forcepointDSC-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| APP_NAME | Yes | Naming root for Vault paths and Postgres table name | |
| VAULT_ADDR | Yes | Vault server address | |
| POSTGRES_DB | Yes | PostgreSQL database name | |
| VAULT_TOKEN | Yes | Vault authentication token | |
| POSTGRES_HOST | Yes | PostgreSQL host | |
| POSTGRES_PORT | Yes | PostgreSQL port | |
| POSTGRES_USER | Yes | PostgreSQL user | |
| POSTGRES_PASSWORD | Yes | PostgreSQL password | |
| MCP_ADMIN_AUTH_KEY | No | Optional admin key enforced for all mutating tools | |
| MCP_CONFIG_DEFAULT_USER_ID | No | Default user scope when userId is omitted | |
| FORCEPOINT_DEFAULT_BASE_URL | No | Forcepoint portal base URL fallback | |
| FORCEPOINT_DEFAULT_TIMEOUT_MS | No | Forcepoint request timeout fallback (milliseconds) | |
| FORCEPOINT_CONFIG_BASE_URL_KEY | No | Postgres key for per-user base URL | |
| MCP_HTTP_VAULT_TOKEN_INDEX_PATH | No | Shared multi-user Vault index for MCP HTTP bearer tokens | |
| FORCEPOINT_CONFIG_TIMEOUT_MS_KEY | No | Postgres key for per-user timeout | |
| FORCEPOINT_DEFAULT_USER_API_VERSION | No | Default user read API version (v2 or v2.1) | |
| FORCEPOINT_CONFIG_USER_API_VERSION_KEY | No | Postgres key for per-user user-read API version | |
| FORCEPOINT_VAULT_USER_AUTH_SECRET_SUFFIX | No | Vault suffix for per-user Forcepoint auth secrets |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| forcepoint_query_suggestionA | Suggest Forcepoint MCP tool sequences, safety checks, and rich tool schemas for a workflow intent. Read-only; use for schema discovery and planning. |
| forcepoint_connection_infoA | Return Forcepoint MCP runtime defaults, authentication model, docs references, and persistence wiring. Read-only. |
| forcepoint_scope_infoB | Return user-scoped Postgres and Vault paths used by this Forcepoint MCP solution. Read-only. |
| forcepoint_endpoint_inventoryA | Return the documented Forcepoint endpoint catalog and generated OpenAPI inventory metadata. Read-only. |
| forcepoint_connection_config_getA | Read Postgres-backed Forcepoint connection configuration for one user scope. Read-only. |
| forcepoint_connection_config_setA | Persist Forcepoint base URL, timeout, or preferred user API version for one user scope. Mutating; requires authorizationKey when admin auth is enabled. |
| forcepoint_user_token_getA | Read metadata about the Vault-backed Forcepoint credential for one user scope. Read-only; secret values remain redacted. |
| forcepoint_user_token_setA | Store a user-scoped Forcepoint bearer token or basic-auth credential in Vault. Mutating and high-risk; requires authorizationKey when admin auth is enabled. |
| forcepoint_user_token_deleteA | Delete the Vault-backed Forcepoint credential for one user scope. Mutating and high-risk; requires authorizationKey when admin auth is enabled. |
| forcepoint_mcp_http_token_getA | List user-scoped MCP HTTP bearer-token metadata stored in Vault. Read-only. |
| forcepoint_mcp_http_token_upsertB | Create or update a user-scoped MCP HTTP bearer token stored in Vault. Mutating and high-risk; requires authorizationKey when admin auth is enabled. |
| forcepoint_mcp_http_token_revokeA | Revoke a user-scoped MCP HTTP bearer token by tokenId. Mutating and high-risk; requires authorizationKey when admin auth is enabled. |
| forcepoint_health_checkB | Verify Forcepoint reachability and stored credentials using the documented group-list read endpoint. Read-only. |
| forcepoint_user_create_or_updateC | Create or update a Forcepoint user through the documented Config API. Mutating; requires authorizationKey when admin auth is enabled. |
| forcepoint_user_deactivateA | Deactivate a Forcepoint user. Mutating and potentially disruptive; requires authorizationKey when admin auth is enabled. |
| forcepoint_user_reactivateA | Reactivate a Forcepoint user. Mutating; requires authorizationKey when admin auth is enabled. |
| forcepoint_user_deleteA | Delete a deactivated Forcepoint user. High-risk mutation; requires authorizationKey when admin auth is enabled. |
| forcepoint_user_getB | Read Forcepoint user details via Config API v2 or v2.1. Read-only. |
| forcepoint_group_create_or_updateB | Create a Forcepoint group or rename an existing group. Mutating; requires authorizationKey when admin auth is enabled. |
| forcepoint_group_deleteA | Delete a Forcepoint group. High-risk mutation; requires authorizationKey when admin auth is enabled. |
| forcepoint_group_add_membersB | Add existing users to a Forcepoint group. Mutating; requires authorizationKey when admin auth is enabled. |
| forcepoint_group_remove_membersA | Remove users from a Forcepoint group. Mutating; requires authorizationKey when admin auth is enabled. |
| forcepoint_group_listA | List Forcepoint groups for the selected user scope. Read-only. |
| forcepoint_group_getB | Read Forcepoint group details, member status slice, and pagination metadata. Read-only. |
| forcepoint_api_requestA | Execute a generic Forcepoint API request using the selected user’s Vault-backed credential. Use only when no dedicated tool fits. Mutating calls require authorizationKey when admin auth is enabled. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 25 tools
Tools are grouped by domain (users, groups, tokens, config, metadata) with distinct actions. The four read-only metadata tools (query_suggestion, connection_info, scope_info, endpoint_inventory) share an 'info' nature but serve different purposes, and the token tools are clearly separated by credential type.
All tools share the forcepoint_ prefix, and most follow an object_verb pattern (e.g., user_get, group_add_members). However, a few meta-tools break this pattern (query_suggestion, connection_info, scope_info, endpoint_inventory, health_check, api_request), so the convention is not perfectly uniform.
With 25 tools, the server is at the upper boundary of what feels heavy. The breadth is justified by covering multiple Forcepoint domains (users, groups, tokens, config, system info), but the four meta-tools could arguably be consolidated, making the count feel slightly excessive.
The tool surface provides solid CRUD coverage for users and groups, token management, connection config, and a generic API request fallback. The only notable gap is the lack of a dedicated user_list tool, but this is workable via forcepoint_api_request, so the gap is minor.