The server provides read-only access to F6 XDR data for searching, counting, field discovery, and artifact browsing.
Search supported XDR sections (alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions) with field:value queries, wildcards, time filters, ordering, and pagination; empty queries return whole sections.
Count records in a section, optionally using a query filter.
Discover available search fields, filter options, and suggested real values for fields.
List host-collected artifacts by asset_id or machine_id, and inspect an artifact's internal files/folders one level at a time.
The exposed schema is read-only; it does not include download, write, mark-event, abort, or artifact-collection tools.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@F6 XDR MCP Server Show me critical unresolved alerts from the last 24 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP-сервер к платформе F6 XDR. Даёт ИИ-ассистенту доступ к алертам, инцидентам, письмам, файлам, хостам и журналу — поиском на языке запросов платформы.
Тул | Назначение |
| Поиск по секции; пустой запрос возвращает секцию целиком |
| Количество записей |
| Доступные поля поиска |
| Доступные значения фильтров |
| Реальные значения поля по префиксу |
| Артефакты, собранные с хостов: багрепорты, логи, конфиги, дампы |
| Файлы и папки внутри собранного артефакта |
| Скачать артефакт или его часть в локальную папку |
| Пользовательские артефакты: сохранённые в консоли списки путей и команд |
| Запустить сбор артефактов с хоста |
| Остановить сбор, который ещё идёт |
| Пометить объект: закрыть алерт, отметить ложное срабатывание |
Секции: alerts, incidents, emails, files, events, connections, assets,
modules, audit, applications, application_versions.
Первые семь тулов только читают. xdr_download_artifact пишет файлы на диск,
xdr_mark_event изменяет данные, а три тула сбора действуют на хостах; все они по
умолчанию выключены, см. раздел «Безопасность».
Related MCP server: F5 MCP Server
Нужен Python 3.10+ и персональный API-токен пользователя XDR.
{
"mcpServers": {
"xdr": {
"command": "uvx",
"args": ["xdr-mcp"],
"env": {
"XDR_BASE_URL": "https://<your-xdr-host>",
"XDR_API_KEY": "<token>"
}
}
}
}Этот блок подходит для Claude Desktop, Cursor и VS Code. Для Claude Code:
claude mcp add xdr \
-e XDR_BASE_URL=https://<your-xdr-host> -e XDR_API_KEY=<token> \
-- uvx xdr-mcpВместо uvx можно использовать pip install xdr-mcp и команду xdr-mcp, либо
контейнер — docker run -i --rm -e XDR_BASE_URL -e XDR_API_KEY ghcr.io/f6-security/xdr-mcp
(образ собран под linux/amd64 и linux/arm64).
Переменная | Назначение |
| Адрес вашей инсталляции XDR |
| Персональный API-токен пользователя |
|
|
|
|
|
|
| Папка, куда |
| PEM-бандл для инсталляции за внутренним УЦ |
alerts severity : "critical" AND resolved : "false"
alerts timestamp >= now-1d AND NOT false_positive : "true"
incidents closed : "false" AND timestamp >= now-30d
emails is_blocked : "true" AND timestamp >= now-1d
assets edr_active : "true"
applications vendor : "Microsoft Corporation"
audit success : "false" AND timestamp >= now-7dУсловия объединяются через AND, OR, NOT и группируются скобками. Время —
обычно поле timestamp, относительное (now-1d, now-6h) или абсолютное.
Какие поля доступны в секции, покажет xdr_get_mapping; в application_versions
для дат используются first_seen и last_seen.
В строковых значениях работает * в любой позиции: name : "VDI-5*",
file_name : "*.exe". Без него значение должно совпасть точно. Если запрос ничего не
вернул, а значение могло писаться иначе, точное написание подскажет
xdr_get_suggestions: платформа отвечает на несовпавшее значение нулём записей, а не
ошибкой.
applications возвращает программное обеспечение, а application_versions —
записи его версий на активах. Сначала найдите нужное ПО в applications, затем
используйте его uuid в поле software_id:
application_versions software_id : "<software_uuid>"
application_versions software_id : "<software_uuid>" AND version : "1.2.3"
application_versions asset : "<machine_id>" AND last_seen >= now-7dsoftware_id поддерживается поиском, хотя отсутствует в xdr_get_mapping.
Поле asset принимает machine_id или точный current_name, соответствующий
одному активу. Ответ включает version, uuid, ts_created, ts_updated
и сведения об активе, например machine_id и computer_name.
Для секции доступны все пять тулов, принимающих секцию. Пагинация использует page_size
и offset; сортировка — version, ts_created, ts_updated с необязательным
префиксом -. xdr_count считает записи версий на активах: одинаковая версия
на разных активах может встречаться несколько раз. Поле version имеет
show_suggestions=false, поэтому пустой список подсказок допустим.
Всё, что возвращают читающие тулы, попадает в контекст языковой модели: адреса и темы писем, имена файлов, хосты, журнал действий. Выдавайте серверу токен с минимально необходимыми правами.
xdr_mark_event создаёт матчер — правило, которое применяется ко всем объектам,
подходящим под выражение, и этим тулом не отменяется. Поэтому тул выключен по
умолчанию; включайте XDR_ALLOW_WRITE осознанно и не добавляйте его в
авто-подтверждение MCP-клиента.
Собранные артефакты — одни из самых чувствительных данных платформы: дампы памяти,
учётные данные, история команд. xdr_download_artifact кладёт их на диск, а модели
возвращает только путь и размер — содержимое в контекст не попадает. Тул включается,
только когда задана XDR_DOWNLOAD_DIR; выбирайте для неё папку с ограниченным
доступом. Для списка и скачивания токену нужны права на артефакты.
xdr_collect_artifacts запускает на хосте сбор с правами SYSTEM или root. Сбор
нагружает хост, а пользовательские артефакты могут нести команды, которые на нём
выполнятся. Поэтому тулы сбора включаются своей переменной XDR_ALLOW_COLLECT, а не
XDR_ALLOW_WRITE. Произвольных команд тул не принимает, только пользовательские
артефакты, сохранённые человеком в консоли. За вызов — один хост, массового запуска
нет. Пути проверяются до запроса: неподходящий путь роняет весь сбор. Для путей,
пользовательских артефактов, багрепорта, дампов памяти, истории команд и ещё
нескольких частей платформа просит одноразовый код, если у пользователя токена нет
списка разрешённых IP. С XDR_PASSWORD_PROMPT=1 сервер спрашивает его в отдельном
окне и отправляет прямо в консоль. Модель его не видит, а окно показывает, что и с
какого хоста собирается. Без этой переменной модель спросит код в чате. Остановить
можно только сбор, который ещё идёт: отмену завершённого платформа тоже принимает, и
его архив после этого не читается. Не добавляйте тулы сбора в авто-подтверждение
MCP-клиента.
Модель угроз и порядок сообщения об уязвимостях — SECURITY.md.
См. CONTRIBUTING.md.
Get the total count of records in an XDR section. Optionally filter by query to count matching records only. For application_versions this counts per-asset records, not distinct version strings.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Search query string using field:value syntax, e.g. 'resolved : "false" AND severity : "critical"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. A string value may contain * as a wildcard, in any position: name : "VDI-5*", file_name : "*.exe", domain : "*corp*". Without a wildcard a string value must match exactly. Numeric and date fields do not take wildcards. Call xdr_get_mapping for the fields a section accepts, xdr_get_filters for the values an enumerated field takes, and xdr_get_suggestions to look up the exact spelling of a value — a value outside the accepted set returns zero results rather than an error. Time filtering uses fields from xdr_get_mapping, typically timestamp, with relative (timestamp >= now-1d, now-6h) or absolute values (timestamp >= "2024-01-01T00:00:00.000+03:00"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the "applications" section, filter by asset, e.g. (asset: "<machine_id>"). The "application_versions" section returns per-asset software version records. Filter by software_id: "<uuid from applications>" (supported even though absent from mapping), version: "1.2.3", or asset: "<machine_id or exact current_name>" identifying a single asset. For dates in this section use first_seen or last_seen, e.g. last_seen >= now-7d; ordering uses version, ts_created or ts_updated. A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for. (optional) | |
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions |
List the files and folders inside a collected artifact, one level at a time, with their sizes. Takes the artifact's numeric 'id' from xdr_list_artifacts and an optional folder inside it (e.g. /var/log). Use it to find the part worth downloading rather than fetching a whole artifact.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Folder inside the artifact; omit for the top | |
| report_id | Yes | Numeric artifact id ('id' in xdr_list_artifacts) |
Get available filter options for an XDR section.
| Name | Required | Description | Default |
|---|---|---|---|
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions |
Get all available search fields for an XDR section. Returns field names, labels, categories, and supported operators. Call this first to understand what you can search on.
| Name | Required | Description | Default |
|---|---|---|---|
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions |
Look up real values of a field, optionally narrowed by a prefix. Use it when a query returns nothing and the value may simply be spelled differently — an unmatched value is answered with zero records rather than an error, so a guess is indistinguishable from a genuine absence. Each entry has a value to put in a query and a label for display; search on the value. Returns up to about ten entries, so narrow the prefix to see more. Field names come from xdr_get_mapping, where the ones worth asking about carry show_suggestions; an unknown field name comes back empty rather than as an error.
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | Field to list values of, as named by xdr_get_mapping | |
| prefix | No | Return only values starting with this. Omit for the field's first values. | |
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions |
List artifacts collected from hosts — what an analyst gathered through the asset's Response → Artifacts: bug reports, logs, configs, memory dumps. Filter by host with asset_id (the asset's numeric id) or machine_id; with neither, lists artifacts across all hosts. Newest first by default. Each row has 'id' (for xdr_get_artifact_structure), 'internal_id' (for xdr_download_artifact), 'parts' (what was collected), 'command_status' (New, Queued, Pending, Uploading, Uploaded, Done, Failed, Aborted) and 'size' in bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | 1-based page number | |
| asset_id | No | Numeric asset id | |
| ordering | No | By creation time; default -ts_created (newest first) | |
| page_size | No | Rows per page (1-200, default 20) | |
| machine_id | No | Agent machine id (UUID); looked up to the asset id first |
Search for events/objects in an XDR section. Returns matching records; an empty query returns the section unfiltered. Use xdr_get_mapping first to discover available fields.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search query string using field:value syntax, e.g. 'resolved : "false" AND severity : "critical"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. A string value may contain * as a wildcard, in any position: name : "VDI-5*", file_name : "*.exe", domain : "*corp*". Without a wildcard a string value must match exactly. Numeric and date fields do not take wildcards. Call xdr_get_mapping for the fields a section accepts, xdr_get_filters for the values an enumerated field takes, and xdr_get_suggestions to look up the exact spelling of a value — a value outside the accepted set returns zero results rather than an error. Time filtering uses fields from xdr_get_mapping, typically timestamp, with relative (timestamp >= now-1d, now-6h) or absolute values (timestamp >= "2024-01-01T00:00:00.000+03:00"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the "applications" section, filter by asset, e.g. (asset: "<machine_id>"). The "application_versions" section returns per-asset software version records. Filter by software_id: "<uuid from applications>" (supported even though absent from mapping), version: "1.2.3", or asset: "<machine_id or exact current_name>" identifying a single asset. For dates in this section use first_seen or last_seen, e.g. last_seen >= now-7d; ordering uses version, ts_created or ts_updated. A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for. | |
| offset | No | Number of results to skip. For the "modules" section the API pages in fixed steps, so offset must be a multiple of page_size there. | |
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions | |
| ordering | No | Sort field with optional - prefix for descending, e.g. -created_at (newest first). An unknown field is silently ignored: the API reports no error and the results come back in some other order, so use only the fields listed here. Per section — alerts: created_at, last_event, last_updated, severity; incidents: created_at, updated_at; emails: ts_created, delay; files: ts_created, delay; events: Header.Timestamp; connections: ts_parsed, ts_last_usage_parsed, service_count, duration; assets: last_activity, first_activity; modules: ts_created, name; audit: timestamp; applications: name, ts_created, ts_updated; application_versions: version, ts_created, ts_updated. | |
| page_size | No | Number of results per page (1-200, default 10) |
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.3.0xdr_count3 fields changedInput schema / properties / query / descriptionPrevious value: -"Search query string using field:value syntax, e.g. 'resolved : \"false\" AND severity : \"critical\"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. Call xdr_get_mapping for the fields a section accepts, and xdr_get_filters for the values an enumerated field takes — a value outside that set returns zero results rather than an error. Time filtering uses the timestamp field, relative (timestamp >= now-1d, now-6h) or absolute (timestamp >= \"2024-01-01T00:00:00.000+03:00\"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the \"applications\" section, filter by asset, e.g. (asset: \"<machine_id>\"). A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for. (optional)"New value: +"Search query string using field:value syntax, e.g. 'resolved : \"false\" AND severity : \"critical\"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. A string value may contain * as a wildcard, in any position: name : \"VDI-5*\", file_name : \"*.exe\", domain : \"*corp*\". Without a wildcard a string value must match exactly. Numeric and date fields do not take wildcards. Call xdr_get_mapping for the fields a section accepts, xdr_get_filters for the values an enumerated field takes, and xdr_get_suggestions to look up the exact spelling of a value — a value outside the accepted set returns zero results rather than an error. Time filtering uses fields from xdr_get_mapping, typically timestamp, with relative (timestamp >= now-1d, now-6h) or absolute values (timestamp >= \"2024-01-01T00:00:00.000+03:00\"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the \"applications\" section, filter by asset, e.g. (asset: \"<machine_id>\"). The \"application_versions\" section returns per-asset software version records. Filter by software_id: \"<uuid from applications>\" (supported even though absent from mapping), version: \"1.2.3\", or asset: \"<machine_id or exact current_name>\" identifying a single asset. For dates in this section use first_seen or last_seen, e.g. last_seen >= now-7d; ordering uses version, ts_created or ts_updated. A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for. (optional)"Input schema / properties / section / descriptionPrevious value: -"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications"New value: +"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions"Input schema / properties / section / enumPrevious value: -[
- "alerts",
- "incidents",
- "emails",
- "files",
- "events",
- "connections",
- "assets",
- "modules",
- "audit",
- "applications"
-]New value: +[
+ "alerts",
+ "incidents",
+ "emails",
+ "files",
+ "events",
+ "connections",
+ "assets",
+ "modules",
+ "audit",
+ "applications",
+ "application_versions"
+]xdr_get_artifact_structurexdr_get_filters2 fields changedInput schema / properties / section / descriptionPrevious value: -"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications"New value: +"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions"Input schema / properties / section / enumPrevious value: -[
- "alerts",
- "incidents",
- "emails",
- "files",
- "events",
- "connections",
- "assets",
- "modules",
- "audit",
- "applications"
-]New value: +[
+ "alerts",
+ "incidents",
+ "emails",
+ "files",
+ "events",
+ "connections",
+ "assets",
+ "modules",
+ "audit",
+ "applications",
+ "application_versions"
+]xdr_get_mapping2 fields changedInput schema / properties / section / descriptionPrevious value: -"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications"New value: +"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions"Input schema / properties / section / enumPrevious value: -[
- "alerts",
- "incidents",
- "emails",
- "files",
- "events",
- "connections",
- "assets",
- "modules",
- "audit",
- "applications"
-]New value: +[
+ "alerts",
+ "incidents",
+ "emails",
+ "files",
+ "events",
+ "connections",
+ "assets",
+ "modules",
+ "audit",
+ "applications",
+ "application_versions"
+]xdr_get_suggestionsxdr_list_artifactsxdr_search4 fields changedInput schema / properties / ordering / descriptionPrevious value: -"Sort field with optional - prefix for descending, e.g. -created_at (newest first). An unknown field is silently ignored: the API reports no error and the results come back in some other order, so use only the fields listed here. Per section — alerts: created_at, last_event, last_updated, severity; incidents: created_at, updated_at; emails: ts_created, delay; files: ts_created, delay; events: Header.Timestamp; connections: ts_parsed, ts_last_usage_parsed, service_count, duration; assets: last_activity, first_activity; modules: ts_created, name; audit: timestamp; applications: name, ts_created, ts_updated."New value: +"Sort field with optional - prefix for descending, e.g. -created_at (newest first). An unknown field is silently ignored: the API reports no error and the results come back in some other order, so use only the fields listed here. Per section — alerts: created_at, last_event, last_updated, severity; incidents: created_at, updated_at; emails: ts_created, delay; files: ts_created, delay; events: Header.Timestamp; connections: ts_parsed, ts_last_usage_parsed, service_count, duration; assets: last_activity, first_activity; modules: ts_created, name; audit: timestamp; applications: name, ts_created, ts_updated; application_versions: version, ts_created, ts_updated."Input schema / properties / query / descriptionPrevious value: -"Search query string using field:value syntax, e.g. 'resolved : \"false\" AND severity : \"critical\"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. Call xdr_get_mapping for the fields a section accepts, and xdr_get_filters for the values an enumerated field takes — a value outside that set returns zero results rather than an error. Time filtering uses the timestamp field, relative (timestamp >= now-1d, now-6h) or absolute (timestamp >= \"2024-01-01T00:00:00.000+03:00\"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the \"applications\" section, filter by asset, e.g. (asset: \"<machine_id>\"). A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for."New value: +"Search query string using field:value syntax, e.g. 'resolved : \"false\" AND severity : \"critical\"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. A string value may contain * as a wildcard, in any position: name : \"VDI-5*\", file_name : \"*.exe\", domain : \"*corp*\". Without a wildcard a string value must match exactly. Numeric and date fields do not take wildcards. Call xdr_get_mapping for the fields a section accepts, xdr_get_filters for the values an enumerated field takes, and xdr_get_suggestions to look up the exact spelling of a value — a value outside the accepted set returns zero results rather than an error. Time filtering uses fields from xdr_get_mapping, typically timestamp, with relative (timestamp >= now-1d, now-6h) or absolute values (timestamp >= \"2024-01-01T00:00:00.000+03:00\"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the \"applications\" section, filter by asset, e.g. (asset: \"<machine_id>\"). The \"application_versions\" section returns per-asset software version records. Filter by software_id: \"<uuid from applications>\" (supported even though absent from mapping), version: \"1.2.3\", or asset: \"<machine_id or exact current_name>\" identifying a single asset. For dates in this section use first_seen or last_seen, e.g. last_seen >= now-7d; ordering uses version, ts_created or ts_updated. A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for."Input schema / properties / section / descriptionPrevious value: -"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications"New value: +"Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications, application_versions"Input schema / properties / section / enumPrevious value: -[
- "alerts",
- "incidents",
- "emails",
- "files",
- "events",
- "connections",
- "assets",
- "modules",
- "audit",
- "applications"
-]New value: +[
+ "alerts",
+ "incidents",
+ "emails",
+ "files",
+ "events",
+ "connections",
+ "assets",
+ "modules",
+ "audit",
+ "applications",
+ "application_versions"
+]v0.1.0xdr_countxdr_get_filtersxdr_get_mappingxdr_searchScored across 7 tools
The search/count pair and the artifact tools are clearly distinct, but the metadata trio — xdr_get_mapping, xdr_get_filters, and xdr_get_suggestions — have overlapping purposes (all answer 'what can I search/filter on?'), and xdr_get_filters has a one-line description that gives no guidance on when to use it instead of get_mapping. xdr_get_suggestions and xdr_search could also be confused since both can return matching values.
All tools share the xdr_ prefix and snake_case, with a clear verb-first structure (search, count, get_*, list_*). The only deviation is that xdr_search and xdr_count drop the noun compared to the get_/list_ tools, which is minor and still readable.
Seven tools is a well-scoped set for a search-and-inspect server: one per query primitive plus two for the artifact workflow. Each tool has a distinct role, and nothing feels padded or missing from the count itself.
xdr_list_artifacts explicitly tells the agent to use its 'internal_id' with xdr_download_artifact, but no such tool exists in this set — the artifact workflow dead-ends after inspecting structure. There is also no way to perform response/containment actions or export search results, leaving the core lifecycle incomplete.
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
Search log events, investigate anomalies, and manage cases in your Knowledge Grid tenant.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Manage tickets, run agents and workflows, query tables, and search workspace knowledge.
