Sysdig MCP Server

[!IMPORTANT] Breaking change — this MCP server now focuses on Sysdig Monitor.

Starting with the next major release, the dedicated Sysdig Secure tools (list_runtime_events, get_event_info, get_event_process_tree) have been removed from this server. For Sysdig Secure use cases, install the new @sysdig/secure-mcp-server package, which provides comprehensive coverage of Sysdig Secure capabilities.

The SysQL tools (generate_sysql, run_sysql) remain available here because they can be used against both Monitor and Secure datasets.

Table of contents

• Sysdig MCP Server
  • Table of contents
  • Description
  • Quickstart Guide
  • Available Tools
  • Requirements
  • Configuration
    • API Permissions
  • Server Setup
    • Go
    • Docker
    • Binary
    • Kubernetes
  • Client Configuration
    • Authentication
    • URL
    • Claude Desktop App
    • MCP Inspector
    • Goose Agent

Description

This is an implementation of an MCP (Model Context Protocol) Server that exposes Sysdig Monitor capabilities to LLMs, plus the cross-cutting SysQL tooling. New tools and functionalities will be added over time following semantic versioning. The goal is to provide a simple and easy-to-use interface for querying information from the Sysdig platform using LLMs.

For Sysdig Secure-specific workflows, use the dedicated @sysdig/secure-mcp-server.

Quickstart Guide

Get up and running with the Sysdig MCP Server quickly using our pre-built Docker image.

1. Get your API Token: Go to your Sysdig instance and navigate to Settings > Sysdig Monitor API (or Sysdig Secure API — either works, since SysQL tools accept both). This token is required to authenticate requests to the Sysdig Platform (See the Configuration section for more details).

2. Configure your MCP client:

   Add the server configuration to your MCP client (e.g., Claude Desktop's claude_desktop_config.json). Choose your preferred installation method from the Server Setup section. The Docker method is the easiest to get started with since it requires no local toolchain.

   Substitute the following placeholders with your actual values:

   • <your_sysdig_host>: The hostname of your Sysdig instance (e.g., https://us2.app.sysdig.com or https://eu1.app.sysdig.com)
   • <your_sysdig_api_token>: Your Sysdig API token (Secure or Monitor)

Available Tools

The server dynamically filters the available tools based on the permissions associated with the API token used for the request. If the token lacks the required permissions for a tool, that tool will not be listed.

Sysdig Monitor

• k8s_list_clusters

  • Description: Lists the cluster information for all clusters or just the cluster specified.
  • Required Permission: metrics-data.read
  • Sample Prompt: "List all kubernetes clusters" or "Show me info for cluster 'production-gke'"

• k8s_list_nodes

  • Description: Lists the node information for all nodes, all nodes from a cluster or just the node specified.
  • Required Permission: metrics-data.read
  • Sample Prompt: "List all kubernetes nodes in the cluster 'production-gke'" or "Show me info for node 'node-123'"

• **`

... View full README on GitHub