nh4ttruong/secobserve-mcp

*MCP server for SecObserve — Triage, import and administration from an agent*
Tools • Install • Configure • Register with a client • Design
secobserve-mcp exposes the SecObserve REST API to an LLM agent over the Model Context Protocol: browse and triage observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, generate VEX documents. Transport is stdio by default. Listed in the official MCP Registry as io.github.nh4ttruong/secobserve-mcp.
Tools
18 tools, not one per endpoint. SecObserve has ~50 REST resources and ~40 named actions; registering a tool for each would cost more context than the data ever returns, so the API is modelled as **data** and the tools are the interface to it.
| Tool | Purpose |
| --- | --- |
| secobserve_list_resources | The catalogue: every resource, its verbs, its actions. Makes no API call, so it is free to call first. |
| secobserve_describe_resource | Exact filters, fields and enums, read from the running instance's OpenAPI schema. |
| secobserve_list / _get | Read, with filters, sorting, pagination and projection. |
| secobserve_create / _update / _delete | CRUD over any resource in the catalogue. |
| secobserve_call_action | The long tail: apply_rules, copy, simulate, license_overview, exports. |
| secobserve_assess_observation | Triage one finding. Writes an observation log, honours the approval workflow. |
| secobserve_bulk_assess_observations | The same assessment across up to 250 findings. |
| secobserve_approve_observation_log | Approve or reject pending assessments (four-eyes). |
| secobserve_product_metrics | Pre-aggregated counts: current, timeline, the delta between two dates, and how stale they are. |
| secobserve_upload_file | Import a scan report, SBOM or VEX document from disk. |
| secobserve_api_import | Pull findings through a stored API configuration. Blocks; a timeout reports the work as still running and where to watch it land. |
| secobserve_trigger_scan | Run SecObserve's built-in OSV or VulnerableCode scan. Same blocking behaviour. |
| secobserve_run_periodic_task | Trigger a background job, or list the registered ones. |
| secobserve_status | Version, health, public settings, queue statistics, PURL types. |
| secobserve_vex_document | Generate or revise a CSAF / OpenVEX / CycloneDX document. |
Prompts
Six prompts, for the work that is a sequence of calls rather than one. A prompt is fetched by name when someone picks it, so it costs nothing per session — unlike a tool schema, which is sent on every connection.
| Prompt | Purpose |
| --- | --- |
| triage-product | Work one product's open findings, highest severity and fix_available first, assessing each with evidence. |
| daily-changes | What changed since local midnight: new, parser-changed, resolved, human-assessed. |
| weekly-changes | The same feed over the past 7 days, broken down by day. |
| daily-report | Today's counts per product, what moved today, what is still open. |
| weekly-report | The same three parts over the past 7 days, for the report someone sends on. |
| monthly-report | A month's closing numbers and the month-over-month delta. |
Each one carries the caveats that decide whether the report is right: metrics cover the default branch only and answer 200 with every count at zero when the job has not run, no filter expresses a calendar month, and nothing in SecObserve is a due date or an SLA.
Install
uvx downloads and runs it without installing anything permanently. In VS Code: one-click install.
To put it on your PATH instead:
Once you have done that, uv tool owns the name: a bare uvx secobserve-mcp runs that pinned copy forever and never notices a newer release, so keep it current with uv tool upgrade secobserve-mcp.
The client configurations below therefore say uvx secobserve-mcp@latest, which revalidates against PyPI on each launch — once per client session, not once per command.