Juno MCP Server

MCP server for Uptycs Juno — the AI-powered security assistant.

Connect Juno to any MCP-compatible client to investigate threats, analyze findings, and manage security investigations.

What you can do

• Investigate threats — "Are there any privilege escalation attempts in the last 24 hours?"

• Follow up — "What user accounts were involved in the lateral movement?"

• Scope investigations — Target specific connectors, time ranges, and personas

• Manage investigations — List, create, and delete investigations

• Reuse playbooks — Save an investigation brief once, then launch it on demand with per-run values

• Browse connectors — See which external integrations (GitHub, Splunk, AWS, etc.) are configured

• Share — Publish investigation runs for others to see

Related MCP server: Purple AI MCP Server

How it works

flowchart LR
    Client["MCP Client"]
    Server["juno-mcp-server"]

    subgraph UptycsJuno["Uptycs Juno"]
        Juno["AI Assistant"]
        Connectors["Connectors<br/>(GitHub, Splunk, …)"]
        Juno -. "calls during investigation" .-> Connectors
    end

    Client -- "tool calls" --> Server
    Server -- "responses" --> Client
    Server -- "HTTPS + JWT auth" --> Juno
    Juno -- "findings, recommendations, summaries" --> Server

    style Client fill:#4a90d9,stroke:#2c5f8a,color:#fff
    style Server fill:#2ecc71,stroke:#1a9c54,color:#fff
    style Juno fill:#e74c3c,stroke:#c0392b,color:#fff
    style Connectors fill:#e74c3c,stroke:#c0392b,color:#fff

1. The MCP client discovers available Juno tools via the MCP protocol

2. When a tool is called, the server authenticates with your Uptycs API key (JWT) and calls the Juno API

3. Juno processes the request and returns findings, summaries, and recommendations back through the server

Prerequisites

• Python 3.11+

• uv package manager

• An Uptycs account with Juno enabled

• An Uptycs API key (how to create one)

Installation

git clone https://github.com/uptycslabs/juno-mcp-server.git
cd juno-mcp-server

API key

Download your API key JSON file from the Uptycs console (Configuration > API Keys):

{
  "key": "YOUR_API_KEY",
  "secret": "YOUR_API_SECRET",
  "customerId": "YOUR_CUSTOMER_ID",
  "domain": "your-domain",
  "domainSuffix": ".uptycs.net"
}

Configure your MCP client

Add the following to your MCP client configuration. Example for Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "juno": {
      "command": "uv",
      "args": ["--directory", "/path/to/juno-mcp-server", "run", "juno-mcp"],
      "env": {
        "UPTYCS_API_KEY_FILE": "/path/to/apikey.json"
      }
    }
  }
}

Restart your MCP client. You should see Juno tools available.

Tools

Investigations

Runs & Follow-ups

Sharing

Playbooks

Connectors

Environment variables

Blocking mode

By default, create_investigation and create_follow_up return immediately with a pending run, and the client must poll get_run until the run completes.

With blocking mode enabled, these calls wait internally until the investigation completes and return the full results directly — no polling required.

{
  "mcpServers": {
    "juno": {
      "command": "uv",
      "args": ["--directory", "/path/to/juno-mcp-server", "run", "juno-mcp"],
      "env": {
        "UPTYCS_API_KEY_FILE": "/path/to/apikey.json",
        "JUNO_MCP_BLOCKING": "true"
      }
    }
  }
}

Note: Investigations can take several minutes to complete. In blocking mode, the tool call will wait until done.

License

Copyright Uptycs, Inc. All rights reserved.