Sophos Central MCP Server

For MSP/MSSP teams: Manage endpoint security, email threats, and firewall policy across all your Sophos tenants through natural language. Ask Claude to investigate an alert, isolate a host, run Live Discover queries, and correlate with XDR data — without leaving your AI workflow.

Overview

A Model Context Protocol (MCP) server for the Sophos Central API, enabling AI-powered security operations through Claude and other MCP-compatible clients. Designed for MSP/MSSP environments with Partner Super Admin credentials, it provides multi-tenant management across all customer tenants from a single server instance — covering endpoint protection, threat detection, Live Discover forensics, XDR hunting, email security, firewall management, and more.

Features

• 334 tools across 33 API domains — comprehensive Sophos Central API coverage
• Multi-tenant MSSP support — enumerate and target any customer tenant via Partner Super Admin credentials
• Endpoint isolation and investigation — isolate endpoints, check tamper protection, trigger scans
• Alert triage — list, filter, acknowledge, and action Sophos alerts across tenants
• Live Discover SQL queries — run real-time forensic SQL queries directly on managed endpoints
• XDR Data Lake hunting — historical threat hunting with SQL against the Sophos XDR data lake
• Threat detections — query, group, and count behavioral detections
• Case management — create and manage investigation cases end-to-end
• Email security — quarantine management, mailbox listing, post-delivery message clawback
• Firewall management — CRUD operations, group management, firmware upgrades
• DNS protection — location policies, custom domain allow/block lists
• SOC playbooks — built-in sophos_playbook_* tools for guided IR and threat hunting workflows
• Three transport modes — stdio (Claude Desktop), SSE, and Streamable HTTP (Claude Code)
• Automatic OAuth2 token management — token refresh with no manual intervention
• Regional routing — requests automatically routed to the correct data region (US, EU, CA, AU, JP, BR)

Prerequisites

• Node.js v18 or later (native fetch support required)
• npm v8 or later
• Sophos Central Partner Super Admin API credentials — see Configuration for how to create these

Installation

git clone https://github.com/rijul170/sophos-central-mcp.git
cd sophos-central-mcp
npm install
npm run build

Configuration

1. Create a .env file

cp .env.example .env

Edit .env with your credentials:

# Required
SOPHOS_CLIENT_ID=your-client-id-here
SOPHOS_CLIENT_SECRET=your-client-secret-here

# Optional — transport mode: stdio | sse | streamable-http (default: stdio)
MCP_TRANSPORT=stdio

# Optional — host for HTTP transports (default: 127.0.0.1)
MCP_HOST=127.0.0.1

# Optional — port for HTTP transports (default: 3001)
MCP_PORT=3001

2. Create API Credentials in Sophos Central

1. Log in to Sophos Central Partner Dashboard
2. Navigate to Settings & Policies → API Credentials Management
3. Click Add Credential
4. Set the role to Service Principal Super Admin
5. Copy the Client ID and Client Secret — the secret is displayed only once

Claude Code Integration (HTTP Mode)

HTTP mode is recommended for Claude Code — it supports concurrent sessions and does not require restarting the server between conversations.

Start the server:

MCP_TRANSPORT=streamable-http MCP_PORT=3001 node build/index.js

Or set MCP_TRANSPORT=streamable-http in your .env and run:

node build/index.js

Add to your Claude Code MCP configuration (.claude/settings.json or global settings):

{
  "mcpServers": {
    "sophos-mcp": {
      "type": "http",
      "url": "http://localhost:3001/mcp"
    }
  }
}

A /health endpoint is available at http://localhost:3001/health for liveness checks.

Claude Desktop Integration (stdio Mode)

stdio mode is the standard transport for Claude Desktop. The server process is managed by Claude Desktop directly.

Add to your Claude Desktop MCP configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "sophos-mcp": {
      "command": "node",
      "args": ["/path/to/sophos-central-mcp/build/index.js"],
      "env": {
        "SOPHOS_CLIENT_ID": "your-client-id",
        "SOPHOS_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Replace /path/to/sophos-central-mcp with the absolute path to your cloned repository.

SSE Mode

SSE (Server-Sent Events) mode is available for legacy MCP clients that do not support Streamable HTTP.

MCP_TRANSPORT=sse MCP_PORT=3001 node build/index.js

The SSE endpoint is available at http://localhost:3001/sse.

Tool Domains

MSSP Multi-Tenant Support

The server is built around Sophos Partner Super Admin credentials, which have visibility across all managed customer tenants.

How it works:

1. On startup, the server authenticates to Sophos Central using your Partner credentials and discovers your organization type (partner or organization).
2. Use sophos_list_tenants (or sophos_list_org_tenants for organization accounts) to enumerate all managed tenants and their IDs.
3. Pass the tenantId parameter to any tenant-scoped tool to target a specific customer environment.
4. All API calls are automatically routed to the correct regional endpoint (US, EU, CA, AU, JP, BR) based on the tenant's data residency.

Example workflow:

1. sophos_list_tenants          → get all tenant IDs and names
2. sophos_list_alerts           → pass tenantId for a specific customer
3. sophos_isolate_endpoint      → isolate an endpoint in that tenant
4. sophos_live_discover_run_query → run forensic SQL on the isolated host