Sophos Central MCP (read-only)

Unofficial MCP server exposing read-only Sophos Central information: antivirus/endpoint health, firewall inventory and status, switch settings, and email protection (quarantine, mailboxes, clawback status). Built against the public Sophos Central APIs using the vendor's own Postman collection as the source of truth for paths, headers, and response shapes.

Not affiliated with, endorsed by, or sponsored by Sophos.

Scope: read-only, by design

This server implements no mutating endpoints at all — not behind a flag, not behind a deny-list, they simply aren't wired up. Excluded on purpose:

• Endpoint: isolate/un-isolate, tamper-protection changes, policy CRUD, scans, forensic logs/memory dumps, endpoint-group CRUD, migrations.

• Firewall: firmware upgrades, reboot/other firewall actions, firewall-group CRUD, MDR threat-feed indicator writes.

• Switch: MAC-filter list writes.

• Email: quarantine/post-delivery-quarantine release or delete, clawback initiation, mailbox create/update/delete/bulk, alias/delegate/distribution-list-owner writes, attachment strip/reattach/download.

If you need any of those, they're documented in Sophos's API but not implemented here — open an issue or add a tool following the same pattern in src/tools.ts.

Related MCP server: Sophos XGS MCP Server

Authentication

Sophos Central uses OAuth2 client-credentials. Create an API Credential in Sophos Central under Settings > API Credential Management, which gives you a Client ID and Client Secret scoped to one tenant (or an organization/partner account managing multiple tenants).

SOPHOS_CLIENT_ID=...
SOPHOS_CLIENT_SECRET=...

The server exchanges these for an access token (https://id.sophos.com/api/v2/oauth2/token), resolves the caller's tenant ID and data-region API host via whoami, and sends X-Tenant-ID (or X-Organization-ID/X-Partner-ID for those credential types) on every subsequent request. No tenant ID needs to be configured manually.

Install

npm ci && npm run build

Then point your MCP client at dist/entry.js:

{
  "mcpServers": {
    "sophos-central": {
      "command": "node",
      "args": ["/path/to/sophos-central-mcp/dist/entry.js"],
      "env": {
        "SOPHOS_CLIENT_ID": "...",
        "SOPHOS_CLIENT_SECRET": "..."
      }
    }
  }
}

Tools

Sophos's own API surface notes

• Switch API is currently narrow. The vendor's own Postman examples only cover MAC-filter settings and async task status — no separate switch-device inventory endpoint is documented there as of this writing.

• Endpoint restore/file-browsing and firewall traffic logs are not covered by this API surface at all; Sophos Central's console remains the place for those.