Sophos Central MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to Sophos Central, a unified cloud security management platform. Manage endpoints, investigate alerts, analyze EDR/XDR detections, run Live Discover queries, and audit security policies.

Features

Endpoints

• List, search, and inspect endpoints by hostname, IP, OS, health status
• Network isolation and un-isolation for incident response
• On-demand scan triggering
• Software inventory retrieval

Alerts

• List and filter alerts by severity, category, product, date range
• Acknowledge and resolve alerts with actions taken
• View available response actions per alert

EDR/XDR Detections

• List detections with MITRE ATT&CK technique mappings
• Threat case management (grouped related detections)
• Detection-to-case correlation

Security Events

• Search events by type, severity, endpoint, date range
• Event type catalog (malware, PUA, web filter, etc.)
• Admin audit log access

Policies

• List endpoint, server, and firewall policies
• Inspect individual policy configurations
• Review global and policy-specific exclusions

Tenant Management

• Multi-tenant listing (MSP/partner view)
• Tenant details and license information
• Overall tenant security health scoring

Live Discover (osquery)

• Execute Live Discover queries on endpoints
• Saved query library management
• Query result retrieval
• Query category browsing

Architecture

┌────────────────────────────────────────┐
│           MCP Client (LLM)             │
└──────────────┬─────────────────────────┘
               │ MCP Protocol (stdio)
┌──────────────▼─────────────────────────┐
│          sophos-mcp server             │
│                                        │
│  ┌──────────┐  ┌────────────────────┐  │
│  │ Prompts  │  │    Resources       │  │
│  │ 4 guides │  │ queries, policies, │  │
│  │          │  │ MITRE mappings     │  │
│  └──────────┘  └────────────────────┘  │
│                                        │
│  ┌──────────────────────────────────┐  │
│  │            Tools                  │  │
│  │  endpoints │ alerts │ detections  │  │
│  │  events │ policies │ tenants     │  │
│  │  live-discover                    │  │
│  └──────────────┬───────────────────┘  │
│                 │                       │
│  ┌──────────────▼───────────────────┐  │
│  │      Sophos Central API Client   │  │
│  │      (OAuth2 + REST)             │  │
│  └──────────────┬───────────────────┘  │
└──────────────────┼─────────────────────┘
                   │ HTTPS
┌──────────────────▼─────────────────────┐
│       Sophos Central Platform API      │
│  https://api.central.sophos.com        │
└────────────────────────────────────────┘

Installation

git clone https://github.com/solomonneas/sophos-mcp.git
cd sophos-mcp
npm install
npm run build

Configuration

Sophos Central uses OAuth2 with client credentials. Set environment variables:

export SOPHOS_CLIENT_ID="your-client-id"
export SOPHOS_CLIENT_SECRET="your-client-secret"
export SOPHOS_TENANT_ID="your-tenant-id"   # optional for single-tenant

Or use a .env file:

SOPHOS_CLIENT_ID=your-client-id
SOPHOS_CLIENT_SECRET=your-client-secret
SOPHOS_TENANT_ID=your-tenant-id

Getting API Credentials

1. Log in to Sophos Central
2. Go to Global Settings > API Credentials Management
3. Click Add Credential and assign a role
4. Copy the Client ID and Client Secret

MCP Client Configuration

Claude Desktop

{
  "mcpServers": {
    "sophos": {
      "command": "node",
      "args": ["path/to/sophos-mcp/dist/index.js"],
      "env": {
        "SOPHOS_CLIENT_ID": "your-client-id",
        "SOPHOS_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

OpenClaw

Add to your openclaw.json:

{
  "mcp": {
    "servers": {
      "sophos": {
        "type": "stdio",
        "command": "node",
        "args": ["/path/to/sophos-mcp/dist/index.js"],
        "env": {
          "SOPHOS_CLIENT_ID": "your-client-id",
          "SOPHOS_CLIENT_SECRET": "your-client-secret"
        }
      }
    }
  }
}

Tool Reference

Live Discover Query Examples

-- Running processes
SELECT pid, name, path, cmdline, start_time FROM processes WHERE name = 'suspicious.exe';

-- Listening ports (non-standard)
SELECT pid, port, address, protocol FROM listening_ports WHERE port NOT IN (80, 443, 22);

-- Scheduled tasks
SELECT name, action, path, enabled FROM scheduled_tasks WHERE enabled = 1;

-- Installed software from unknown publishers
SELECT name, version, publisher FROM programs WHERE publisher LIKE '%unknown%';

-- Active network connections to suspicious port
SELECT pid, remote_address, remote_port, state FROM socket_events WHERE remote_port = 4444;

-- File hash lookup
SELECT path, sha256 FROM hash WHERE path = '/usr/bin/suspicious';

-- Recently modified executables
SELECT path, filename, size, mtime FROM file WHERE path LIKE '/tmp/%' AND filename LIKE '%.exe';

Prompts

Resources

Development

npm run build    # Compile TypeScript
npm run dev      # Watch mode
npm run test     # Run tests
npm run lint     # Lint check

License

MIT