watchTowr Platform MCP Server

A Model Context Protocol (MCP) server that connects AI assistants to the watchTowr Platform, providing real-time access to your external attack surface data, findings, hunts, and threat intelligence.

Features

• 88 tools covering the full watchTowr Platform API — assets, findings, hunts, certificates, suspicious domains, and more
• Read and write — query your attack surface and take action (update statuses, trigger retests, submit seed assets)
• Composite intelligence — built-in tools for attack surface summaries, change detection, executive scorecards, and compliance reporting
• Secure — authenticates via API key with tenant isolation; credentials never leave your environment

Prerequisites

• watchTowr Platform account with API access enabled
• API Key — obtained from your watchTowr Platform dashboard under Settings → API Management
• Platform Host — your watchTowr instance URL (e.g. https://your-tenant.your-region.watchtowr.io)
• Python 3.10+ and uv (for local installation), or Docker

Quick Start

Local Installation

git clone https://github.com/watchtowr/watchtowr-mcp.git
cd watchtowr-mcp

# Clone the API SDK
git clone https://github.com/watchtowr/watchtowr-api-sdk.git

# Install dependencies
uv venv
uv pip install -e .
uv pip install -e watchtowr-api-sdk

# Run the server
WATCHTOWR_API_KEY="your-api-key" \
WATCHTOWR_PLATFORM_HOST="https://your-tenant.your-region.watchtowr.io" \
uv run watchtowr-mcp

Docker

Build the image:

git clone https://github.com/watchtowr/watchtowr-mcp.git
cd watchtowr-mcp
docker build -t watchtowr-mcp .

stdio — for MCP clients

docker run -it --rm \
  -e WATCHTOWR_API_KEY="your-api-key" \
  -e WATCHTOWR_PLATFORM_HOST="https://your-tenant.your-region.watchtowr.io" \
  watchtowr-mcp

HTTP — standalone service

docker run -d --rm \
  -e WATCHTOWR_API_KEY="your-api-key" \
  -e WATCHTOWR_PLATFORM_HOST="https://your-tenant.your-region.watchtowr.io" \
  -e MCP_TRANSPORT=streamable-http \
  -p 8080:8080 \
  watchtowr-mcp

MCP Client Configuration

Claude Desktop / Cursor (local)

{
  "mcpServers": {
    "watchtowr": {
      "command": "uv",
      "args": [
        "--directory", "/path/to/watchtowr-mcp",
        "run", "watchtowr-mcp"
      ],
      "env": {
        "WATCHTOWR_API_KEY": "your-api-key",
        "WATCHTOWR_PLATFORM_HOST": "https://your-tenant.your-region.watchtowr.io"
      }
    }
  }
}

Claude Desktop / Cursor (Docker)

Build the watchtowr-mcp image first — see the Docker section above.

{
  "mcpServers": {
    "watchtowr": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "--env", "WATCHTOWR_API_KEY=your-api-key",
        "--env", "WATCHTOWR_PLATFORM_HOST=https://your-tenant.your-region.watchtowr.io",
        "watchtowr-mcp"
      ]
    }
  }
}

Configuration

Available Tools

Findings (10 tools)

Assets (24 tools)

Hunts (6 tools)

Threat Intelligence (6 tools)

Services (2 tools)

Organisation (5 tools)

Composite & Triage (13 tools)

Reporting & Compliance (11 tools)

Incident Response (5 tools)

Workflow & Automation (6 tools)

Example Prompts

"Give me an attack surface summary"
"Show all critical findings"
"What new assets were discovered this week?"
"List certificates expiring in the next 30 days"
"Show me suspicious domains flagged for typosquatting"
"Get the details for finding 1234 and trigger a retest"
"List all findings for business unit 5"
"What hunts have been completed recently?"
"Give me the executive risk scorecard"
"Show me stale findings older than 30 days"
"What critical findings are unassigned?"
"Run a daily digest"
"Bulk retest findings 101,102,103"
"Show me all assets in country CN"
"What services are running Apache?"
"Give me the CISA-KEV remediation status"
"Compare week-over-week changes for the last 4 weeks"

Development

Project Structure

watchtowr-mcp/
├── watchtowr_mcp_server/
│   ├── __init__.py
│   ├── mcp.py                 # Entry point
│   ├── client.py              # API client and shared helpers
│   └── tools/
│       ├── __init__.py        # Tool registration
│       ├── findings.py        # Finding tools
│       ├── assets.py          # Asset tools
│       ├── hunts.py           # Hunt tools
│       ├── threat_intel.py    # Suspicious domains, POI, certificates
│       ├── services.py        # Service listing tools
│       ├── organization.py    # Business units, activity logs, source IPs
│       ├── composite.py       # Cross-cutting intelligence, triage, and posture tools
│       ├── reporting.py       # Compliance, audit, executive reporting tools
│       ├── incident.py        # Incident response and threat hunting tools
│       └── workflow.py        # Bulk operations, queues, and automation tools
├── pyproject.toml
├── Dockerfile
└── README.md

Support

• API Reference: watchTowr Platform API Documentation
• Technical Support: Contact the watchTowr support team

Requires a valid watchTowr Platform subscription. For more information, visit watchtowr.com.