LimaCharlie MCP Server

A high-performance Model Context Protocol (MCP) server for LimaCharlie, enabling AI assistants like Claude to interact with your security infrastructure through natural language.

What is This?

This server bridges AI assistants and the LimaCharlie security platform through the Model Context Protocol. It allows Claude (and other MCP-compatible AI assistants) to:

• Query telemetry with natural language (translated to LCQL)
• Investigate endpoints in real-time (processes, network, files)
• Respond to threats (isolate hosts, tag sensors, task endpoints)
• Manage detections (D&R rules, YARA rules, false positives)
• Administer platforms (outputs, integrations, configurations)
• Generate security content with AI (rules, queries, playbooks)

LimaCharlie is a Security Infrastructure as a Service (SIaaS) platform providing EDR, XDR, SIEM capabilities through a unified API. This MCP server makes that API accessible to AI assistants.

Features

• 121 MCP Tools across 8 specialized profiles
• Multi-Tenant Architecture with strict credential isolation
• Dual Transport Modes: STDIO (local) and HTTP (cloud with OAuth 2.1)
• AI-Powered Generation: Automatic rule and query creation using Google Gemini
• Production-Ready: Thread-safe SDK caching, graceful shutdown, health checks
• Secure by Design: Context-based auth, SHA-256 cache keys, UID validation
• High Performance: Single ~55MB binary, sub-second cold starts
• Flexible Authentication: API keys, JWT tokens, OAuth 2.1 with PKCE

Quick Start

# 1. Build the server
go build -o lc-mcp-server ./cmd/server

# 2. Set your credentials
export LC_OID="your-organization-id"
export LC_API_KEY="your-api-key"

# 3. Run the server
./lc-mcp-server

Running with Claude Code (STDIO Mode)

Claude Code can connect to this server locally using STDIO transport. This is the recommended method for development and personal use.

Step 1: Build the Server

cd /path/to/lc-mcp-server
go build -o lc-mcp-server ./cmd/server

Step 2: Configure Claude Code

Edit your Claude Code MCP settings file (usually at ~/.config/claude-code/mcp.json):

{
  "mcpServers": {
    "limacharlie": {
      "command": "/absolute/path/to/lc-mcp-server",
      "args": [],
      "env": {
        "LC_OID": "your-organization-id",
        "LC_API_KEY": "your-api-key",
        "MCP_MODE": "stdio",
        "MCP_PROFILE": "all",
        "LOG_LEVEL": "info"
      }
    }
  }
}

Step 3: Restart Claude Code

Restart Claude Code to load the MCP server. You can verify it's working by asking:

"Can you list my online sensors?"

Claude will use the list_sensors or get_online_sensors tool to query your LimaCharlie organization.

Profile-Specific Configuration

You can configure multiple MCP server instances with different profiles:

{
  "mcpServers": {
    "limacharlie-investigate": {
      "command": "/path/to/lc-mcp-server",
      "args": [],
      "env": {
        "LC_OID": "your-org-id",
        "LC_API_KEY": "your-api-key",
        "MCP_MODE": "stdio",
        "MCP_PROFILE": "live_investigation",
        "LOG_LEVEL": "warn"
      }
    },
    "limacharlie-detect": {
      "command": "/path/to/lc-mcp-server",
      "args": [],
      "env": {
        "LC_OID": "your-org-id",
        "LC_API_KEY": "your-api-key",
        "MCP_MODE": "stdio",
        "MCP_PROFILE": "detection_engineering",
        "LOG_LEVEL": "warn"
      }
    }
  }
}

Tool Profiles

The server organizes tools into profiles for different use cases:

| Profile | Tool

... View full README on GitHub