Content
# Tanium MCP Server
MCP (Model Context Protocol) server for Tanium endpoint management, compatible with Claude Desktop and Microsoft Copilot Studio.
## Features
### Endpoint Discovery
- Find endpoints by computer name, IP address, username, or installed software
- Get full endpoint details including installed software inventory
- List computer groups and their filter expressions
### Software Inventory
- Get fleet-wide version breakdown for any software
- Find all endpoints with a specific application installed
### Tanium Deploy (Software Packages)
- Browse Deploy software packages (Greenshot, PowerToys, etc.) with name filtering
- Deploy software to computer groups or specific endpoints by name
- Track deployment status and results
### Action Scripts (Tanium Interact)
- Browse and detail action script packages
- Run scripts against computer groups, specific endpoints, or individual machines by hostname
- Support for parameterized packages
- Stop running actions
### Direct Connect (Tanium Performance)
- Get live CPU performance data from an endpoint
- Get live running process list (PID, memory, user, command line)
- Get performance and security alerts with optional time range
- Terminate a process on an endpoint
## Supported URL Formats
```bash
# Just company name (maps to <company>-api.cloud.tanium.com)
mycompany
# With or without https://
https://mycompany-api.cloud.tanium.com
mycompany-api.cloud.tanium.com
# Full URL (as-is)
https://mycompany-api.cloud.tanium.com/plugin/products/gateway/graphql
```
## Usage
### Local Development
```bash
npm install
node src/server.js
```
### Docker
```bash
docker build -t tanium-mcp .
docker run -p 3000:3000 \
-e TANIUM_API_URL=mycompany \
-e TANIUM_API_TOKEN=token-... \
tanium-mcp
```
### Environment Variables
| Variable | Description | Default |
|----------|-------------|---------|
| `TANIUM_API_URL` | Tanium tenant name or full API URL | required |
| `TANIUM_API_TOKEN` | Tanium API token (stdio mode only) | — |
| `PORT` | HTTP server port | `3000` |
## Authentication
In HTTP mode the Tanium API token is passed per-request in the `Authorization` header — it is never stored server-side:
```
Authorization: Bearer <your-tanium-api-token>
```
In stdio mode (Claude Desktop Extension) the token is read from the `TANIUM_API_TOKEN` environment variable injected by Claude Desktop.
## Claude Desktop
Each user adds this to their `claude_desktop_config.json`:
**Windows** (`%APPDATA%\Claude\claude_desktop_config.json`):
```json
{
"mcpServers": {
"tanium": {
"command": "cmd.exe",
"args": ["/c", "npx", "-y", "mcp-remote", "https://<deployed-url>/mcp", "--header", "Authorization:Bearer <your-tanium-api-token>"]
}
}
}
```
**macOS/Linux** (`~/Library/Application Support/Claude/claude_desktop_config.json`):
```json
{
"mcpServers": {
"tanium": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://<deployed-url>/mcp", "--header", "Authorization:Bearer <your-tanium-api-token>"]
}
}
}
```
> **Windows note:** Node.js must be installed (`npx` is bundled with it). The `cmd.exe /c` wrapper is required because Claude Desktop spawns processes without shell expansion and `C:\Program Files\nodejs\` contains a space.
## Deployment
### Azure Container Apps
```bash
az containerapp up -n tanium-mcp --source .
```
## Tools
| Tool | Read/Write | Description |
|------|-----------|-------------|
| `tanium_list_sensors` | read | List/search sensors by name |
| `tanium_get_endpoints` | read | List endpoints with name, IP, manufacturer, model |
| `tanium_get_computer_groups` | read | List computer groups and filter expressions — use these as deploy targets |
| `tanium_find_endpoints_by_user` | read | Find endpoints by last logged-in username |
| `tanium_find_endpoints_by_software` | read | Find endpoints with a specific app installed |
| `tanium_find_endpoints_by_computer_name` | read | Find endpoints by hostname (partial match) |
| `tanium_find_endpoints_by_ip` | read | Find endpoints by IP address |
| `tanium_get_endpoint_details` | read | Full details for one endpoint including installed software |
| `tanium_list_packages` | read | List Tanium Deploy software packages with name filtering |
| `tanium_get_package_details` | read | Action script package commands and parameters |
| `tanium_get_software_versions` | read | Fleet-wide version breakdown for a software |
| `tanium_list_action_groups` | read | List action groups (permission scopes for script deployment) |
| `tanium_deploy_package` | **write** | Deploy software or run action scripts against groups or specific endpoints |
| `tanium_get_action_status` | read | Check status and results (completed/failed/running) of a deployment |
| `tanium_stop_action` | **write** | Stop a running action |
| `tanium_get_endpoint_performance` | read | Live CPU usage via Direct Connect |
| `tanium_get_endpoint_processes` | read | Live running processes via Direct Connect |
| `tanium_get_endpoint_alerts` | read | Performance/security alerts via Direct Connect (optional time range) |
| `tanium_terminate_process` | **write** | Kill a process on an endpoint via Direct Connect |
### `tanium_deploy_package` targeting
The tool supports two deployment backends:
**Tanium Deploy** (software packages — Greenshot, PowerToys, etc.):
```
softwarePackageId ID from tanium_list_packages
targetGroup Computer group name, e.g. "All Computers"
startTime / endTime Optional ISO 8601 window (defaults: now to +7 days)
```
**Tanium Actions** (scripts — run commands, patches, etc.):
```
packageId / packageName ID or name from tanium_get_package_details
endpointNames ["SC-PC-ABC123", "SC-PC-XYZ456"] (resolved to IDs)
endpointIds Tanium endpoint IDs from find/list tools
computerGroupName/Id Target a whole computer group
packageParams [{key: "$1", value: "..."}] for parameterized packages
actionGroupId/Name Permission scope override (default: "Default - All Computers")
```
## Evaluation
`eval.xml` contains verified Q&A pairs for testing agent performance against a live environment.
