CyberQP MCP server

CyberQP MCP Server

MCP server for CyberQP's (formerly QuickPass Cybersecurity) privileged access management (PAM) API - customer/account metadata, the tenant event log, and JIT (Just-In-Time) account status/policy visibility, for AI assistants and the WYRE Conduit gateway.

Authentication

CyberQP authenticates with OAuth2 authorizationcode flow (offlineaccess scope, refreshtoken-backed) - not clientcredentials. This connector never performs the OAuth dance itself: the WYRE Conduit gateway owns the authorize/exchange/refresh legs, and this server only ever receives a live bearer access token, sent as Authorization: Bearer to CyberQP's API. In gateway mode the token arrives per-request via the X-CyberQP-Access-Token header; in local/stdio mode it's read once from CYBERQPACCESSTOKEN.

Configuration

Tools

Customers

• cyberqplistcustomers - list customers visible to the authenticated technician, filterable by directory type and name.
• cyberqpgetcustomer_accounts - list account metadata (id, username, type, status) for a customer.
• cyberqpgetcustomeraccountscount - get per-account-type counts for a customer.

Events

• cyberqpgetevents - get the tenant's event log, filterable by customer, account, event type, status, and date range.
• cyberqpgetevent_types - get the full set of event-type values.

Tenant

• cyberqpgettenantcompanydata - get the authenticated tenant's own company profile.

JIT (Just-In-Time) - status and policy only

• cyberqpgetjit_policies - get the configured JIT policy (approval requirements, max duration) for a customer + account type.
• cyberqpgetcustomerjitstatus - get JIT account status for a specific customer.
• cyberqpcheckjitaccountexists - check whether a JIT account exists for a customer + directory type.
• cyberqpgettenantjitstatus - get JIT account status across the entire tenant.

Scope

This is a deliberately narrow, read-only, non-credential-exposing v1 surface. CyberQP is a PAM product - several of its real endpoints return live plaintext passwords and OTP codes, or mutate/provision privileged access. None of those are implemented here, by design, not by oversight:

Hard-excluded (credential-exposing) - never implemented:

• GET /api/v1/account/{accountId}/password (AccountControllergetAccountPasswordv1)
• GET /api/v1/jit/customer/{customerId}/account/{accountId}/password (JitControllergetJitAccountPasswordv1)
• GET /api/v1/jit/customer/{customerId}/account/{accountId}/otp (JitControllergetJitAccountOTPv1)
• POST /api/v1/jit/customer/{customerId}/account/{accountId}/otp (JitControllersaveJitAccountOtpSecretv1)
• DELETE /api/v1/jit/customer/{customerId}/account/{accountId}/otp (JitControllerdeleteJitAccountOtpSecretv1)

Hard-excluded (provisioning/mutation) - never implemented:

• PATCH /api/v1/jit/customer/{customerId}/account/{accountId}/enable (JitControllerenableJitAccountv1)
• PATCH /api/v1/jit/customer/{customerId}/account/{accountId}/disable (JitControllerdisableJitAccountv1)
• DELETE /api/v1/jit/customer/{customerId}/account/{accountId} (JitControllerdeleteJitAccountv1)
• POST /api/v1/jit/customer/{customerId}/account (JitControllercreateJitAccountv1)

Shortened. The full README is on GitHub.