ESET PROTECT MCP Server

MCP server for ESET PROTECT's ESET Connect API gateway - endpoint fleet visibility (devices and groups), detection/EDR investigation, vulnerability data, patch status, and user management - for AI assistants and the WYRE Conduit gateway.

Authentication

Create a dedicated API user in ESET Business Account: User Management > create a user with read-only permission > enable the Integrations toggle. This gives you an email/password pair for that user.

ESET Connect's token endpoint (POST /oauth/token) is documented in its own OpenAPI spec as a password grant - username/password fields, not client_id/client_secret with grant_type=client_credentials. This server accepts clientId/clientSecret (matching the credential shape used across WYRE's other MCP connectors) and sends them as username/password in that grant. It handles the resulting bearer token's caching and refresh (via the returned refresh_token, falling back to a full re-login if the refresh token itself is rejected) internally - callers only ever supply the long-lived email/password pair.

Configuration

Each ESET Connect API domain (device, incident, vulnerability, patch, and user management) is hosted on its own per-region subdomain, e.g. https://us.device-management.eset.systems; the auth host follows the same regional pattern, e.g. https://us.business-account.iam.eset.systems. ESETPROTECT_REGION selects the prefix for all of them.

Tools

Device Management

• esetprotect_list_device_groups - list device groups.
• esetprotect_list_group_devices - list the devices in a group.
• esetprotect_list_devices - list managed devices, filterable by display name, functionality status, or mute state.
• esetprotect_get_device - get a device by UUID.
• esetprotect_batch_get_devices - get multiple devices by UUID in one call.

Incident Management (detections, detection groups, EDR)

• esetprotect_list_detections / esetprotect_get_detection - v1 detections (legacy surface).
• esetprotect_list_detections_v2 / esetprotect_get_detection_v2 / esetprotect_batch_get_detections - v2 detections (endpoint, cloud office, and EDR).
• esetprotect_list_detection_groups / esetprotect_get_detection_group - detections clustered into groups.
• esetprotect_list_edr_rules / esetprotect_get_edr_rule - EDR detection rules.
• esetprotect_list_edr_rule_exclusions / esetprotect_get_edr_rule_exclusion - EDR rule exclusions.

Vulnerability Management

• esetprotect_list_device_os_vulnerabilities - OS vulnerabilities found on devices.
• esetprotect_list_device_vulnerabilities - vulnerabilities found on devices (application/OS/package scope).
• esetprotect_list_recent_scans - recent vulnerability scan details.
• esetprotect_list_vulnerable_devices - devices with known vulnerabilities.

Patch Management

• esetprotect_list_recent_application_patching_details - most recent application-patching processes fleet-wide.
• esetprotect_list_device_patches - patches for devices, filterable by patch type.
• esetprotect_list_patching_process_details - detailed patching-process history within a time window.

User Management

• esetprotect_list_users - list users, filterable by email, display name, protection status, and more.
• esetprotect_get_user - get a user by UUID.
• esetprotect_batch_get_users - get multiple users by UUID in one call (atomic - all or none).

Scope

This is a v1, read-only fleet/security-visibility surface. Explicitly deferred: device move/rename and batch import, detection and detection-group resolve, EDR rule and rule-exclusion create/update/delete, and any asset-management group create/delete/move/rename endpoints. These are mutation/provisioning actions out of scope for a read-only monitoring connector and can be added as a follow-up.

The incident-management API also exposes a separate /v2/incidents case-management surface (list/get/close/reopen, comments) alongside detections and detection-groups; it is not covered by this v1 surface either, for the same reason.

Development

npm install
npm run build
npm test
npm run lint   # tsc --noEmit

Docker

docker build -t eset-protect-mcp .
docker run -p 8080:8080 \
  -e ESETPROTECT_CLIENT_ID=... \
  -e ESETPROTECT_CLIENT_SECRET=... \
  eset-protect-mcp