sophos-central-mcp-server 0.1.10 → 0.2.1

package/README.md

@@ -1,6 +1,6 @@
 # Sophos Central MCP Server
 
-MCP (Model Context Protocol) server for interacting with Sophos Central APIs. Supports partner, organisation, and single-tenant credential types with automatic region routing.
+MCP (Model Context Protocol) server for interacting with Sophos Central APIs. Supports partner, organisation, and single-tenant credential types with automatic region routing. **266 tools** covering 14 Sophos API namespaces.
 
 ## Quick Start
 
@@ -50,6 +50,7 @@ claude mcp add sophos-central \
 - **Token lifecycle**: Automatic OAuth2 token refresh before expiry
 - **Rate limit handling**: Retry with backoff on 429 responses
 - **Dual transport**: Streamable HTTP (for Claude Desktop / Claude Code) or stdio
+- **Full API coverage**: 266 tools across endpoints, alerts, policies, firewalls, email, mobile, XDR, cases, SIEM, and more
 
 ## Prerequisites
 
@@ -85,166 +86,396 @@ TRANSPORT=http
 
 ## Tools
 
-### Partner Sales & Advisory
+### Partner & Organisation (18 tools)
 
-> These tools are only available with **partner or organisation-level** credentials. They operate across all managed tenants in a single call.
+> These tools are only available with **partner or organisation-level** credentials. They operate across all managed tenants.
 
 | Tool | Description |
 |------|-------------|
 | `sophos_list_tenants` | List all managed tenants with IDs, names, and data regions |
 | `sophos_list_account_health` | Bulk health scores for all tenants, ranked worst-first |
 | `sophos_partner_gap_analysis` | Security gap and upsell opportunity report across all tenants |
-
-#### `sophos_partner_gap_analysis` — detail
-
-Fetches account health for every managed tenant in parallel and distils the results into a compact, ranked list of security gaps — designed for partner sales and advisory conversations. A single call covers the entire managed estate.
-
-**Parameters**
-
-| Parameter | Type | Default | Description |
-|-----------|------|---------|-------------|
-| `protection_threshold` | integer (1–100) | `80` | Flag tenants whose protection score is below this percentage |
-| `flag_missing_server_protection` | boolean | `false` | Include tenants with no server protection enrolled as an upsell opportunity. Off by default to reduce noise for SMB-heavy partners |
-| `limit` | integer | all | Return only the top N tenants by gap count |
-
-**Gaps detected**
-
-| Gap type | Meaning |
-|----------|---------|
-| `no_products_enrolled` | No Sophos products enrolled or no endpoints reporting health data |
-| `low_computer_protection` | Computer protection score below the configured threshold |
-| `low_server_protection` | Server protection score below the configured threshold |
-| `tamper_protection_partial` | Tamper protection not enabled on all computers |
-| `tamper_protection_partial_servers` | Tamper protection not enabled on all servers |
-| `policy_non_compliance` | Computer policy compliance below 100% |
-| `policy_non_compliance_servers` | Server policy compliance below 100% |
-| `no_server_protection` | Server protection not enrolled (only when `flag_missing_server_protection=true`) |
-
-**Response shape**
-
-```json
-{
-  "summary": {
-    "total_tenants": 137,
-    "tenants_with_gaps": 42,
-    "tenants_with_errors": 1,
-    "tenants_no_issues": 94,
-    "protection_threshold_used": 80,
-    "gap_type_breakdown": [
-      { "type": "tamper_protection_partial", "affected_tenants": 28 },
-      { "type": "low_computer_protection",   "affected_tenants": 14 }
-    ]
-  },
-  "tenants_with_gaps": [
-    {
-      "tenant_id": "...",
-      "tenant_name": "Acme Corp",
-      "gap_count": 3,
-      "gaps": [
-        { "type": "low_computer_protection", "detail": "Computer protection at 62% (below 80% threshold)", "score": 62 },
-        { "type": "tamper_protection_partial", "detail": "Tamper protection enabled on only 50% of computers", "score": 50 },
-        { "type": "policy_non_compliance", "detail": "Computer policy compliance at 75%", "score": 75 }
-      ]
-    }
-  ]
-}
-```
-
-### SOC Monitoring
+| `sophos_create_tenant` | Create a new managed tenant |
+| `sophos_get_managed_tenant` | Get managed tenant details |
+| `sophos_list_partner_roles` | List partner-level roles |
+| `sophos_get_partner_role` | Get partner role detail |
+| `sophos_create_partner_role` | Create a partner role |
+| `sophos_delete_partner_role` | Delete a partner role |
+| `sophos_list_partner_permission_sets` | List available partner permission sets |
+| `sophos_list_partner_admins` | List partner administrators |
+| `sophos_get_partner_admin` | Get partner admin detail |
+| `sophos_create_partner_admin` | Create a partner admin |
+| `sophos_delete_partner_admin` | Delete a partner admin |
+| `sophos_list_partner_admin_role_assignments` | List admin role assignments |
+| `sophos_add_partner_admin_role_assignment` | Add role assignment to admin |
+| `sophos_delete_partner_admin_role_assignment` | Remove role assignment |
+| `sophos_get_billing_usage` | Get billing usage summary |
+
+### Alerts (4 tools)
 
 | Tool | Description |
 |------|-------------|
 | `sophos_list_alerts` | List alerts with severity/category/product/date filters |
 | `sophos_get_alert` | Get full alert detail with allowed actions |
 | `sophos_acknowledge_alert` | Mark an alert as reviewed |
+| `sophos_search_alerts` | Advanced search with structured filters and sorting |
+
+### Endpoints (18 tools)
+
+| Tool | Description |
+|------|-------------|
 | `sophos_list_endpoints` | List endpoints with health/OS/hostname/isolation filters |
 | `sophos_get_endpoint` | Get full endpoint detail |
 | `sophos_scan_endpoint` | Trigger an on-demand scan |
 | `sophos_isolate_endpoint` | Network-isolate a compromised endpoint |
 | `sophos_release_endpoint` | Release an endpoint from isolation |
-| `sophos_get_account_health` | Get tenant health check scores |
-| `sophos_list_users` | List directory users |
-| `sophos_list_admins` | List admin accounts and roles |
-| `sophos_list_roles` | List available admin roles |
+| `sophos_delete_endpoint` | Delete a specific endpoint |
+| `sophos_bulk_delete_endpoints` | Bulk delete multiple endpoints |
+| `sophos_get_tamper_protection` | Get tamper protection status and password |
+| `sophos_toggle_tamper_protection` | Enable/disable tamper protection |
+| `sophos_get_adaptive_attack_protection` | Get adaptive attack protection status |
+| `sophos_toggle_adaptive_attack_protection` | Enable/disable adaptive attack protection |
+| `sophos_trigger_update_check` | Trigger a software update check |
+| `sophos_request_forensic_logs` | Request forensic log upload |
+| `sophos_get_forensic_log_status` | Get forensic log request status |
+| `sophos_request_memory_dump` | Request memory dump from endpoint |
+| `sophos_get_memory_dump_status` | Get memory dump request status |
+| `sophos_bulk_isolate_endpoints` | Bulk isolate/release multiple endpoints |
+| `sophos_get_endpoint_isolation_status` | Get endpoint isolation status |
+
+### Endpoint Settings (32 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_installer_downloads` | List available installer packages |
+| `sophos_get_installer_download` | Get specific installer download link |
+| `sophos_list_blocked_addresses` | List blocked network addresses |
+| `sophos_add_blocked_address` | Add a blocked network address |
+| `sophos_delete_blocked_address` | Delete a blocked address |
+| `sophos_list_local_sites` | List web control local site definitions |
+| `sophos_add_local_site` | Add a local site for web control |
+| `sophos_update_local_site` | Update a local site |
+| `sophos_delete_local_site` | Delete a local site |
+| `sophos_list_web_control_categories` | List web control categories |
+| `sophos_get_tls_decryption_settings` | Get TLS decryption settings |
+| `sophos_update_tls_decryption_settings` | Update TLS decryption settings |
+| `sophos_get_global_tamper_protection` | Get global tamper protection settings |
+| `sophos_update_global_tamper_protection` | Update global tamper protection |
+| `sophos_list_detected_exploits` | List detected exploits |
+| `sophos_get_detected_exploit` | Get exploit detail |
+| `sophos_list_exploit_mitigation_categories` | List exploit mitigation categories |
+| `sophos_get_exploit_mitigation_category` | Get category detail |
+| `sophos_list_exploit_mitigation_apps` | List exploit mitigation applications |
+| `sophos_get_exploit_mitigation_app` | Get application detail |
+| `sophos_add_exploit_mitigation_app` | Add application to exploit mitigation |
+| `sophos_update_exploit_mitigation_app` | Update exploit mitigation application |
+| `sophos_list_ips_exclusions` | List IPS exclusions |
+| `sophos_add_ips_exclusion` | Add IPS exclusion |
+| `sophos_delete_ips_exclusion` | Delete IPS exclusion |
+| `sophos_list_isolation_exclusions` | List isolation exclusions |
+| `sophos_add_isolation_exclusion` | Add isolation exclusion |
+| `sophos_delete_isolation_exclusion` | Delete isolation exclusion |
+| `sophos_get_lockdown_settings` | Get server lockdown settings |
+| `sophos_update_lockdown_settings` | Update server lockdown settings |
+| `sophos_get_mtr_settings` | Get MDR/MTR settings |
+| `sophos_update_mtr_settings` | Update MDR/MTR settings |
+
+### Endpoint Migrations (7 tools)
 
-### Admin Automation
+| Tool | Description |
+|------|-------------|
+| `sophos_list_migrations` | List endpoint migration jobs |
+| `sophos_get_migration` | Get migration job details |
+| `sophos_create_migration` | Create a new migration job |
+| `sophos_delete_migration` | Delete a migration job |
+| `sophos_list_migration_endpoints` | List endpoints in a migration |
+| `sophos_list_recommended_packages` | List recommended software packages |
+| `sophos_list_static_packages` | List static software packages |
+
+### Policies (6 tools)
 
 | Tool | Description |
 |------|-------------|
 | `sophos_list_policies` | List endpoint policies with optional type filter |
 | `sophos_get_policy` | Get full policy detail including all settings |
+| `sophos_create_policy` | Create a new endpoint policy |
 | `sophos_clone_policy` | Clone an existing policy under a new name |
 | `sophos_update_policy` | Update policy name, enabled state, priority, or settings |
+| `sophos_delete_policy` | Delete a policy |
+
+### Endpoint Groups (7 tools)
+
+| Tool | Description |
+|------|-------------|
 | `sophos_list_endpoint_groups` | List endpoint groups |
-| `sophos_get_endpoint_group` | Get group detail with optional member endpoint list |
+| `sophos_get_endpoint_group` | Get group detail with optional member list |
 | `sophos_create_endpoint_group` | Create a new endpoint group |
-| `sophos_update_endpoint_group` | Rename or update a group's description |
+| `sophos_update_endpoint_group` | Rename or update a group |
 | `sophos_delete_endpoint_group` | Delete an endpoint group |
 | `sophos_add_endpoints_to_group` | Add endpoints to a group |
 | `sophos_remove_endpoint_from_group` | Remove an endpoint from a group |
+
+### Exclusions & Allow/Block Lists (9 tools)
+
+| Tool | Description |
+|------|-------------|
 | `sophos_list_exclusions` | List global scanning exclusions |
-| `sophos_add_exclusion` | Add a scanning exclusion (path, process, web, PUA, AMSI) |
+| `sophos_add_exclusion` | Add a scanning exclusion |
 | `sophos_delete_exclusion` | Delete a scanning exclusion |
 | `sophos_list_allowed_items` | List globally allowed items |
-| `sophos_add_allowed_item` | Allow an item by SHA256, path, or certificate signer |
+| `sophos_add_allowed_item` | Allow an item by SHA256, path, or certificate |
 | `sophos_delete_allowed_item` | Remove an allowed item |
 | `sophos_list_blocked_items` | List globally blocked items |
-| `sophos_add_blocked_item` | Block an item by SHA256, path, or certificate signer |
+| `sophos_add_blocked_item` | Block an item by SHA256, path, or certificate |
 | `sophos_delete_blocked_item` | Remove a blocked item |
 
-### Investigation
+### Account Health (3 tools)
 
-#### Cases
+| Tool | Description |
+|------|-------------|
+| `sophos_get_account_health` | Get tenant health check scores |
+| `sophos_list_account_health` | Bulk health scores for all tenants (partner/org only) |
+| `sophos_partner_gap_analysis` | Gap analysis across all tenants (partner/org only) |
+
+### Directory Users & Groups (17 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_users` | List directory users |
+| `sophos_get_user` | Get user detail |
+| `sophos_create_user` | Create a directory user |
+| `sophos_update_user` | Update a user |
+| `sophos_delete_user` | Delete a user |
+| `sophos_list_user_groups` | List directory user groups |
+| `sophos_get_user_group` | Get user group detail |
+| `sophos_create_user_group` | Create a user group |
+| `sophos_update_user_group` | Update a user group |
+| `sophos_delete_user_group` | Delete a user group |
+| `sophos_list_user_group_members` | List members of a user group |
+| `sophos_add_users_to_group` | Add users to a group |
+| `sophos_remove_user_from_group` | Remove a user from a group |
+| `sophos_list_user_group_endpoints` | List endpoints in a user group |
+| `sophos_list_user_group_policies` | List policies assigned to a user group |
+| `sophos_list_admins` | List admin accounts and roles |
+| `sophos_list_roles` | List available admin roles |
+
+### Admin Management (14 tools)
 
 | Tool | Description |
 |------|-------------|
-| `sophos_list_cases` | List investigation cases with pagination |
+| `sophos_get_admin` | Get admin detail |
+| `sophos_create_admin` | Create an admin account |
+| `sophos_delete_admin` | Delete an admin account |
+| `sophos_list_admin_role_assignments` | List admin's role assignments |
+| `sophos_add_admin_role_assignment` | Add role assignment to admin |
+| `sophos_delete_admin_role_assignment` | Remove role assignment |
+| `sophos_get_admin_role_assignment` | Get specific role assignment |
+| `sophos_create_role` | Create an admin role |
+| `sophos_get_role` | Get role detail |
+| `sophos_update_role` | Update a role |
+| `sophos_delete_role` | Delete a role |
+| `sophos_list_permission_sets` | List available permission sets |
+| `sophos_list_admin_authenticators` | List admin's authenticators |
+| `sophos_reset_admin_password` | Reset an admin's password |
+
+### Cases (9 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_cases` | List investigation cases |
 | `sophos_get_case` | Get full case details |
-| `sophos_create_case` | Create a new self-managed investigation case |
-| `sophos_update_case` | Update case status, severity, assignee, or overview |
+| `sophos_create_case` | Create a new investigation case |
+| `sophos_update_case` | Update case status, severity, assignee |
+| `sophos_delete_case` | Delete a case |
 | `sophos_list_case_detections` | List detections linked to a case |
-| `sophos_get_case_mitre_summary` | Get MITRE ATT&CK tactic/technique breakdown for a case |
+| `sophos_get_case_detection` | Get specific detection detail |
+| `sophos_list_case_impacted_entities` | List impacted entities for a case |
+| `sophos_get_case_mitre_summary` | Get MITRE ATT&CK breakdown for a case |
 
-#### Detections
+### Detections (6 tools)
 
 Async API — start a query, poll for completion, then fetch results.
 
 | Tool | Description |
 |------|-------------|
-| `sophos_run_detections_query` | Start an async query for individual XDR/EDR detections |
-| `sophos_get_detections_run` | Poll the status of a detections query run |
-| `sophos_get_detections_results` | Fetch results from a completed detections query |
-| `sophos_run_detection_groups_query` | Start an async query for grouped detections |
-| `sophos_get_detection_groups_run` | Poll the status of a detection groups query run |
-| `sophos_get_detection_groups_results` | Fetch results from a completed detection groups query |
+| `sophos_run_detections_query` | Start async query for individual detections |
+| `sophos_get_detections_run` | Poll detection query status |
+| `sophos_get_detections_results` | Fetch completed detection query results |
+| `sophos_run_detection_groups_query` | Start async query for grouped detections |
+| `sophos_get_detection_groups_run` | Poll detection groups query status |
+| `sophos_get_detection_groups_results` | Fetch completed detection groups results |
 
-#### SIEM Events
+### SIEM (2 tools)
 
 | Tool | Description |
 |------|-------------|
-| `sophos_list_siem_events` | Stream security events via cursor-based pagination (last 24h) |
-| `sophos_list_siem_alerts` | Stream security alerts via cursor-based pagination (last 24h) |
+| `sophos_list_siem_events` | Stream security events (cursor-based, last 24h default) |
+| `sophos_list_siem_alerts` | Stream security alerts (cursor-based, last 24h default) |
 
-#### XDR Data Lake
+### XDR Data Lake (9 tools)
 
-Async API — submit a SQL query against historical telemetry, poll for completion, then fetch results.
+Async API — submit SQL queries against historical telemetry.
 
 | Tool | Description |
 |------|-------------|
-| `sophos_run_xdr_query` | Start an async SQL query against the Sophos Data Lake |
-| `sophos_get_xdr_query_run` | Poll the status of an XDR query run |
-| `sophos_get_xdr_query_results` | Fetch paginated results from a completed XDR query |
+| `sophos_run_xdr_query` | Start async SQL query against the Data Lake |
+| `sophos_get_xdr_query_run` | Poll XDR query run status |
+| `sophos_get_xdr_query_results` | Fetch completed XDR query results |
+| `sophos_list_xdr_query_runs` | List XDR query runs |
+| `sophos_cancel_xdr_query_run` | Cancel a running XDR query |
+| `sophos_list_xdr_query_categories` | List XDR query categories |
+| `sophos_get_xdr_query_category` | Get XDR query category detail |
+| `sophos_list_xdr_queries` | List saved XDR queries |
+| `sophos_get_xdr_query` | Get saved XDR query detail |
 
-#### Live Discover
+### Live Discover (4 tools)
 
-Async API — run OSquery SQL on live endpoints in real time. Rate limited to 10 runs/minute, 500/day.
+Async API — run OSquery SQL on live endpoints. Rate limited to 10 runs/minute, 500/day.
 
 | Tool | Description |
 |------|-------------|
 | `sophos_list_live_discover_queries` | List available saved OSquery queries |
-| `sophos_run_live_discover_query` | Run a saved or ad hoc OSquery against live endpoints |
-| `sophos_get_live_discover_run` | Poll the status of a Live Discover query run |
-| `sophos_get_live_discover_results` | Fetch paginated results from a completed Live Discover run |
+| `sophos_run_live_discover_query` | Run a saved or ad hoc query on live endpoints |
+| `sophos_get_live_discover_run` | Poll Live Discover run status |
+| `sophos_get_live_discover_results` | Fetch Live Discover results |
+
+### Firewall (19 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_firewalls` | List managed firewalls |
+| `sophos_get_firewall` | Get firewall detail |
+| `sophos_update_firewall` | Update firewall properties |
+| `sophos_delete_firewall` | Delete a firewall |
+| `sophos_firewall_action` | Perform action (reboot, sync, upgrade check) |
+| `sophos_check_firmware_upgrade` | Check for firmware upgrades |
+| `sophos_start_firmware_upgrade` | Start a firmware upgrade |
+| `sophos_cancel_firmware_upgrade` | Cancel a firmware upgrade |
+| `sophos_list_firewall_groups` | List firewall groups |
+| `sophos_get_firewall_group` | Get firewall group detail |
+| `sophos_create_firewall_group` | Create a firewall group |
+| `sophos_update_firewall_group` | Update a firewall group |
+| `sophos_delete_firewall_group` | Delete a firewall group |
+| `sophos_get_firewall_sync_status` | Get firewall sync status |
+| `sophos_get_threat_feed_settings` | Get MDR threat feed settings |
+| `sophos_update_threat_feed_settings` | Update threat feed settings |
+| `sophos_list_threat_feed_indicators` | List threat feed indicators |
+| `sophos_search_threat_feed_indicators` | Search threat feed indicators |
+| `sophos_get_threat_feed_indicator` | Get specific threat indicator |
+
+### Email Protection (30 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_search_quarantine` | Search quarantined emails |
+| `sophos_preview_quarantine_message` | Preview quarantined email content |
+| `sophos_get_quarantine_urls` | Get URLs in quarantined email |
+| `sophos_get_quarantine_attachments` | Get quarantined email attachment info |
+| `sophos_release_quarantine_message` | Release quarantined email to recipient |
+| `sophos_delete_quarantine_message` | Permanently delete quarantined email |
+| `sophos_strip_quarantine_attachments` | Strip attachments and release |
+| `sophos_reattach_quarantine_attachments` | Reattach stripped attachments |
+| `sophos_download_quarantine_attachment` | Download specific attachment |
+| `sophos_search_post_delivery_quarantine` | Search post-delivery quarantine |
+| `sophos_preview_post_delivery_message` | Preview post-delivery quarantined message |
+| `sophos_get_post_delivery_attachments` | Get post-delivery attachment info |
+| `sophos_release_post_delivery_message` | Release post-delivery message |
+| `sophos_delete_post_delivery_message` | Delete post-delivery message |
+| `sophos_download_post_delivery_attachment` | Download post-delivery attachment |
+| `sophos_clawback_message` | Clawback/recall a delivered message |
+| `sophos_get_clawback_status` | Get clawback action status |
+| `sophos_list_mailboxes` | List mailboxes |
+| `sophos_create_mailbox` | Create a mailbox |
+| `sophos_bulk_create_mailboxes` | Bulk create mailboxes |
+| `sophos_get_mailbox` | Get mailbox detail |
+| `sophos_update_mailbox` | Update a mailbox |
+| `sophos_delete_mailbox` | Delete a mailbox |
+| `sophos_list_mailbox_aliases` | List mailbox aliases |
+| `sophos_add_mailbox_alias` | Add a mailbox alias |
+| `sophos_delete_mailbox_alias` | Delete a mailbox alias |
+| `sophos_list_mailbox_delegates` | List mailbox delegates |
+| `sophos_add_mailbox_delegate` | Add a mailbox delegate |
+| `sophos_delete_mailbox_delegate` | Remove a mailbox delegate |
+| `sophos_get_email_settings` | Get email protection settings |
+
+### Mobile Device Management (38 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_get_mobile_auto_enrollment` | Get auto-enrollment settings |
+| `sophos_update_mobile_auto_enrollment` | Update auto-enrollment settings |
+| `sophos_list_mobile_os` | List supported mobile OS platforms |
+| `sophos_list_mobile_devices` | List mobile devices with filters |
+| `sophos_get_mobile_device` | Get device detail |
+| `sophos_create_mobile_device` | Enroll a new mobile device |
+| `sophos_update_mobile_device` | Update device properties |
+| `sophos_delete_mobile_device` | Delete/unenroll a device |
+| `sophos_list_mobile_device_properties` | Get device properties |
+| `sophos_get_mobile_device_compliance` | Get compliance status |
+| `sophos_get_mobile_device_scans` | Get scan results |
+| `sophos_get_mobile_device_policies` | Get assigned policies |
+| `sophos_get_mobile_device_apps` | Get installed apps |
+| `sophos_get_mobile_device_location` | Get device location |
+| `sophos_list_mobile_device_groups` | List device groups |
+| `sophos_get_mobile_device_group` | Get device group detail |
+| `sophos_create_mobile_device_group` | Create a device group |
+| `sophos_update_mobile_device_group` | Update a device group |
+| `sophos_delete_mobile_device_group` | Delete a device group |
+| `sophos_sync_mobile_device` | Sync a device |
+| `sophos_request_mobile_device_logs` | Request device logs |
+| `sophos_scan_mobile_device` | Trigger device scan |
+| `sophos_unenroll_mobile_device` | Unenroll a device |
+| `sophos_send_mobile_device_message` | Send message to device |
+| `sophos_locate_mobile_device` | Request device location update |
+| `sophos_lock_mobile_device` | Lock device remotely |
+| `sophos_wipe_mobile_device` | Wipe device remotely |
+| `sophos_list_mobile_app_groups` | List app groups |
+| `sophos_get_mobile_app_group` | Get app group detail |
+| `sophos_create_mobile_app_group` | Create an app group |
+| `sophos_update_mobile_app_group` | Update an app group |
+| `sophos_delete_mobile_app_group` | Delete an app group |
+| `sophos_list_mobile_policies` | List mobile policies |
+| `sophos_get_mobile_policy` | Get mobile policy detail |
+| `sophos_update_mobile_policy` | Update a mobile policy |
+| `sophos_list_mobile_profiles` | List mobile profiles |
+| `sophos_get_mobile_profile` | Get mobile profile detail |
+| `sophos_update_mobile_profile` | Update a mobile profile |
+
+### DNS Protection (5 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_dns_locations` | List DNS protection locations |
+| `sophos_get_dns_location` | Get location detail |
+| `sophos_create_dns_location` | Create a DNS location |
+| `sophos_update_dns_location` | Update a DNS location |
+| `sophos_delete_dns_location` | Delete a DNS location |
+
+### Cloud Security (6 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_cloud_security_profiles` | List cloud security profiles |
+| `sophos_get_cloud_security_profile` | Get profile detail |
+| `sophos_create_cloud_security_profile` | Create a cloud security profile |
+| `sophos_update_cloud_security_profile` | Update a profile |
+| `sophos_delete_cloud_security_profile` | Delete a profile |
+| `sophos_list_cloud_security_assets` | List cloud security assets |
+
+### Wi-Fi (3 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_wifi_mac_filters` | List Wi-Fi MAC filtering entries |
+| `sophos_add_wifi_mac_filter` | Add a MAC filter entry |
+| `sophos_delete_wifi_mac_filter` | Delete a MAC filter entry |
+
+### User Activity (2 tools)
+
+| Tool | Description |
+|------|-------------|
+| `sophos_create_attestation` | Create a user attestation/sign-off |
+| `sophos_get_attestation` | Get attestation detail |
 
 ### Tenant context
 
@@ -281,28 +512,39 @@ Per tool call: resolve tenant -> regional API host -> execute request
 
 ```
 src/
-├── index.ts                  # Entry point, server bootstrap
-├── config/config.ts          # Environment config
-├── auth/token-manager.ts     # OAuth2 token lifecycle
+├── index.ts                     # Entry point, server bootstrap
+├── config/config.ts             # Environment config
+├── auth/token-manager.ts        # OAuth2 token lifecycle
 ├── client/
-│   ├── sophos-client.ts      # HTTP client with region routing
-│   └── tenant-resolver.ts    # Whoami + tenant cache
+│   ├── sophos-client.ts         # HTTP client with region routing
+│   └── tenant-resolver.ts       # Whoami + tenant cache
 ├── tools/
-│   ├── helpers.ts            # Shared response formatting
-│   ├── tenants.ts            # sophos_list_tenants
-│   ├── alerts.ts             # sophos_list_alerts, get, acknowledge
-│   ├── endpoints.ts          # sophos_list/get/scan/isolate/release
-│   ├── health.ts             # sophos_get_account_health, sophos_list_account_health, sophos_partner_gap_analysis
-│   ├── directory.ts          # sophos_list_users, list_admins, list_roles
-│   ├── policies.ts           # sophos_list/get/clone/update_policy
-│   ├── groups.ts             # sophos_list/get/create/update/delete_endpoint_group, add/remove endpoints
-│   ├── exclusions.ts         # sophos_list/add/delete exclusions, allowed items, blocked items
-│   ├── cases.ts              # sophos_list/get/create/update_case, list_case_detections, mitre_summary
-│   ├── detections.ts         # sophos_run/get/results for detections and detection-groups
-│   ├── siem.ts               # sophos_list_siem_events, sophos_list_siem_alerts
-│   ├── xdr.ts                # sophos_run/get/results for XDR Data Lake queries
-│   └── live-discover.ts      # sophos_list_queries, run/get/results for Live Discover
-└── types/sophos.ts           # Sophos API response types
+│   ├── helpers.ts               # Shared response formatting
+│   ├── tenants.ts               # Tenant listing (partner/org only)
+│   ├── partner.ts               # Partner admin, roles, billing (partner/org only)
+│   ├── alerts.ts                # Alert list, get, acknowledge, search
+│   ├── endpoints.ts             # Endpoint CRUD, scan, isolate, tamper, forensics
+│   ├── endpoint-settings.ts     # Installer, web control, exploit mitigation, IPS, etc.
+│   ├── endpoint-migrations.ts   # Migration jobs, software packages
+│   ├── health.ts                # Account health, gap analysis
+│   ├── directory.ts             # Users, user groups, group membership
+│   ├── admin-management.ts      # Admin CRUD, roles, permission sets
+│   ├── policies.ts              # Policy CRUD, clone
+│   ├── groups.ts                # Endpoint group CRUD, membership
+│   ├── exclusions.ts            # Scanning exclusions, allowed/blocked items
+│   ├── cases.ts                 # Investigation cases, detections, MITRE
+│   ├── detections.ts            # Detection queries (async)
+│   ├── siem.ts                  # SIEM events and alerts
+│   ├── xdr.ts                   # XDR Data Lake queries (async)
+│   ├── live-discover.ts         # Live Discover queries (async)
+│   ├── firewall.ts              # Firewall CRUD, firmware, groups, threat feed
+│   ├── email.ts                 # Quarantine, mailboxes, message actions
+│   ├── mobile.ts                # Mobile devices, groups, actions, policies
+│   ├── dns-protection.ts        # DNS locations
+│   ├── cloud-security.ts        # Cloud security profiles, assets
+│   ├── wifi.ts                  # Wi-Fi MAC filtering
+│   └── user-activity.ts         # User attestations
+└── types/sophos.ts              # Sophos API response types
 ```
 
 ## Security

package/dist/client/sophos-client.d.ts

@@ -6,7 +6,7 @@ import type { TokenManager } from "../auth/token-manager.js";
 import type { TenantResolver } from "./tenant-resolver.js";
 export interface RequestOptions {
     /** HTTP method */
-    method?: "GET" | "POST" | "PATCH" | "DELETE";
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
     /** Query parameters */
     params?: Record<string, string>;
     /** JSON request body */

package/dist/client/sophos-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sophos-client.d.ts","sourceRoot":"","sources":["../../src/client/sophos-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,WAAW,cAAc;IAC7B,kBAAkB;IAClB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC7C,uBAAuB;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB;IACxB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,cAAc;gBADd,YAAY,EAAE,YAAY,EAC1B,cAAc,EAAE,cAAc;IAGxC;;;OAGG;IACG,aAAa,CAAC,CAAC,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC;IAgCb;;OAEG;IACG,aAAa,CAAC,CAAC,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC;YAiCC,gBAAgB;IAwE9B,OAAO,CAAC,KAAK;CAGd"}
+{"version":3,"file":"sophos-client.d.ts","sourceRoot":"","sources":["../../src/client/sophos-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,WAAW,cAAc;IAC7B,kBAAkB;IAClB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrD,uBAAuB;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB;IACxB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,cAAc;gBADd,YAAY,EAAE,YAAY,EAC1B,cAAc,EAAE,cAAc;IAGxC;;;OAGG;IACG,aAAa,CAAC,CAAC,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC;IAgCb;;OAEG;IACG,aAAa,CAAC,CAAC,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC;YAiCC,gBAAgB;IAwE9B,OAAO,CAAC,KAAK;CAGd"}

package/dist/index.js

@@ -28,6 +28,17 @@ import { registerDetectionTools } from "./tools/detections.js";
 import { registerSiemTools } from "./tools/siem.js";
 import { registerXdrTools } from "./tools/xdr.js";
 import { registerLiveDiscoverTools } from "./tools/live-discover.js";
+import { registerAdminManagementTools } from "./tools/admin-management.js";
+import { registerEndpointMigrationTools } from "./tools/endpoint-migrations.js";
+import { registerEndpointSettingsTools } from "./tools/endpoint-settings.js";
+import { registerFirewallTools } from "./tools/firewall.js";
+import { registerEmailTools } from "./tools/email.js";
+import { registerDnsProtectionTools } from "./tools/dns-protection.js";
+import { registerCloudSecurityTools } from "./tools/cloud-security.js";
+import { registerWifiTools } from "./tools/wifi.js";
+import { registerUserActivityTools } from "./tools/user-activity.js";
+import { registerPartnerTools } from "./tools/partner.js";
+import { registerMobileTools } from "./tools/mobile.js";
 async function main() {
     // Load and validate config
     const config = loadConfig();
@@ -46,13 +57,14 @@ async function main() {
     // Create the MCP server
     const server = new McpServer({
         name: "sophos-central-mcp-server",
-        version: "0.1.10",
+        version: "0.2.1",
     });
     // Register tools based on identity type
     console.error(`[sophos-mcp] Registering tools for ${identity.idType} caller...`);
-    // Tenant listing only available for partner/org callers
+    // Partner/org-only tools
     if (identity.idType !== "tenant") {
         registerTenantTools(server, tenantResolver);
+        registerPartnerTools(server, sophosClient, tenantResolver);
     }
     // Phase 1: Tenant-scoped SOC monitoring tools
     registerAlertTools(server, sophosClient, tenantResolver);
@@ -69,6 +81,23 @@ async function main() {
     registerSiemTools(server, sophosClient, tenantResolver);
     registerXdrTools(server, sophosClient, tenantResolver);
     registerLiveDiscoverTools(server, sophosClient, tenantResolver);
+    // Phase 4: Endpoint migration and software package tools
+    registerEndpointMigrationTools(server, sophosClient, tenantResolver);
+    // Phase 5: Endpoint settings tools
+    registerEndpointSettingsTools(server, sophosClient, tenantResolver);
+    // Phase 6: Firewall management tools
+    registerFirewallTools(server, sophosClient, tenantResolver);
+    // Phase 7: Admin management and directory user/group tools
+    registerAdminManagementTools(server, sophosClient, tenantResolver);
+    // Phase 8: Email protection tools
+    registerEmailTools(server, sophosClient, tenantResolver);
+    // Phase 9: DNS, cloud security, Wi-Fi, licensing, accounts, user activity
+    registerDnsProtectionTools(server, sophosClient, tenantResolver);
+    registerCloudSecurityTools(server, sophosClient, tenantResolver);
+    registerWifiTools(server, sophosClient, tenantResolver);
+    registerUserActivityTools(server, sophosClient, tenantResolver);
+    // Phase 10: Mobile device management tools
+    registerMobileTools(server, sophosClient, tenantResolver);
     console.error("[sophos-mcp] All tools registered.");
     // Start transport
     if (config.transport === "http") {