License

MIT