Prerequisites

• A Sysdig Secure account in a supported region
• An MCP-capable AI client, such as Claude Code, Cursor, OpenAI Codex, OpenCode, or Claude Desktop
• Network connectivity from your client to your region’s Sysdig endpoint
• A browser for the one-time OAuth sign-in

No API token is required for the hosted server.

Find Your Region’s URL

The hosted server lives at <region-url>/mcp/secure. Identify your region from the Sysdig UI URL you see in your browser when signed in to Sysdig Secure, then use the matching MCP Server URL in the registration steps below.

Register the Server in Claude Code

Run the following command, substituting your region’s MCP Server URL from the table above:

claude mcp add --transport http secure-mcp-server https://us2.app.sysdig.com/mcp/secure

Keep the server name as secure-mcp-server. The registration is saved automatically; there is no environment variable to set or persist. Add --scope user to make the registration available across all your projects, or use the default (local) for the current project only. Restart Claude Code if it was already running.

Authenticate

The first time a Sysdig tool or skill needs the server, run /mcp, select secure-mcp-server, and select Authenticate. Your browser opens for a one-time OAuth sign-in, and the session is then authenticated for the rest of your work.

Configure Other AI Clients

Every MCP-capable client can use the same hosted server: an HTTP MCP server at your region’s /mcp/secure URL, authenticated through OAuth. The exact steps differ per client (a config file, a settings panel, or a CLI command), but the essentials are identical:

• Transport: HTTP (streamable)
• Server name: secure-mcp-server
• URL: your region’s MCP Server URL, for example https://us2.app.sysdig.com/mcp/secure
• Authentication: OAuth, no token. The client drives the browser flow on first request.

For clients that follow the standard MCP server schema, use a configuration snippet like the following. Edit the URL to match your region:

{
  "mcpServers": {
    "secure-mcp-server": {
      "type": "http",
      "url": "https://us2.app.sysdig.com/mcp/secure"
    }
  }
}

Consult your client’s MCP documentation for the exact configuration-file location and reload procedure.

Verify the Connection

In Claude Code, run:

claude mcp list

You should see a secure-mcp-server row with the status connected. In a running session, /mcp opens the MCP status panel, which shows the authentication state for each server.

For an end-to-end check, ask the agent to call get_customer_settings. If it returns a JSON object describing your tenant’s settings, the server is reachable and authenticated.

Troubleshooting

Minimum Permissions Required

Additional recommended permissions:

• Settings: API Access Token (View, Read, Edit)

Assign Permissions

To assign these permissions to a user or service account, do the following:

1. Go to Settings > Access & Secrets | Roles in Sysdig Secure.
2. Create a role with the permissions listed in Minimum Permissions Required.
3. Assign the role to a service account or user.
4. Use that account when authenticating to the MCP server.