ESET PROTECT MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AUTH_MODE | No | Authentication mode: 'env' (default, reads the env vars) or 'gateway' (credentials arrive per-request via X-EsetProtect-* headers). | env |
| LOG_LEVEL | No | Logging level. | info |
| MCP_TRANSPORT | No | Transport for the MCP server. | stdio |
| CONDUIT_S2S_SECRET | No | When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request. | |
| ESETPROTECT_REGION | No | The ESET Connect region your ESET Business Account was provisioned in. | us |
| ESETPROTECT_CLIENT_ID | No | Email of the dedicated ESET Connect API user. | |
| ESETPROTECT_CLIENT_SECRET | No | Password of that API user. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| esetprotect_list_device_groupsB | List ESET PROTECT device (static/dynamic) groups. |
| esetprotect_list_group_devicesB | List the devices that are members of a given device group. |
| esetprotect_list_devicesB | List managed devices (endpoints), optionally filtered by display name, functionality status, or mute state. |
| esetprotect_get_deviceA | Get a single managed device by UUID. |
| esetprotect_batch_get_devicesA | Get multiple managed devices by UUID in one call (max recommended 100, hard limit 1000). |
| esetprotect_list_detectionsB | List detections (v1 - legacy surface, endpoint antivirus/firewall detections only). Prefer esetprotect_list_detections_v2 for new integrations. |
| esetprotect_get_detectionA | Get a single detection by UUID (v1 - legacy surface). |
| esetprotect_list_detections_v2B | List detections (v2 - covers endpoint, cloud office, and EDR detections). |
| esetprotect_get_detection_v2C | Get a single detection by UUID (v2). |
| esetprotect_batch_get_detectionsA | Get multiple v2 detections by UUID in one call (max recommended 100, hard limit 1000). |
| esetprotect_list_detection_groupsC | List detection groups - related detections clustered together (e.g. the same malware across many devices). |
| esetprotect_get_detection_groupB | Get a single detection group by UUID. |
| esetprotect_list_edr_rulesC | List EDR (Endpoint Detection & Response) detection rules. |
| esetprotect_get_edr_ruleA | Get a single EDR rule by UUID. |
| esetprotect_list_edr_rule_exclusionsC | List EDR rule exclusions. |
| esetprotect_get_edr_rule_exclusionA | Get a single EDR rule exclusion by UUID. |
| esetprotect_list_device_os_vulnerabilitiesC | List operating-system vulnerabilities found on devices. |
| esetprotect_list_device_vulnerabilitiesC | List vulnerabilities found on devices (application, OS, or package scope). |
| esetprotect_list_recent_scansC | List details of recent vulnerability scans. |
| esetprotect_list_vulnerable_devicesC | List devices that currently have one or more known vulnerabilities. |
| esetprotect_list_recent_application_patching_detailsB | List details of the most recent application-patching processes across the fleet. |
| esetprotect_list_device_patchesB | List patches (available/applied) for devices, optionally filtered by device, group, or patch type. |
| esetprotect_list_patching_process_detailsC | List detailed patching-process history for devices within an optional time window. |
| esetprotect_list_usersA | List ESET Business Account users provisioned into this ESET PROTECT tenant, with optional filters. |
| esetprotect_get_userC | Get a single user by UUID. |
| esetprotect_batch_get_usersA | Get multiple users by UUID in one call. Atomic: every requested user is returned or none. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 26 tools
The set follows a clear resource/action pattern, but several tools are easy to confuse: detections have v1 and v2 variants, device_os_vulnerabilities overlaps with device_vulnerabilities, and multiple patching/vulnerability-scan history tools exist. The descriptions help, but an agent must read carefully to avoid selecting the wrong list/get surface.
Every tool is prefixed with esetprotect_ and follows a consistent snake_case verb_noun pattern, including batch_get variants. There is no mixing of conventions or unexpected naming styles.
With 26 tools, the server is on the heavy side and above the ideal 3-15 range. Some consolidation is possible, especially around v1/v2 detections and multiple vulnerability/patching list tools, though the breadth is somewhat justified by the scope of ESET PROTECT.
The surface is almost entirely read-only: list/get/batch operations with no create, update, delete, or remediation tools. There are also no single-resource getters for device groups or vulnerability details, so some management and drill-down workflows dead-end.