eset-mcp — Claude Code MCP server: what it does, how to install
Connects ESET Connect cloud regions and PROTECT On-Prem instances to AI assistants. Brings threat hunting and device management into your agent workflow.
claude mcp add eset-mcp -- docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3What eset-mcp does
The server exposes ESET management APIs to your coding agent. It bundles 102 individual endpoints generated from official OpenAPI specifications alongside four high-level composite tools: eset_search, device_full_profile, incident_full_context, and latest_detections. They aggregate telemetry across multiple raw endpoints.
Deployments can target cloud regions like eu or us, as well as on-premise PROTECT consoles behind Cloudflare Access tunnels. Docker is required here. Without a running Docker daemon, the ghcr.io/maciekaz/eset-mcp:1.0.3 image will not launch.
Operational safety relies on the ESET_MODE flag. Setting it to RO limits the catalog to 51 read-only tools. Switching to RW exposes the entire set of 106 tools with destructive hints enabled.
What it helps with
- inspect threat detections recorded by ESET Inspect
- retrieve workstation posture using
device_full_profile - query on-prem ESET PROTECT instances behind Cloudflare Access
- enforce read-only safety using
ESET_MODE=RO
Example prompts for the agent
- Fetch the full context for incident ID 5920
- Pull the latest security detections from our ESET tenant
- Inspect workstation status with
device_full_profile
How to install eset-mcp
Platform CLI
claude mcp add eset-mcp -- docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3Platform CLI
codex mcp add eset-mcp -- docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3Config file
{
"mcpServers": {
"eset-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/maciekaz/eset-mcp:1.0.3"
]
}
}
}Config file
{
"servers": {
"eset-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/maciekaz/eset-mcp:1.0.3"
]
}
}
}Platform CLI
gemini mcp add eset-mcp docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about eset-mcp
How to install eset-mcp in Claude Code?
Run claude mcp add eset-mcp -- docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3. Ensure Docker is installed and running on your system.
What does eset-mcp do?
It connects ESET Connect cloud and on-premise consoles to MCP-compatible AI hosts. Agents can query assets, review incidents, and execute management tasks.
What is the difference between RO and RW modes?
Setting ESET_MODE=RO restricts the exposed tool list to 51 inspection tools. The RW setting unlocks all 106 operations, marking mutating actions as destructive.
