Lumu MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LUMU_DEFENDER_API_KEY | Yes | Your Lumu Defender API key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| health_checkA | Check the health status of the server |
| get_incidentsC | Retrieve security incidents from Lumu Defender API with pagination support |
| get_incident_detailsC | Get detailed information about a specific security incident |
| get_incident_contextB | Get context information for a specific security incident |
| comment_incidentB | Add a comment to a specific security incident |
| get_open_incidentsA | Retrieve open security incidents from Lumu Defender with pagination support |
| get_muted_incidentsB | Retrieve muted security incidents from Lumu Defender with pagination support |
| get_closed_incidentsC | Retrieve closed security incidents from Lumu Defender with pagination support |
| get_incident_endpointsC | Retrieve endpoints and contacts for a specific security incident |
| mark_incident_as_readB | Mark a security incident as read |
| mute_incidentB | Mute a security incident |
| unmute_incidentC | Unmute a security incident |
| get_incident_updatesB | Get real-time updates on incident operations |
| close_incidentB | Close a security incident |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Each tool targets a distinct aspect of incident management (e.g., close, comment, get details, mute) with no overlap. Even similar tools like get_incident_details and get_incident_context are clearly differentiated.
All tools follow the verb_noun pattern in snake_case (e.g., close_incident, get_open_incidents). health_check is a slight deviation but is a standard term and fits naturally.
14 tools cover the full range of incident operations without being excessive. Each tool serves a clear purpose, and the count is well-suited for a security incident management server.
The set covers retrieval, query by status, muting, closing, commenting, and health checks. Missing an explicit reopen or update incident details tool, but core workflow is complete.