Bitdefender GravityZone MCP server

Bitdefender GravityZone MCP Server

MCP server for Bitdefender GravityZone's Control Center API - endpoint/network inventory, security policies, the account-wide malware-hash Blocklist, and scheduled/instant reports - for AI assistants and the WYRE Conduit gateway.

New call shape for this catalog: GravityZone's API is JSON-RPC 2.0, not REST - every other Conduit sidecar (Cork, CyberQP, Slide, UniFi, Cisco Duo) calls a conventional REST API. See Authentication and JSON-RPC shape below.

Authentication

GravityZone authenticates with HTTP Basic Authentication (RFC 2617): the API key is sent as the username, with an empty password - Authorization: Basic base64(apiKey + ":"). This is also a new shape for this catalog - every other static-key connector here (Cork, CyberQP, Slide, UniFi) sends a custom X-Vendor-Api-Key header that the sidecar turns into a Bearer token; GravityZone has no bearer-token concept at all.

API keys are generated in Control Center under My Account -> API keys, and each key is scoped, at generation time, to a checklist of API areas (Network, Policies, Reports, Incidents, Companies, Licensing, Accounts, Packages, Integrations, Push, Quarantine). This connector's key needs the Network, Policies, Reports, and Incidents areas selected - the other seven are never called and do not need to be enabled.

This connector also needs the account's Control Center Access URL (shown on that same My Account page, under Control Center API) - GravityZone Cloud, its EU region, and any self-hosted/on-premise Control Center each have a different API host, so unlike most vendors in this catalog there is no single fixed base URL to hardcode.

In gateway mode, both arrive per-request via the X-Bitdefender-Api-Key and X-Bitdefender-Access-Url headers; in local/stdio mode they're read once from BITDEFENDERAPIKEY and BITDEFENDERACCESSURL.

JSON-RPC shape

GravityZone exposes several separate JSON-RPC 2.0 endpoints, one per product area, at /v1.0/jsonrpc/ (e.g. /v1.0/jsonrpc/network, /v1.0/jsonrpc/policies). Every call to a given area - whatever it does - is an HTTP POST to that same URL with an identical envelope:

{ "id": "<uuid>", "jsonrpc": "2.0", "method": "getEndpointsList", "params": { "parentId": "..." } }

The operation lives entirely inside the body (method + params), never in the URL or HTTP verb - there is no GET/POST/PATCH/DELETE distinction to key a read-only boundary off of, unlike every REST sidecar in this catalog. This connector's read-only scope is therefore enforced by only ever calling documented getXxx/listXxx method names (see Scope below and client.ts's jsonRpcCall()), not by restricting HTTP verbs.

A successful call returns { "id", "jsonrpc", "result": ... }. A failed call can come back two ways, and this connector's client.ts distinguishes both:

• HTTP-layer failure - 401 (bad/missing key), 403 (the key doesn't have this API area enabled - see above), 405 (non-POST), or 429 (rate limit).
• JSON-RPC-layer failure - HTTP 200 with a body error member ({code, message, data.details}, e.g. -32602 Invalid params).

Rate limit: 10 requests/second per API key; GravityZone returns 429 above that.

Configuration

Shortened. The full README is on GitHub.