Tanium Gateway MCP

A Node.js project that exposes the Tanium Gateway GraphQL API as a Model Context Protocol (MCP) server. MCP hosts such as Claude Desktop, Cursor, VS Code, and Gemini CLI can query Tanium asset, vulnerability, patch, and deployment information in natural language.

Feature Overview

The server uses stdio transport. The LLM calls tools through MCP, and the server makes the Tanium Gateway GraphQL request on its behalf.

MCP Host (Claude / Cursor / Gemini …)
        │  MCP (stdio)
        ▼
tanium-gateway-mcp
        │  GraphQL (session 헤더)
        ▼
Tanium Gateway (`/plugin/products/gateway/graphql`)

Related MCP server: Purple AI MCP Server

Requirements

• Node.js 18 or later (ES2022 / ESM)

• Gateway GraphQL endpoint in your Tanium environment

• API token (passed via the session header)

Installation

git clone <이 저장소 URL>
cd tanium-gateway-mcp_dev   # 또는 클론한 디렉터리 이름
npm install

Environment Variables

Create a .env file in the project root. Do not commit your token. .env is included in .gitignore.

TANIUM_BASE_URL=https://your-tanium-instance.example.com
TANIUM_GRAPHQL_PATH=/plugin/products/gateway/graphql
TANIUM_API_TOKEN=your-api-token

Depending on your on-premises version, the authentication header name may not be session. If you get a 401, check src/tanium-client.ts.

Build and Run

npm run build          # TypeScript → dist/
node dist/index.js     # stdio MCP 서버 (Host가 spawn하는 방식과 동일)

To run TypeScript directly during development:

npm run dev

To view the tool list in a GUI:

npm run inspect

(uses @modelcontextprotocol/inspector)

MCP Host Configuration Example (Cursor)

~/.cursor/mcp.json or project .cursor/mcp.json:

{
  "mcpServers": {
    "tanium-gateway": {
      "command": "node",
      "args": ["/절대경로/tanium-gateway-mcp_dev/dist/index.js"],
      "env": {
        "TANIUM_BASE_URL": "https://your-tanium-instance.example.com",
        "TANIUM_GRAPHQL_PATH": "/plugin/products/gateway/graphql",
        "TANIUM_API_TOKEN": "your-api-token"
      }
    }
  }
}

After configuring, run npm run build once, then reload the MCP server in Cursor.

For integration with other hosts such as Gemini CLI and VS Code Copilot, see docs/Gemini_MCP_Host_연동_가이드.md.

Tool List

Asset

Comply

Deploy

Discover

Integrity Monitor

Patch

Reporting

Threat Response

List-type queries use the Tanium Gateway common FieldFilter (path / op / value / any / filters). The syntax is also available in the MCP Resource tanium://docs/field-filter-syntax.

Prompts

Project Structure

src/
  index.ts                 # MCP 서버 엔트리 (stdio)
  tanium-client.ts         # GraphQL 클라이언트
  resources.ts             # MCP Resources
  prompts.ts               # MCP Prompts
  tools/                   # 모듈별 Tool
    asset.ts
    comply.ts
    deploy.ts
    discover.ts
    integrityMonitor.ts
    patch.ts
    reporting.ts
    threatResponse.ts
docs/
  Tanium_Gateway_MCP_구축_가이드.md

Before Uploading to GitHub

1. Do not commit .env. (Already in .gitignore)

2. If mcp.json or .cursor/mcp.json contains a real token, do not include it in the repository. Use placeholders only in examples.

3. dist/ and node_modules/ are not committed. They are generated by npm install and npm run build after cloning.

Known Limitations

The following areas are not currently queried by tools. See the Resource tanium://docs/known-limitations for details.

• Asset lifecycle/EOL dates, custom importance ratings

• Patch SLA, approval workflows, automatic rollback

• Separate module-wide features such as Self Service Portal, MDM, and Disk Encryption

License

If this repository has no license file, it is recommended to state the terms of use when uploading.