Rubrik Security Cloud MCP server

Rubrik MCP

An MCP server that connects AI assistants to the Rubrik Security Cloud GraphQL API. It's built for Rubrik admins and teams automating against Rubrik, and runs locally (on your own workstation or on an agent's server) alongside the AI assistant that calls it.

<!-- Ownership marker for the MCP Registry. It verifies that this PyPI package belongs to the server named in server.json by looking for this string in the published package description. Must match server.json's name exactly, and must not be followed by punctuation. --> <!-- mcp-name: io.github.rubrikinc/rubrik-mcp -->

What you can do

Discovery

The MCP ships with a pre-built index of the entire RSC GraphQL API. The discovery tools let the AI agent explore that index — searching operations, inspecting full argument signatures, tracing input and return types — to find exactly the right operation and field shape for any request. This produces precise, well-formed GraphQL on the first try.

Discovery tools require no RSC credentials and work entirely offline. This makes them useful on their own: if you're evaluating the API, prototyping an integration, or building automation before you have production credentials, you can start immediately.

> "What operations are available for SLA management?"
> "Show me the full argument shape for the assignSla mutation."
> "Generate Python code to assign an SLA domain to a list of workload IDs."

Because the agent understands both queries and mutations from the schema index, it can generate runnable Python code for any write operation — without ever connecting to RSC.

Execution

With an RSC service account, the agent can run live GraphQL queries against your environment:

• List workloads with protection status, compliance state, and backup history
• Retrieve recent events and failures
• Trigger on-demand snapshots and poll until they complete
• Register hosts and assign SLA domains

Raw GraphQL execution is read-only. If you ask for a write operation not covered by a built-in tool, the server returns the attempted mutation and the agent generates a runnable code sample. A small number of write operations are available as dedicated built-in tools: on-demand snapshots (rsctakeondemandsnapshot), host onboarding (rsconboardhost), and SLA assignment (rscassignsla). These are disabled by default — set "writes_enabled": true in the gating policy to expose them. For everything else, the generated code approach gives you a runnable script with full control.

[!WARNING]

Write tools act on your Rubrik environment, and the LLM driving the MCP decides when to call them. Any model can misread instructions or be influenced by untrusted data it reads (prompt injection) and invoke a write tool you did not intend — for example an SLA change via rscassignsla that leaves data unprotected. As more write tools are added, this surface grows. They are disabled by default for that reason; enabling them is an explicit choice. The durable boundary is a least-privilege, read-only service account, which cannot perform any write operation regardless of which model you use or how the agent behaves. See Service account role recommendations, and enable Quorum Authorization for destructive operations.

Built-in tools

Discovery — no credentials required

Execution — service account required

Shortened. The full README is on GitHub.