MCP Server

The platform ships a Model Context Protocol (MCP) server, named ingext, that presents its capabilities as typed tools an AI client can call directly. This is the surface behind the headless SIEM: rather than an analyst driving screens, an AI client drives the product (searching the datalake, reading behavior summaries, running reports, installing connectors, and delivering results), and the web interface becomes one client among several.

This page covers connecting a client, what a connected client is allowed to do, and the tools grouped by purpose. Every tool, with its parameters, is on MCP Tool Reference.

Permissions and audit

Every tool call runs through the same role-based access checks and audit trail as the Ingext API, and is scoped to the account the client connected to. What a client can see and do depends on how it authenticated:

• OAuth sign-in: calls run as the user who signed in, with that user's roles.
• API token: calls carry the roles, data policies, and API policies attached to the token. Give a token used by an AI client only the roles it needs; see API Tokens.

MCP activity is recorded in the account's audit log, on Admin console → Audit Logs (v1: Settings → Management → Audit). A client's sign-in through the MCP OAuth server appears as an mcp.oauth.token action. See Audit.

Each tool carries one of three effect labels, so you can decide which calls a person should confirm before the client runs them:

Effect	Meaning	Tools
Read	No side effects.	41
Write	Creates, changes, runs, or sends something.	10
Delete	Removes something permanently.	3

Connecting a client

The server is served at /mcp on your Ingext host (the host you sign in at, which on a standard deployment is <companyname>.app.ingext.io):

https://<your-ingext-host>/mcp

The server speaks MCP over Streamable HTTP. A client authenticates in one of two ways: by signing in through the server's built-in OAuth server, or by presenting an Ingext API token as a bearer credential.

Claude (custom connector)

1. In Claude, open Settings → Connectors and choose Add custom connector.
2. Give the connector a name, enter https://<your-ingext-host>/mcp as its URL, and add it.
3. Choose Connect. Claude opens the Ingext sign-in page, served by the built-in OAuth server at /mcp/oauth. Sign in as you normally do, including through your SSO provider.

Once connected, Claude lists the Ingext tools, and every call runs as the user who signed in.

Claude Code

Claude Code authenticates with an Ingext API token. Create one on Admin console → API Tokens (v1: Settings → Advanced → Permissions, on the API Tokens tab), with the roles the client should have; the value is shown only once, at creation. See API Tokens.

Then add the server over Streamable HTTP, with the token as the bearer:

claude mcp add --transport http ingext \
  https://<your-ingext-host>/mcp \
  --header "Authorization: Bearer <token>"

This is the same API token the REST API accepts in its Fluencytoken header; here it goes in a standard Authorization: Bearer header. Run claude mcp list to confirm the server connects, or /mcp inside a Claude Code session to see its status and tools.

Other MCP clients

Any client that supports Streamable HTTP connects to the same URL, either through the OAuth sign-in or with an API token in the Authorization: Bearer header, whichever the client supports.

Common call sequences

Most tasks are a short chain of calls: discover what exists, check the input, then act. A client works these out from the tool descriptions, but they are also the quickest way to read the tool list.

Task	Call sequence
Query the datalake	list_data_tables → validate_kql → kql_search
Run a report	list_reports → run_report → get_report_task → get_report_result
Assemble a month from a report's archive	list_report_archive → backfill_report_archive (only if days are missing) → download_report_archive
Install a connector	list_connector_templates → create_connector → get_connector
Query Azure Log Analytics	azure_logs_list_tables → azure_logs_get_schema → azure_logs_validate → azure_logs_search
Send an email with an attachment	upload_attachment → send_email

Tool groups

The server's 54 tools fall into eleven groups. Each tool name links to its entry, with parameters, on MCP Tool Reference.

Group	Tools	Related documentation
Discover data: what can be queried	list_data_tables, list_entity_tables, lake_search_list_index, list_integrations	Data Lakes, Entity Tables (v1: Data Lake → Management, EntityInfo Tables)
Search & query: the datalake, assets, and the audit log	validate_kql, kql_search, lake_search, asset_search, audit_search	KQL, Search, Audit
Behavior & detection: summaries, events, and eventwatch rules	behavior_summary_search, behavior_event_search, eventwatch_rule_list, eventwatch_rule_get, eventwatch_rule_test, investigate_sentinelone_alert	Investigate, Managing Rules
Azure & Microsoft 365: Log Analytics and Azure AD users	azure_logs_list_tables, azure_logs_get_schema, azure_logs_validate, azure_logs_search, get_azure_user_record	Office 365 ResourceWatch
Reports: FPL report processors and the scheduled-report archive	list_reports, run_report, get_report_task, get_report_result, list_report_archive, download_report_archive, backfill_report_archive	Reports, Scheduling and Delivery, Reports → FPL Reports (v1: Reports → Processors)
Usage & metrics: the billing ledger and platform metrics	usage_daily, usage_attempts, usage_sink_classification, prom_query, prom_query_range	Usage Report (v1: Platform → Usage), Metrics
Connectors: applications installed from templates	list_connector_templates, list_connectors, get_connector, create_connector, delete_connector	Integrations, Applications (v1: Platform → Applications)
AWS assumed roles: cross-account access for AWS sources	get_account_podrole, list_assumed_role, get_assumed_role, test_assumed_role, add_assumed_role, delete_assumed_role	Connecting to AWS
Notifications & email: endpoints and outbound mail	list_notification_endpoint, add_notification_endpoint, update_notification_endpoint, delete_notification_endpoint, upload_attachment, send_email	Notifications (v1: Notifications), Alerts & Actions
Syslog listeners: the platform's syslog endpoint	syslog_get_config, syslog_register_config, syslog_update_config	Syslog Ports
Resource dumps: bulk inventory downloads	list_resource_dumps, get_resource_dump_url	Resources (v1: SIEM → Resources)

Related

• MCP Tool Reference: every tool, its effect, and its parameters
• KQL: the query language the search tools accept
• REST API: the HTTP interface behind the web application
• Audit: where MCP sign-ins and activity are recorded