Sysdig MCP Server Integration

The Sysdig MCP Server bridges AI workflows and the Sysdig API, exposing tools, resources, and contextual data for informed AI-driven actions.

It enables AI clients to:

• Query Sysdig Secure for runtime security events
• Retrieve process trees and event metadata
• Generate and execute SysQL queries via natural language
• Invoke Sysdig CLI scanning tools (when supported)
• Tie together AI prompts, context, and Sysdig data to assist decision-making

It acts as an intermediary: clients speak MCP to your MCP server, which then calls the Sysdig APIs (or CLI) as needed to fulfill requests.

Features

The server currently supports the following capabilities:

Prerequisites

• Python 3.10+ (or as specified in the project)
• Access to a Sysdig Secure instance with an API token
• Network connectivity from the MCP server to Sysdig
• (Optional) Docker for deployment
• For native/host runs: dependencies listed in pyproject.toml

Development Setup

Using uv

You can use uv as a drop-in replacement for pip to create the virtual environment and install dependencies.

If you don’t have uv installed, follow the instructions on the uv project page.

To set up your local environment:

uv venv
source .venv/bin/activate

This creates a virtual environment using uv and installs the required dependencies.

Configuration

API Token

To authenticate with the Sysdig Secure platform, you’ll need a Sysdig Secure API token.

To get your API token:

1. Log in to your Sysdig Secure instance.
2. Navigate to Settings > User Profile > Sysdig Secure API.
3. Generate a new token or copy an existing one.

This token is required to authenticate requests from the MCP server to the Sysdig Secure backend.

Environment Variables

Example .env file:

    # Required Configuration
    SYSDIG_MCP_API_HOST=https://us2.app.sysdig.com
    SYSDIG_MCP_API_SECURE_TOKEN=your-api-token-here

    # Optional Configuration
    SYSDIG_MCP_TRANSPORT=stdio
    SYSDIG_MCP_LOGLEVEL=INFO
    SYSDIG_MCP_LISTENING_PORT=8080
    SYSDIG_MCP_LISTENING_HOST=localhost
    SYSDIG_MCP_MOUNT_PATH=/sysdig-mcp-server

API Permissions

The API token must have permissions for the tools being used.

Minimum Permissions Required

Additional recommended permissions:

• Settings: API Access Token (View, Read, Edit)

Assign Permissions

To assign these permissions to a user or service account, do the following:

1. Go to Settings > Access & Secrets | Roles in Sysdig Secure.
2. Create a role with the permissions listed in minimum permissions required.
3. Assign the role to a Service Account or user.
4. Use that account’s token with the MCP server.

Running the MCP Server

Docker Deployment (Recommended)

docker pull ghcr.io/sysdiglabs/sysdig-mcp-server:latest

docker run -e SYSDIG_MCP_API_HOST=<your_sysdig_host> \
    -e SYSDIG_MCP_API_SECURE_TOKEN=<your_sysdig_secure_api_token> \
    -e SYSDIG_MCP_TRANSPORT=stdio \
    -p 8080:8080 \
    ghcr.io/sysdiglabs/sysdig-mcp-server:latest

For HTTP/SSE Transports

docker run -e SYSDIG_MCP_TRANSPORT=streamable-http \
    -e SYSDIG_MCP_API_HOST=<your_sysdig_host> \
    -e SYSDIG_MCP_API_SECURE_TOKEN=<your_sysdig_secure_api_token> \
    -p 8080:8080 \
    ghcr.io/sysdiglabs/sysdig-mcp-server:latest

Client Configuration

Authentication

When using sse or streamable-http transport, the server expects a Bearer token in the HTTP header.

Example headers:

Authorization: Bearer <your_sysdig_secure_api_token>
X-Sysdig-Host: <your_sysdig_host>

If X-Sysdig-Host is not provided, the server uses the host from SYSDIG_MCP_API_HOST.

URL

HTTP/SSE transports:

http://<host>:<port>/sysdig-mcp-server/mcp

Example:

http://localhost:8080/sysdig-mcp-server/mcp

Claude Desktop App

To configure the Claude Desktop app manually, do the following:

1. Go to Settings > Developer > Edit Config.
2. Add the MCP configuration under mcpServers:

   {
       "mcpServers": {
       "sysdig-mcp-server": {
           "command": "docker",
           "args": [
           "run",
           "-i",
           "--rm",
           "-e",
           "SYSDIG_MCP_API_HOST",
           "-e",
           "SYSDIG_MCP_TRANSPORT",
           "-e",
           "SYSDIG_MCP_API_SECURE_TOKEN",
           "ghcr.io/sysdiglabs/sysdig-mcp-server"
           ],
           "env": {
           "SYSDIG_MCP_API_HOST": "<your_sysdig_host>",
           "SYSDIG_MCP_API_SECURE_TOKEN": "<your_sysdig_secure_api_token>",
           "SYSDIG_MCP_TRANSPORT": "stdio"
           }
       }
       }
   }
   

3. Replace placeholders (<your_sysdig_host>, <your_sysdig_secure_api_token>).
4. Save and restart Claude Desktop.

MCP Inspector

1. Run MCP Inspector locally.
2. Select the appropriate transport type and start your MCP server.
3. Pass authentication headers (for HTTP/SSE) or environment variables (for stdio).

Goose Agent

1. Run goose configure and follow the steps to add the Sysdig MCP extension.
2. Example ~/.config/goose/config.yaml snippet:

   extensions:
       sysdig-mcp-server:
       cmd: sysdig-mcp-server
       description: Sysdig MCP server
       enabled: true
       envs:
           SYSDIG_MCP_TRANSPORT: stdio
       env_keys:
           - SYSDIG_MCP_API_HOST
           - SYSDIG_MCP_API_SECURE_TOKEN
           - SYSDIG_MCP_TRANSPORT
       timeout: 300
       type: stdio
   

Examples and Use Cases

Security Considerations