LABSCO SUMMARY

Read-only plus SELECT queries is the setting that makes this safe and still useful.

The quick-start config turns both on deliberately: an agent can run live osquery SELECTs across your fleet — which is where the real answers are — while every tool that could delete a host, transfer teams or push a script stays unregistered. That is a better boundary than trusting instructions, because the write tools genuinely are not exposed. Turn writes on per deployment when you need them, not as a default.

What it is

An MCP server for Fleet Device Management. It covers the read surface broadly — hosts, saved queries, compliance policies, software inventory and CVEs, teams, users, MDM profiles, scripts, activity logs — and gates every state-changing tool behind an explicit configuration switch.

What you get

Hosts — fleet_list_hosts, fleet_get_host, fleet_get_host_by_identifier, fleet_search_hosts, plus per-host MDM, certificate, encryption-key and activity tools
Software and vulnerabilities — fleet_list_software, fleet_get_host_software, fleet_get_vulnerabilities, fleet_get_cve, fleet_find_software_on_host, fleet_list_software_titles
Policies and queries — fleet_list_policies, fleet_get_policy_results, fleet_list_queries, fleet_get_query_report
MDM — fleet_list_mdm_profiles, fleet_get_mdm_profiles_summary, fleet_get_filevault_summary, fleet_list_mdm_devices and more
Osquery help — fleet_list_osquery_tables, fleet_get_osquery_table_schema, fleet_suggest_tables_for_query propose tables from a stated intent
fleet_health_check confirms connectivity and authentication before you debug anything else
Write tools such as fleet_query_host, fleet_transfer_hosts and fleet_delete_host appear only when read-only mode is off

Requirements

A Fleet server and an API token from Fleet's My account > Get API token page. Published on PyPI as fleet-mcp version 1.1.3, stdio transport; the client entry runs uvx fleet-mcp run. Two variables are required — FLEET_SERVER_URL and FLEET_API_TOKEN (secret). Three optional ones shape behaviour: FLEET_READONLY, FLEET_ALLOW_SELECT_QUERIES and FLEET_VERIFY_SSL.

Setup effort

One command plus a key — uvx fleet-mcp run, then supply credentials

See installation options

USE CASES

01

Finding out which machines are affected by a CVE

Look up the CVE, then find which hosts have the vulnerable software installed.

fleet_get_cvefleet_find_software_on_host

02

Answering a compliance question about the fleet

Read the policy's results rather than exporting a report from the UI.

fleet_list_policiesfleet_get_policy_results

03

Asking a live question osquery can answer

Get table suggestions for what you are trying to find out, then run a SELECT across hosts.

fleet_suggest_tables_for_queryfleet_list_osquery_tables

04

Checking disk encryption coverage

Pull the FileVault summary and the MDM profile deployment status in one pass.

fleet_get_filevault_summaryfleet_get_mdm_profiles_summary

05

Tracking down one machine

Find it by hostname, UUID or serial and read its full record.

fleet_get_host_by_identifierfleet_get_host

132 tools

Listed in project docs. Your client may show a different list.

fleet_list_hosts

fleet_get_host

fleet_get_host_by_identifier

fleet_search_hosts

fleet_list_host_upcoming_activities

fleet_list_host_past_activities

fleet_get_host_mdm

fleet_list_host_certificates

fleet_get_host_macadmins

fleet_get_host_device_mapping

fleet_get_host_encryption_key

fleet_list_queries

fleet_get_query

fleet_get_query_report

fleet_list_policies

BEFORE YOU INSTALL

What to know first

Tools you get

132 tools named in the project's documentation.

Requires

uvx on PATH
FLEET_API_TOKEN in your environment
FLEET_SERVER_URL in your environment

INSTALLATION

Connect your client

Server setup

TERMINAL

uvx fleet-mcp run

MCP Clients

Continue

CONTINUE · JSON

{
  "mcpServers": [
    {
      "name": "fleet",
      "command": "uvx",
      "args": [
        "fleet-mcp",
        "run"
      ],
      "env": {
        "FLEET_SERVER_URL": "<YOUR_FLEET_SERVER_URL>",
        "FLEET_API_TOKEN": "<YOUR_FLEET_API_TOKEN>",
        "FLEET_READONLY": "true",
        "FLEET_ALLOW_SELECT_QUERIES": "true"
      }
    }
  ]
}

Zed

ZED · JSON

{
  "context_servers": {
    "fleet": {
      "command": {
        "path": "uvx",
        "args": [
          "fleet-mcp",
          "run"
        ]
      },
      "settings": {
        "env": {
          "FLEET_SERVER_URL": "<YOUR_FLEET_SERVER_URL>",
          "FLEET_API_TOKEN": "<YOUR_FLEET_API_TOKEN>",
          "FLEET_READONLY": "true",
          "FLEET_ALLOW_SELECT_QUERIES": "true"
        }
      }
    }
  }
}

VS Code

VS CODE · JSON

{
  "servers": {
    "fleet": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "fleet-mcp",
        "run"
      ],
      "env": {
        "FLEET_SERVER_URL": "<YOUR_FLEET_SERVER_URL>",
        "FLEET_API_TOKEN": "<YOUR_FLEET_API_TOKEN>",
        "FLEET_READONLY": "true",
        "FLEET_ALLOW_SELECT_QUERIES": "true"
      }
    }
  }
}

Augment Code

AUGMENT CODE · JSON

{
  "augment.advanced": {
    "mcpServers": [
      {
        "name": "fleet",
        "command": "uvx",
        "args": [
          "fleet-mcp",
          "run"
        ],
        "env": {
          "FLEET_SERVER_URL": "<YOUR_FLEET_SERVER_URL>",
          "FLEET_API_TOKEN": "<YOUR_FLEET_API_TOKEN>",
          "FLEET_READONLY": "true",
          "FLEET_ALLOW_SELECT_QUERIES": "true"
        }
      }
    ]
  }
}

Fleet-MCP