Sophos Central MCP

{
  "version": "0.1.4",
  "transport": "stdio",
  "fileSha256": "ee8bceb04e5903b7ca46332cecd0407c9790b3e485cc8fa4dcf82c9423d77926",
  "identifier": "https://github.com/Servosity/msp-skills/releases/download/sophos-central-v0.1.4/sophos-central-mcp.mcpb",
  "registryType": "mcpb",
  "environmentVariables": [
    {
      "name": "SOPHOS_CENTRAL_CLIENT_ID",
      "isRequired": true,
      "description": "Client ID of a Sophos Central API credential (Partner Dashboard > Settings & Policies > API Credentials, or Global Settings > API Credentials Management)."
    },
    {
      "name": "SOPHOS_CENTRAL_CLIENT_SECRET",
      "isRequired": true,
      "description": "Client secret of that API credential. Sophos shows it only once, when the credential is created."
    },
    {
      "name": "SOPHOS_CENTRAL_TENANT_ID",
      "description": "Optional. With a partner or organization credential, the customer tenant ID that tenant-scoped tools act on. Leave blank to let the fleet tools walk every customer; tools that take a tenant argument can still pick one per call."
    },
    {
      "name": "SOPHOS_CENTRAL_BASE_URL",
      "description": "Optional. Leave blank: requests go to https://api.central.sophos.com and each tenant's regional host is found automatically."
    },
    {
      "name": "SOPHOS_CENTRAL_TOKEN_URL",
      "description": "Optional. Leave blank to use https://id.sophos.com/api/v2/oauth2/token."
    },
    {
      "name": "SOPHOS_CENTRAL_OAUTH_SCOPE",
      "description": "Optional. Leave blank to use the scope Sophos Central documents (token)."
    },
    {
      "name": "SOPHOS_CENTRAL_MCP_READ_ONLY",
      "default": "1",
      "description": "Optional. Set to 1 to make the MCP server refuse every non-GET call and hide the sync and export tools. It does not replace giving the API credential a read-only role."
    },
    {
      "name": "SOPHOS_CENTRAL_NO_LOCAL_DATA",
      "description": "Optional. Set to 1 to keep no local copy of API responses: reads go to the API, the response cache is off, and sync and fleet refresh refuse to run. Leave blank to keep the local store."
    },
    {
      "name": "SOPHOS_CENTRAL_MCP_HTTP_TOKEN",
      "description": "Required only when running the MCP server with --transport http (a remote or hosted deployment); callers must send a matching Authorization: Bearer header. Not needed for the default local stdio transport Claude Desktop uses."
    },
    {
      "name": "SOPHOS_CENTRAL_USER_AGENT",
      "description": "Optional. Overrides the User-Agent the CLI sends to Sophos Central. Leave blank to use the built-in one."
    },
    {
      "name": "PRINTING_PRESS_CLIENT_PROFILE",
      "description": "Only used when the MCP server is bound to a tenant-gated client profile. This connector registers no tenant-gated source, so leave it blank."
    }
  ]
}