Sophos Central MCP

Sophos Central MCP Server

For MSP/MSSP teams: Manage endpoint security, email threats, and firewall policy across all your Sophos tenants through natural language. Ask Claude to investigate an alert, isolate a host, run Live Discover queries, and correlate with XDR data — without leaving your AI workflow.

Overview

A Model Context Protocol (MCP) server for the Sophos Central API, enabling AI-powered security operations through Claude and other MCP-compatible clients. Designed for MSP/MSSP environments with Partner Super Admin credentials, it provides multi-tenant management across all customer tenants from a single server instance — covering endpoint protection, threat detection, Live Discover forensics, XDR hunting, email security, firewall management, and more.

Features

• 334 tools across 33 API domains — comprehensive Sophos Central API coverage
• Multi-tenant MSSP support — enumerate and target any customer tenant via Partner Super Admin credentials
• Endpoint isolation and investigation — isolate endpoints, check tamper protection, trigger scans
• Alert triage — list, filter, acknowledge, and action Sophos alerts across tenants
• Live Discover SQL queries — run real-time forensic SQL queries directly on managed endpoints
• XDR Data Lake hunting — historical threat hunting with SQL against the Sophos XDR data lake
• Threat detections — query, group, and count behavioral detections
• Case management — create and manage investigation cases end-to-end
• Email security — quarantine management, mailbox listing, post-delivery message clawback
• Firewall management — CRUD operations, group management, firmware upgrades
• DNS protection — location policies, custom domain allow/block lists
• SOC playbooks — built-in sophos_playbook_* tools for guided IR and threat hunting workflows
• Three transport modes — stdio (Claude Desktop), SSE, and Streamable HTTP (Claude Code)
• Automatic OAuth2 token management — token refresh with no manual intervention
• Regional routing — requests automatically routed to the correct data region (US, EU, CA, AU, JP, BR)

Prerequisites

• Node.js v18 or later (native fetch support required)
• npm v8 or later
• Sophos Central Partner Super Admin API credentials — see Configuration for how to create these

Installation

git clone https://github.com/rijul170/sophos-central-mcp.git

cd sophos-central-mcp npm install npm run build

Configuration

1. Create a .env file

cp .env.example .env

Edit .env with your credentials:

# Required

SOPHOS_CLIENT_ID=your-client-id-here SOPHOS_CLIENT_SECRET=your-client-secret-here

Optional — transport mode: stdio | sse | streamable-http (default: stdio)

MCP_TRANSPORT=stdio

Optional — host for HTTP transports (default: 127.0.0.1)

MCP_HOST=127.0.0.1

Optional — port for HTTP transports (default: 3001)

MCP_PORT=3001

2. Create API Credentials in Sophos Central

1. Log in to Sophos Central Partner Dashboard
2. Navigate to Settings & Policies → API Credentials Management
3. Click Add Credential
4. Set the role to Service Principal Super Admin
5. Copy the Client ID and Client Secret — the secret is displayed only once

Claude Code Integration (HTTP Mode)

HTTP mode is recommended for Claude Code — it supports concurrent sessions and does not require restarting the server between conversations.

Start the server:

MCP_TRANSPORT=streamable-http MCP_PORT=3001 node build/index.js

Or set MCP_TRANSPORT=streamable-http in your .env and run:

node build/index.js

Add to your Claude Code MCP configuration (.claude/settings.json or global settings):

{

"mcpServers": { "sophos-mcp": { "type": "http", "url": "http://localhost:3001/mcp" } } }

A /health endpoint is available at http://localhost:3001/health for liveness checks.

Claude Desktop Integration (stdio Mode)

stdio mode is the standard transport for Claude Desktop. The server process is managed by Claude Desktop directly.

Add to your Claude Desktop MCP configuration (claude_desktop_config.json):

{

"mcpServers": { "sophos-mcp": { "command": "node", "args": ["/path/to/sophos-central-mcp/build/index.js"], "env": { "SOPHOS_CLIENT_ID": "your-client-id", "SOPHOS_CLIENT_SECRET": "your-client-secret" } } } }

Replace /path/to/sophos-central-mcp with the absolute path to your cloned repository.

SSE Mode

SSE (Server-Sent Events) mode is available for legacy MCP clients that do not support Streamable HTTP.

MCP_TRANSPORT=sse MCP_PORT=3001 node build/index.js

The SSE endpoint is available at http://localhost:3001/sse.

Tool Domains

MSSP Multi-Tenant Support

The server is built around Sophos Partner Super Admin credentials, which have visibility across all managed customer tenants.

How it works:

1. On startup, the server authenticates to Sophos Central using your Partner credentials and discovers your organization type (partner or organization).
2. Use sophos_list_tenants (or sophos_list_org_tenants for organization accounts) to enumerate all managed tenants and their IDs.
3. Pass the tenantId parameter to any tenant-scoped tool to target a specific customer environment.
4. All API calls are automatically routed to the correct regional endpoint (US, EU, CA, AU, JP, BR) based on the tenant's data residency.

Example workflow:

1. sophos_list_tenants          → get all tenant IDs and names

1. sophos_list_alerts → pass tenantId for a specific customer
2. sophos_isolate_endpoint → isolate an endpoint in that tenant
3. sophos_live_discover_run_query → run forensic SQL on the isolated host

SOC Playbooks

The server ships with five built-in playbook tools that provide structured, step-by-step guidance for common SOC workflows. These are designed to be invoked at the start of an investigation to orient the response.

SOC Quick Start

Once the server is connected to Claude, you can use natural language to drive security operations. Example prompts:

Alert triage:

"List all critical and high severity open alerts for tenant from the last 24 hours, grouped by type."

Endpoint investigation:

"Isolate endpoint in tenant , then run a Live Discover SQL query to list all running processes and active network connections."

XDR threat hunting:

"Run an XDR Data Lake query against tenant to find any PowerShell executions with encoded commands in the last 7 days."

MSSP overview:

"Enumerate all my managed tenants, then show me any tenants with open critical alerts."

Email security:

"Show me all quarantined messages for tenant in the last 48 hours and release any flagged as false positives."

Development

# Run with hot-reload (no build step required)

npm run dev

Build TypeScript to JavaScript

npm run build

Run the built server

npm start

Inspect tools interactively with MCP Inspector

npx @modelcontextprotocol/inspector node build/index.js

Project Structure

src/

├── index.ts # Entry point — transport setup, registers all