Secobserve MCP

secobserve-mcp

*MCP server for SecObserve — Triage, import and administration from an agent*

Tools • Install • Configure • Register with a client • Design

secobserve-mcp exposes the SecObserve REST API to an LLM agent over the Model Context Protocol: browse and triage observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, generate VEX documents. Transport is stdio by default. Listed in the official MCP Registry as io.github.nh4ttruong/secobserve-mcp.

Tools

18 tools, not one per endpoint. SecObserve has ~50 REST resources and ~40 named actions; registering a tool for each would cost more context than the data ever returns, so the API is modelled as data and the tools are the interface to it.

Prompts

Six prompts, for the work that is a sequence of calls rather than one. A prompt is fetched by name when someone picks it, so it costs nothing per session — unlike a tool schema, which is sent on every connection.

Each one carries the caveats that decide whether the report is right: metrics cover the default branch only and answer 200 with every count at zero when the job has not run, no filter expresses a calendar month, and nothing in SecObserve is a due date or an SLA.

Install

uvx secobserve-mcp --help

uvx downloads and runs it without installing anything permanently. In VS Code: one-click install.

To put it on your PATH instead:

uv tool install secobserve-mcp

Once you have done that, uv tool owns the name: a bare uvx secobserve-mcp runs that pinned copy forever and never notices a newer release, so keep it current with uv tool upgrade secobserve-mcp. The client configurations below therefore say uvx secobserve-mcp@latest, which revalidates against PyPI on each launch — once per client session, not once per command. --check deliberately stays on the bare name, because its job is to report on the copy your clients are actually running.

From a checkout, for development:

uv venv && uv pip install -e ".[dev]"

Configure

Create a user API token:

curl -X POST "$SECOBSERVE_BASE_URL/api/authentication/create_user_api_token/" \

-H "Content-Type: application/json" \ -d '{"username": "you", "password": "...", "name": "mcp"}'

Check the wiring before handing it to a client:

uvx secobserve-mcp --check

It prints the instance version, the authenticated user, whether read-only and delete are enabled, and how this install compares to the newest release on PyPI. That last part is the only place this server calls pypi.org, it needs one short-lived request, and it degrades to a single line when the index is unreachable.

Run as a container

docker run --rm -p 8931:8931 \

-e SECOBSERVE_BASE_URL=https://secobserve.example.com \ -e SECOBSERVE_API_TOKEN=... \ ghcr.io/nh4ttruong/secobserve-mcp \ --transport http --host 0.0.0.0 --shared-identity

The image is built for linux/amd64 and linux/arm64, runs as a non-root user, and answers GET /healthz with its version. /healthz is liveness only and never calls SecObserve, so a backend outage does not get this server restarted.

--shared-identity is required and not in the image's default command: the token is baked into the environment, so every caller of the port acts as that one SecObserve identity, and the server refuses to start over HTTP until someone says that is intended. It then refuses every write, because an assessment made under a shared token records the wrong actor in the observation log and in four-eyes approval. Arguments to docker run replace CMD rather than extend it, which is why the transport flags are repeated above.

Keep it behind a gateway that authenticates the caller, and off any public port. For a single user, uvx over stdio is the better fit: one process, one token, writes included.

Register with a client

The server prints its own registration snippet, so none of the blocks below have to be copied by hand:

uvx secobserve-mcp --print-config claude   # or: codex, vscode, json

It reads SECOBSERVE_BASE_URL from the environment and always leaves the token as a placeholder — the snippet is meant to be pasted somewhere, and a token should not travel with it. The hint goes to stderr, so --print-config json > mcp.json writes a clean file.

Claude Code

claude mcp add secobserve --env SECOBSERVE_BASE_URL=http://localhost:8000 --env SECOBSERVE_API_TOKEN=... -- uvx secobserve-mcp@latest

Codex CLI

In ~/.codex/config.toml:

[mcp_servers.secobserve]

command = "uvx" args = ["secobserve-mcp@latest"] env = { SECOBSERVE_BASE_URL = "http://localhost:8000", SECOBSERVE_API_TOKEN = "..." }

Other MCP clients

Most clients take the same JSON shape:

{

"mcpServers": { "secobserve": { "command": "uvx", "args": ["secobserve-mcp@latest"], "env": { "SECOBSERVE_BASE_URL": "http://localhost:8000", "SECOBSERVE_API_TOKEN": "..." } } } }

For a shared deployment, run streamable HTTP with stateless JSON behind a gateway that authenticates the caller:

uvx secobserve-mcp --transport http --host 127.0.0.1 --port 8931 --shared-identity

--shared-identity is what makes this start: the transport has no authentication of its own, so every caller acts as the one identity in SECOBSERVE_API_TOKEN, and the flag accepts that and forces read-only for the process.

Design

Three decisions worth knowing before reading the code:

Responses are projected. SecObserve's serializers return every model column; an Observation has around 100. Each resource carries a default field set, and every list result says what it dropped. Pass fields=["*"] to opt out.

Resource help comes from the instance, not from this repo. secobserve_describe_resource reads /api/oa3/schema/ on the running backend, so filter names and enums cannot drift from the deployed version. The same schema is used to reject unknown filter names before a request is sent: django-filter silently ignores parameters it does not recognise, so filters={"vulnerability_id": "CVE-2021-44228"} would otherwise return the *entire* unfiltered list and the agent would report a confident wrong answer. It now fails with the list of filters that do exist.

Validation lives in the schema wherever a rule exists. An assessment with no comment, a rejection with no remark, a bulk call over 250 ids, or a create with neither product_id nor product_name is refused by the input model before any HTTP request. Everything else is passed through, and the API's 400 body — which names the offending field — is returned verbatim.

Expected failures come back as tool *text*, not as a raised exception: MCP reports a raised exception to the client as a bare Error executing tool , which would throw away exactly the guidance the agent needs to retry correctly.

Audit log

Every tool call writes one JSON line to stderr. SecObserve's own observation log records writes only, so without this a read — which is how data leaves — leaves no trace anywhere.

{"ts":"2026-09-20T19:01:06.474+00:00","tool":"secobserve_list","caller":"apitoken:82fd9d5b1ae9","claimed_username":null,"resource":"observations","outcome":"returned","ms":37.0}

{"ts":"2026-09-20T19:01:06.518+00:00","tool":"secobserve_list","caller":"jwt:09f002a0