blackpoint-mcp

Model Context Protocol (MCP) server for Blackpoint Cyber CompassOne - Managed Detection and Response (MDR) platform.

Features

This MCP server provides access to CompassOne's security capabilities through a decision-tree navigation interface:

Available Domains

• 🏢 Tenants: Customer tenant management
• 💻 Assets: Endpoint and server inventory (endpoint, server, network, cloud, mobile, iot)
• 🔍 Detections: Security detections and telemetry
• 🛡️ Vulnerabilities: Vulnerability management, dark web monitoring, external exposure scanning

Domain Structure

The server uses decision-tree navigation to organize tools:

1. Initial State: Navigation tools only (blackpoint_navigate, blackpoint_status)
2. Domain Entry: Navigate to a domain to see its specific tools
3. Domain Tools: Use domain-specific operations
4. Return: Use blackpoint_back to return to navigation

Tool Naming Convention

All tools follow the pattern: blackpoint_{domain}_{action}

Examples:

• blackpoint_assets_list - List assets by class
• blackpoint_detections_list - List security detections
• blackpoint_vulnerabilities_scans_list - List vulnerability scans

Installation

npm install blackpoint-mcp

Configuration

Environment Variables

Gateway Mode

When AUTH_MODE=gateway, the server reads credentials from HTTP headers:

• X-Blackpoint-API-Token → BLACKPOINT_API_TOKEN

This enables per-request authentication for multi-tenant gateways.

Usage

Standalone Mode (stdio)

# Set credentials
export BLACKPOINT_API_TOKEN="your-api-token"

# Run the server
blackpoint-mcp

Gateway Mode (HTTP)

export AUTH_MODE=gateway
export MCP_TRANSPORT=http
export MCP_HTTP_PORT=8080

blackpoint-mcp

Example Tool Calls

// Start by checking available domains
await tools.call("blackpoint_status");

// Navigate to assets domain
await tools.call("blackpoint_navigate", { domain: "assets" });

// List endpoint assets
await tools.call("blackpoint_assets_list", { 
  class: "endpoint",
  pageSize: 10 
});

// Get specific asset details
await tools.call("blackpoint_assets_get", { 
  id: "asset_12345" 
});

// Return to navigation
await tools.call("blackpoint_back");

API Coverage

✅ Implemented

📋 Planned

Partner vs Tenant Scoping

CompassOne uses hierarchical scoping: Partner → Tenants → Assets

• Partner tokens can access all associated tenants
• Tenant-scoped tokens are limited to specific customers
• Always specify tenantId parameters to avoid c

... View full README on GitHub