ESET PROTECT MCP server

ESET PROTECT MCP Server

MCP server for ESET PROTECT's ESET Connect API gateway - endpoint fleet visibility (devices and groups), detection/EDR investigation, vulnerability data, patch status, and user management - for AI assistants and the WYRE Conduit gateway.

Authentication

Create a dedicated API user in ESET Business Account: User Management > create a user with read-only permission > enable the Integrations toggle. This gives you an email/password pair for that user.

ESET Connect's token endpoint (POST /oauth/token) is documented in its own OpenAPI spec as a password grant - username/password fields, not clientid/clientsecret with granttype=clientcredentials. This server accepts clientId/clientSecret (matching the credential shape used across WYRE's other MCP connectors) and sends them as username/password in that grant. It handles the resulting bearer token's caching and refresh (via the returned refresh_token, falling back to a full re-login if the refresh token itself is rejected) internally - callers only ever supply the long-lived email/password pair.

Configuration

Each ESET Connect API domain (device, incident, vulnerability, patch, and user management) is hosted on its own per-region subdomain, e.g. https://us.device-management.eset.systems; the auth host follows the same regional pattern, e.g. https://us.business-account.iam.eset.systems. ESETPROTECT_REGION selects the prefix for all of them.

Tools

Device Management

• esetprotectlistdevice_groups - list device groups.
• esetprotectlistgroup_devices - list the devices in a group.
• esetprotectlistdevices - list managed devices, filterable by display name, functionality status, or mute state.
• esetprotectgetdevice - get a device by UUID.
• esetprotectbatchget_devices - get multiple devices by UUID in one call.

Incident Management (detections, detection groups, EDR)

• esetprotectlistdetections / esetprotectgetdetection - v1 detections (legacy surface).
• esetprotectlistdetectionsv2 / esetprotectgetdetectionv2 / esetprotectbatchget_detections - v2 detections (endpoint, cloud office, and EDR).
• esetprotectlistdetectiongroups / esetprotectgetdetectiongroup - detections clustered into groups.
• esetprotectlistedrrules / esetprotectgetedrrule - EDR detection rules.
• esetprotectlistedrruleexclusions / esetprotectgetedrruleexclusion - EDR rule exclusions.

Vulnerability Management

• esetprotectlistdeviceosvulnerabilities - OS vulnerabilities found on devices.
• esetprotectlistdevice_vulnerabilities - vulnerabilities found on devices (application/OS/package scope).
• esetprotectlistrecent_scans - recent vulnerability scan details.
• esetprotectlistvulnerable_devices - devices with known vulnerabilities.

Shortened. The full README is on GitHub.