eset_search
Case-insensitive substring search across devices, users, policies and groups. Returns matching items with their UUIDs and which field matched.
LABSCO SUMMARY
Read-only mode hides the write tools rather than refusing them later.
Two independent layers do the work: the catalogue filter means an agent never sees a mutating tool, and a separate gate checks the tool's declared mode before any request leaves the process, so a hard-coded client or a stale tool snapshot fails locally instead of at ESET. On-prem coverage is honest about its edges — incident, mobile, web-access, network-access, quarantine and most vulnerability tools belong to products that are not part of an on-prem PROTECT install, and calling them there returns a plain 404.
What it is
A single hub in front of any number of ESET deployments. One process can serve cloud regions and customer-hosted consoles at the same time, with clients selecting the target per request through headers; the server mints its own tokens and keeps tenants isolated in a pooled client cache.
What you get
- 102 tools generated from 16 official ESET Connect OpenAPI specs, spanning application, asset, device, identity, incident, installer, mobile-device, network-access, patch, policy, quarantine, user, vulnerability and web-access management plus automation
- Four composite tools that fold several raw calls into one: a case-insensitive search across devices, users, policies and groups; a device record with its recent detections, vulnerabilities and scans; an incident with comments, related detections and affected devices; and the newest detections in a time window —
eset_search,device_full_profile,incident_full_context,latest_detections - A read-only catalogue when you want one:
ESET_MODE=ROadvertises only the 51 read tools and hides the rest from the tool list entirely, with a second in-memory gate rejecting write tool names before any HTTP request goes out - Response shaping that protects the context window: an optional
fieldslist on every GET tool, and a byte cap that trims the longest list while preserving top-level fields and attaching a hint on how to continue - Resources reporting the current mode, region, deployment and full tool catalogue, and prompts for offboarding candidates, a per-device CVE report and incident triage
Requirements
A dedicated ESET API user rather than your console login, created in ESET PROTECT Hub or ESET Business Account. In single-tenant mode set ESET_USER and ESET_PASSWORD in .env with ESET_REGION from eu, de, us, ca or jpn. In multi-tenant mode set ESET_AUTH_MODE=basic and clients pass Authorization: Basic per request, optionally with X-ESET-Region or X-ESET-Server-URL to reach an on-prem console; basic mode requires HTTP transport and, because it puts a password on the wire, TLS in front of it. The fastest path is the published image: docker run --rm -i --env-file .env ghcr.io/maciekaz/eset-mcp:1, multi-arch and cosign-signed. Version 1.0.3.
Setup effort
Follow the published steps — cp .env.example .env
USE CASES
01
Getting the whole picture on one device
Pull the device record together with its recent detections, vulnerabilities and scans in a single call instead of four.
02
Triaging an incident quickly
Read the incident with its comments, related detections and affected devices, then look at the newest detections in the window around it.
03
Letting an analyst ask questions without granting write access
Run in read-only mode so the mutating tools are not advertised at all, independently of what the ESET account itself is permitted to do.
04
Serving several tenants from one deployment
Use basic-auth mode with per-request credentials and headers, so cloud and on-prem consoles are reachable from the same process with tokens isolated per tenant.
05
Keeping a large list response from flooding the context
Name the fields you actually want on a GET call, and rely on the byte cap plus its continuation hint when a payload is still too large.
106 tools
Listed in project code.
device_full_profile
One call → device record + recent detections + vulnerabilities + recent scans.
incident_full_context
One call → incident + comments + related detections + affected devices. Detections and devices are capped at 10 each.
latest_detections
Newest detections in a time window, sorted by occurTime descending.
app_executables__list_executables
List executables (GET /v1/executables)
app_executables__get_executable
Get executable (GET /v1/executables/{executableUuid})
app_executables__block_executable
Block executable (POST /v1/executables/{executableUuid}:block)
app_executables__unblock_executable
Unblock executable (POST /v1/executables/{executableUuid}:unblock)
asset_groups__create_group
Create group (POST /v1/groups)
asset_groups__delete_group
Delete group (DELETE /v1/groups/{groupUuid})
asset_groups__move_group
Move group (POST /v1/groups/{groupUuid}:move)
asset_groups__rename_group
Rename group (POST /v1/groups/{groupUuid}:rename)
task_device_tasks__list_tasks
List tasks (GET /v1/device_tasks)
task_device_tasks__create_task
Create task (POST /v1/device_tasks)
task_device_tasks__get_task
Get task (GET /v1/device_tasks/{taskUuid})
task_device_tasks__delete_task
Delete task (DELETE /v1/device_tasks/{taskUuid})
task_device_tasks__list_task_runs
List task runs (GET /v1/device_tasks/{taskUuid}/runs)
task_device_tasks__update_task_targets
Update task targets (POST /v1/device_tasks/{taskUuid}:updateTaskTargets)
task_device_tasks__update_task_triggers
Update task triggers (POST /v1/device_tasks/{taskUuid}:updateTaskTriggers)
auth_o_auth__token
(POST /oauth/token)
device_device_groups__list_groups
List all device groups (GET /v1/device_groups)
device_device_groups__list_member_devices
List devices in device group (GET /v1/device_groups/{groupUuid}/devices)
device_devices__list_devices
List managed devices (GET /v1/devices)
device_devices__get_device
Get device details (GET /v1/devices/{deviceUuid})
device_devices__move_device
Move device (POST /v1/devices/{deviceUuid}:move)
device_devices__rename_device
Rename device (POST /v1/devices/{deviceUuid}:rename)
device_devices__batch_get_devices
Get batch of devices (GET /v1/devices:batchGet)
device_devices__import_device_batch
Import device batch (POST /v1/devices:batchImport)
iam_permissions__list_permissions
List permissions (GET /v2/permissions)
iam_identity_provider__list_roles
List roles (GET /v2/role-assignments)
iam_identity_provider__assign_role
Assign role (POST /v2/role-assignments:assignRole)
iam_identity_provider__revoke_role
Remove assigned role (POST /v2/role-assignments:revokeRole)
iam_roles__create_role
Create role (POST /v2/roles)
iam_roles__delete_role
Delete role (DELETE /v2/roles/{roleName})
incident_detections__list_detections_v1
List detections (GET /v1/detections)
incident_detections__get_detection_v1
Get detection (GET /v1/detections/{detectionUuid})
incident_detection_groups__list_detection_groups
List detection groups (GET /v2/detection-groups)
incident_detection_groups__get_detection_group
Get detection group (GET /v2/detection-groups/{detectionGroupUuid})
incident_detection_groups__resolve_detection_group
Resolve detection group (POST /v2/detection-groups/{detectionGroupUuid}:resolve)
incident_detection_groups__search_detection_groups
Search detection groups (POST /v2/detection-groups:search)
incident_detections__list_detections_v2
List detections (GET /v2/detections)
incident_detections__get_detection_v2
Get detection (GET /v2/detections/{detectionUuid})
incident_detections__resolve_detection
Resolve detection (POST /v2/detections/{detectionUuid}:resolve)
incident_detections__batch_get_detections
Batch get detections (POST /v2/detections:batchGet)
incident_edr_rule_exclusions__list_edr_rule_exclusions
List EDR rule exclusions (GET /v2/edr-rule-exclusions)
incident_edr_rule_exclusions__create_edr_rule_exclusion
Create EDR rule exclusion (POST /v2/edr-rule-exclusions)
incident_edr_rule_exclusions__get_edr_rule_exclusion
Get EDR rule exclusion (GET /v2/edr-rule-exclusions/{exclusionUuid})
incident_edr_rule_exclusions__delete_edr_rule_exclusion
Delete EDR rule exclusion (DELETE /v2/edr-rule-exclusions/{exclusionUuid})
incident_edr_rule_exclusions__update_edr_rule_exclusion_definition
Update EDR rule exclusion definition (POST /v2/edr-rule-exclusions/{exclusionUuid}:updateDefinition)
incident_edr_rules__list_edr_rules
List EDR rules (GET /v2/edr-rules)
incident_edr_rules__create_edr_rule
Create EDR rule (POST /v2/edr-rules)
incident_edr_rules__get_edr_rule
Get EDR rule (GET /v2/edr-rules/{ruleUuid})
incident_edr_rules__delete_edr_rule
Delete EDR rule (DELETE /v2/edr-rules/{ruleUuid})
incident_edr_rules__disable_edr_rule
Disable EDR rule (POST /v2/edr-rules/{ruleUuid}:disable)
incident_edr_rules__enable_edr_rule
Enable EDR rule (POST /v2/edr-rules/{ruleUuid}:enable)
incident_edr_rules__update_edr_rule_definition
Update EDR rule definition (POST /v2/edr-rules/{ruleUuid}:updateDefinition)
incident_incidents__list_incidents
List incidents (GET /v2/incidents)
incident_incidents__get_incident
Get incident (GET /v2/incidents/{incidentUuid})
incident_incidents__update_incident_basic_attributes
Update incident basic attributes (POST /v2/incidents/{incidentUuid}/basic-attributes:update)
incident_incident_comments__list_incident_comments
List incident comments (GET /v2/incidents/{incidentUuid}/comments)
incident_incident_comments__create_incident_comment
Create incident comment (POST /v2/incidents/{incidentUuid}/comments)
incident_incident_comments__get_incident_comment
Get incident comment (GET /v2/incidents/{incidentUuid}/comments/{commentUuid})
incident_incident_comments__delete_incident_comment
Delete incident comment (DELETE /v2/incidents/{incidentUuid}/comments/{commentUuid})
incident_incident_comments__update_incident_comment_text
Update incident comment text (POST /v2/incidents/{incidentUuid}/comments/{commentUuid}/text:update)
incident_incidents__close_incident
Close incident (POST /v2/incidents/{incidentUuid}:close)
incident_incidents__reopen_incident
Reopen incident (POST /v2/incidents/{incidentUuid}:reopen)
installer_installers__generate_gpo_sccm_file
Generate gpo sccm file (POST /v1/gpo-sccm-files:generate)
installer_installers__list_installers
List installers (GET /v1/installers)
installer_installers__create_installer
Create installer (POST /v1/installers)
installer_installers__get_installer
Get installer (GET /v1/installers/{installerUuid})
installer_installers__delete_installer
Delete installer (DELETE /v1/installers/{installerUuid})
mobile_mobile_devices__batch_activate_product
Batch activate product (POST /v1/mobile-devices:batchActivateProduct)
mobile_mobile_devices__batch_get_enrollment_links
Batch get enrollment links (POST /v1/mobile-devices:batchGetEnrollmentLinks)
nap_network_access_configurator__list_ip_sets
List IP sets (GET /v1/policies/{policyUuid}/ip-sets)
nap_network_access_configurator__update_ip_set
Update IP set (POST /v1/policies/{policyUuid}/ip-sets/{ipSetUuid}:update)
nap_network_access_configurator__get_ip_set
Get IP set (GET /v1/policies/{policyUuid}/ip-sets/{ipSetUuid})
patch_patch_management__list_recent_application_patching_details
List recent application patching details (GET /v1/application-patching-processes/recent/details)
patch_unpatched_devices__list_device_patches
List device patches (GET /v1/device-patches)
patch_patch_management__list_device_patching_details
List patching details (GET /v1/patching-process-details)
policy_policies__list_policies
List policies (GET /v2/policies)
policy_policies__create_policy
Create policy (POST /v2/policies)
policy_policies__get_policy
Get policy (GET /v2/policies/{policyUuid})
policy_policies__delete_policy
Delete policy (DELETE /v2/policies/{policyUuid})
policy_policy_assignments__list_policy_assignments
List policy assignments (GET /v2/policy-assignments)
policy_policy_assignments__assign_policy
Assign policy (POST /v2/policy-assignments)
policy_policy_assignments__get_policy_assignment
Get policy assignment (GET /v2/policy-assignments/{assignmentUuid})
policy_policy_assignments__unassign_policy
Unassign policy (DELETE /v2/policy-assignments/{assignmentUuid})
policy_policy_assignments__update_policy_assignment_ranking
Update policy assignment ranking (POST /v2/policy-assignments/{assignmentUuid}:updateRanking)
quarantine_quarantined_objects__list_quarantined_objects
List quarantined objects (GET /v1/quarantined-objects)
quarantine_quarantined_objects__get_quarantined_objects_count
Get quarantined objects count (GET /v1/quarantined-objects/count)
quarantine_quarantined_objects__get_quarantined_object
Get quarantined object (GET /v1/quarantined-objects/{objectUuid})
quarantine_quarantined_objects__batch_delete_quarantined_objects
Batch delete quarantined objects (POST /v1/quarantined-objects:batchDelete)
quarantine_quarantined_objects__batch_download_quarantined_objects
Batch download quarantined objects (POST /v1/quarantined-objects:batchDownload)
quarantine_quarantined_objects__batch_restore_quarantined_objects
Batch restore quarantined objects (POST /v1/quarantined-objects:batchRestore)
quarantine_quarantined_objects__download_quarantined_objects
Download quarantined objects (POST /v1/quarantined-objects:download)
quarantine_quarantined_objects__purge_quarantined_objects
Purge quarantined objects (POST /v1/quarantined-objects:purge)
quarantine_quarantined_objects__restore_quarantined_objects
Restore quarantined objects (POST /v1/quarantined-objects:restore)
user_users__list_users
List users (GET /v1/users)
user_users__get_user
Get user (GET /v1/users/{userUuid})
user_users__batch_get_users
Batch get users (POST /v1/users:batchGetUsers)
vuln_vulnerable_devices__list_device_os_vulnerabilities
List device operating system vulnerabilities (GET /v1/device-os-vulnerabilities)
vuln_vulnerable_devices__list_device_vulnerabilities
List device vulnerabilities (GET /v1/device-vulnerabilities)
vuln_vulnerability_management__list_recent_scan_details
List recent scan details (GET /v1/scans/recent)
vuln_vulnerable_devices__list_vulnerable_devices
List vulnerable devices (GET /v1/vulnerable-devices)
wap_web_address_rules_configurator__list_web_address_rules
List all address rules containing given domain (GET /v2/policies/{policyUuid}/web-address-rules)
wap_web_address_rules_configurator__update_web_address_rule_domains
Update web address rule domains (PUT /v2/policies/{policyUuid}/web-address-rules/{addressRuleUuid}/domains)
BEFORE YOU INSTALL
What to know first
Tools you get
Docs list 106; a default launch gives you 51. ESET_MODE defaults to RO, which advertises the 51 read tools; set ESET_MODE=RW to get all 106.
Requires
- docker on PATH
- A dedicated ESET API user (created in ESET PROTECT Hub or ESET Business Account → API users)
- A .env file with ESET_USER, ESET_PASSWORD and ESET_REGION (eu, de, us, ca or jpn)
INSTALLATION
Connect your client
Server setup
TERMINAL
cp .env.example .env # set ESET_USER / ESET_PASSWORD / ESET_REGION
docker run --rm -i --env-file .env ghcr.io/maciekaz/eset-mcp:1MCP Clients
Claude Desktop — stdio, Claude Code — stdio
JSON
{
"mcpServers": {
"eset": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"--env-file",
"<YOUR_PATH_TO_ENV>",
"ghcr.io/maciekaz/eset-mcp:1"
]
}
}
}Every setup on this page reads ESET_USER, ESET_PASSWORD and ESET_REGION from a .env file. You don't need a copy of the project to make it: download .env.example from the top folder of the project's GitHub repository, save it as .env, and set those three values in it. In the Claude Desktop and Claude Code tabs, <YOUR_PATH_TO_ENV> is the full path to that file.
Other routes
Docker — HTTP server
DOCKER — HTTP SERVER · TERMINAL
docker run -d --name eset-mcp \
--env-file .env -p 8765:8765 \
-e ESET_MCP_TRANSPORT=http \
ghcr.io/maciekaz/eset-mcp:1Every setup on this page reads ESET_USER, ESET_PASSWORD and ESET_REGION from a .env file. You don't need a copy of the project to make it: download .env.example from the top folder of the project's GitHub repository, save it as .env, and set those three values in it. In the Claude Desktop and Claude Code tabs, <YOUR_PATH_TO_ENV> is the full path to that file.
