Sophos Central MCP server

Sophos Central MCP Server

For MSP/MSSP teams: Manage endpoint security, email threats, and firewall policy across all your Sophos tenants through natural language. Ask Claude to investigate an alert, isolate a host, run Live Discover queries, and correlate with XDR data — without leaving your AI workflow.

Overview

A Model Context Protocol (MCP) server for the Sophos Central API, enabling AI-powered security operations through Claude and other MCP-compatible clients. Designed for MSP/MSSP environments with Partner Super Admin credentials, it provides multi-tenant management across all customer tenants from a single server instance — covering endpoint protection, threat detection, Live Discover forensics, XDR hunting, email security, firewall management, and more.

Features

• 334 tools across 33 API domains — comprehensive Sophos Central API coverage
• Multi-tenant MSSP support — enumerate and target any customer tenant via Partner Super Admin credentials
• Endpoint isolation and investigation — isolate endpoints, check tamper protection, trigger scans
• Alert triage — list, filter, acknowledge, and action Sophos alerts across tenants
• Live Discover SQL queries — run real-time forensic SQL queries directly on managed endpoints
• XDR Data Lake hunting — historical threat hunting with SQL against the Sophos XDR data lake
• Threat detections — query, group, and count behavioral detections
• Case management — create and manage investigation cases end-to-end
• Email security — quarantine management, mailbox listing, post-delivery message clawback
• Firewall management — CRUD operations, group management, firmware upgrades
• DNS protection — location policies, custom domain allow/block lists
• SOC playbooks — built-in sophosplaybook tools for guided IR and threat hunting workflows

Prerequisites

• Node.js v18 or later (native fetch support required)
• npm v8 or later
• Sophos Central Partner Super Admin API credentials — see Configuration for how to create these

Installation

git clone https://github.com/rijul170/sophos-central-mcp.git
cd sophos-central-mcp
npm install
npm run build

Configuration

1. Create a .env file

cp .env.example .env

Edit .env with your credentials:

# Required
SOPHOS_CLIENT_ID=your-client-id-here
SOPHOS_CLIENT_SECRET=your-client-secret-here

# Optional — transport mode: stdio | sse | streamable-http (default: stdio)
MCP_TRANSPORT=stdio

# Optional — host for HTTP transports (default: 127.0.0.1)
MCP_HOST=127.0.0.1

# Optional — port for HTTP transports (default: 3001)
MCP_PORT=3001

2. Create API Credentials in Sophos Central

Shortened. The full README is on GitHub.