Blackpoint Cyber MCP server

blackpoint-mcp

Model Context Protocol (MCP) server for Blackpoint Cyber CompassOne - Managed Detection and Response (MDR) platform.

Features

This MCP server provides access to CompassOne's security capabilities through a decision-tree navigation interface:

Available Domains

• 🏢 Tenants: Customer tenant management
• 💻 Assets: Endpoint and server inventory (endpoint, server, network, cloud, mobile, iot)
• 🔍 Detections: Security detections and telemetry
• 🛡️ Vulnerabilities: Vulnerability management, dark web monitoring, external exposure scanning

Domain Structure

All implemented tools are listed together in a single tools/list call — no navigation step required. blackpointstatus reports current health and available domains, and blackpointnavigate/blackpointback remain for clients that like a guided menu, but they're optional: every domain tool (blackpointtenants, blackpointassets, blackpointdetections, blackpointvulnerabilities_*) is callable directly from the start.

(Earlier versions gated domain tools behind a blackpointnavigate call. That doesn't work behind the Conduit gateway — Conduit suppresses navigate/_back from every vendor's tool list for security reasons, which made every domain tool unreachable through it. The list is flat now so it works the same everywhere.)

Tool Naming Convention

All tools follow the pattern: blackpoint{domain}{action}

Examples:

• blackpointassetslist - List assets by class
• blackpointdetectionslist - List security detections
• blackpointvulnerabilitiesscans_list - List vulnerability scans

Installation

npm install blackpoint-mcp

Configuration

Environment Variables

Gateway Mode

When AUTH_MODE=gateway, the server reads credentials from HTTP headers:

• X-Blackpoint-API-Token → BLACKPOINTAPITOKEN

This enables per-request authentication for multi-tenant gateways.

Usage

Standalone Mode (stdio)

# Set credentials
export BLACKPOINT_API_TOKEN="your-api-token"

# Run the server
blackpoint-mcp

Gateway Mode (HTTP)

export AUTH_MODE=gateway
export MCP_TRANSPORT=http
export MCP_HTTP_PORT=8080

blackpoint-mcp

Example Tool Calls

// Start by checking available domains
await tools.call("blackpoint_status");

// Navigate to assets domain
await tools.call("blackpoint_navigate", { domain: "assets" });

// List endpoint assets
await tools.call("blackpoint_assets_list", { 
  class: "endpoint",
  pageSize: 10 
});

// Get specific asset details
await tools.call("blackpoint_assets_get", { 
  id: "asset_12345" 
});

// Return to navigation
await tools.call("blackpoint_back");

API Coverage

✅ Implemented

📋 Planned

Shortened. The full README is on GitHub.