# Sophos Central MCP

Wires your agent into the Sophos Central partner, organization and tenant APIs and picks the right tenant and region on its own.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 62
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/sophos-central
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/sophos-central-mcp

## What it does

The server exposes Sophos Central's APIs to an agent and routes each call to the correct tenant and region. On top of that it adds a triage queue spanning tenants, tamper cleanup across the fleet, a SIEM collector and hostname-based containment. It runs on your own machine and needs no code.

The installer puts two binaries in your user bin path: `sophos-central-cli` and `sophos-central-mcp`. Claude, Codex and Cowork pick up the skill from `SKILL.md` in that directory. Check the install with `sophos-central-cli --version`.

Do not start HTTP mode (`--transport http`), not even on localhost. This build validates a token, yet it has no cap on request size or response time. Stay on stdio, and tear down any tunnel you opened for a remote agent. The MCP tools also change settings using your credentials, so hand them the narrowest access you can.

## Requirements
- Environment variables: `SOPHOS_CENTRAL_CLIENT_ID`, `SOPHOS_CENTRAL_CLIENT_SECRET`, `SOPHOS_CENTRAL_TENANT_ID`, `SOPHOS_CENTRAL_BASE_URL`, `SOPHOS_CENTRAL_TOKEN_URL`, `SOPHOS_CENTRAL_OAUTH_SCOPE`, `SOPHOS_CENTRAL_MCP_READ_ONLY`, `SOPHOS_CENTRAL_MCP_HTTP_TOKEN`, `SOPHOS_CENTRAL_USER_AGENT`, `PRINTING_PRESS_CLIENT_PROFILE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- route Sophos Central calls to the right tenant and region
- pull incidents from every tenant into one triage queue
- clear tamper events across the machine fleet
- contain a host by hostname
- feed Sophos Central events into a SIEM

## Example prompts
- Show me Sophos Central incidents across all tenants from the last day
- Contain host `WS-014` in the client's tenant
- Collect Sophos Central events into the SIEM

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 32 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md