# eset-mcp

Connects ESET Connect cloud regions and PROTECT On-Prem instances to AI assistants. Brings threat hunting and device management into your agent workflow.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: maciekaz
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/maciekaz/ESET-MCP
- Updated: 2026-08-17
- HTML: https://affpapa.org/en/nevibecode/mcp/eset-mcp

## What it does

The server exposes ESET management APIs to your coding agent. It bundles 102 individual endpoints generated from official OpenAPI specifications alongside four high-level composite tools: `eset_search`, `device_full_profile`, `incident_full_context`, and `latest_detections`. They aggregate telemetry across multiple raw endpoints.

Deployments can target cloud regions like `eu` or `us`, as well as on-premise PROTECT consoles behind Cloudflare Access tunnels. Docker is required here. Without a running Docker daemon, the `ghcr.io/maciekaz/eset-mcp:1.0.3` image will not launch.

Operational safety relies on the `ESET_MODE` flag. Setting it to `RO` limits the catalog to 51 read-only tools. Switching to `RW` exposes the entire set of 106 tools with destructive hints enabled.

## Requirements
- Needs: Docker

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add eset-mcp -- docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3
```

### Codex

**Platform CLI**
```bash
codex mcp add eset-mcp -- docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "eset-mcp": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/maciekaz/eset-mcp:1.0.3"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "eset-mcp": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/maciekaz/eset-mcp:1.0.3"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add eset-mcp docker run -i --rm ghcr.io/maciekaz/eset-mcp:1.0.3
```

## When to use it
- inspect threat detections recorded by ESET Inspect
- retrieve workstation posture using `device_full_profile`
- query on-prem ESET PROTECT instances behind Cloudflare Access
- enforce read-only safety using `ESET_MODE=RO`

## Example prompts
- Fetch the full context for incident ID 5920
- Pull the latest security detections from our ESET tenant
- Inspect workstation status with `device_full_profile`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md