MCP Server
The platform ships a Model Context Protocol (MCP) server that presents its capabilities as typed tools an AI client can call directly. This is the surface behind the company's current positioning of a headless SIEM: rather than an analyst driving screens, an AI client drives the product — searching the data lake, reading configuration, running reports, and delivering results — while the interface becomes one client among several. This page documents what the server exposes, how to connect to it, how permissions apply, and what the tool surface covers.
Tool inventory
The table below inventories the categories of capability the MCP surface provides. Exact tool names, argument schemas, and return shapes are deliberately not reproduced here — they change with the server, so read them from your own connection rather than from this page. Most MCP clients list the available tools and their schemas as soon as they connect. Treat this table as a map, not a contract.
| Category | Capabilities | Related documentation |
|---|---|---|
| Data lake search | Run a KQL query against an index; validate a KQL query without executing it. | KQL |
| Data tables | List the data tables and indexes available to the account. | Data Lake → Management, Schemas |
| Connector management | List connectors; retrieve a connector; create a connector; delete a connector; list the available connector templates. | Integrations, Platform → Integrations |
| Integrations | List the configured integrations. | Platform → Integrations |
| Reports | List reports; execute a report; check the state of a report run; retrieve a completed report's results. | Reports, Reports → Processors |
| Audit search | Search the account's audit records. | Audit, What is an Audit Log |
| Notification endpoints | List notification endpoints; add an endpoint; update an endpoint; delete an endpoint. | Notifications |
| Assumed roles | List assumed roles; retrieve one; add one; test one; delete one. Used for cross-account access to cloud data sources. | AWS integrations |
| Metrics | Prometheus-style instant and range queries over platform metrics. | Metrics, Usage |
| Messaging | Send email; upload an attachment for inclusion in a message. | Alerts & Actions |
| Account context | Retrieve account-level context such as the account's pod role and directory user records. | Users and Roles |
Related
- KQL — the query language the search tools accept