sophos-central-mcp-server 0.2.7 → 0.2.8

package/dist/config/config.d.ts

@@ -12,7 +12,7 @@ export interface SophosConfig {
 export declare function loadConfig(): SophosConfig;
 export declare const SOPHOS_AUTH_URL = "https://id.sophos.com/api/v2/oauth2/token";
 export declare const SOPHOS_GLOBAL_API = "https://api.central.sophos.com";
-export declare const CHARACTER_LIMIT = 25000;
+export declare const CHARACTER_LIMIT: number;
 export declare const DEFAULT_PAGE_SIZE = 50;
 export declare const MAX_PAGE_SIZE = 100;
 //# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,wBAAgB,UAAU,IAAI,YAAY,CAwBzC;AAGD,eAAO,MAAM,eAAe,8CAA8C,CAAC;AAC3E,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AAGlE,eAAO,MAAM,eAAe,QAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,wBAAgB,UAAU,IAAI,YAAY,CAwBzC;AAGD,eAAO,MAAM,eAAe,8CAA8C,CAAC;AAC3E,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AAGlE,eAAO,MAAM,eAAe,QAG3B,CAAC;AACF,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC"}

package/dist/config/config.js

@@ -23,8 +23,8 @@ export function loadConfig() {
 // Sophos Central global API endpoints
 export const SOPHOS_AUTH_URL = "https://id.sophos.com/api/v2/oauth2/token";
 export const SOPHOS_GLOBAL_API = "https://api.central.sophos.com";
-// Response size limits
-export const CHARACTER_LIMIT = 25000;
+// Response size limits (CHARACTER_LIMIT configurable via env var)
+export const CHARACTER_LIMIT = Math.max(10000, parseInt(process.env.CHARACTER_LIMIT || "50000", 10) || 50000);
 export const DEFAULT_PAGE_SIZE = 50;
 export const MAX_PAGE_SIZE = 100;
 //# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAEtD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,GAAG,CAAC,IAAI,4CAA4C,CACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QACnD,IAAI,EAAE,OAAO;QACb,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,SAA8B,IAAI,MAAM;KACjE,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAElE,uBAAuB;AACvB,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAEtD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,GAAG,CAAC,IAAI,4CAA4C,CACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QACnD,IAAI,EAAE,OAAO;QACb,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,SAA8B,IAAI,MAAM;KACjE,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAElE,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CACrC,KAAK,EACL,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,CAC9D,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC"}

package/generate_health_report.py

@@ -5,7 +5,7 @@ sys.stdout = open(sys.stdout.fileno(), mode='w', encoding='utf-8', buffering=1)
 from fpdf import FPDF
 from datetime import datetime
 
-# ── Sophos brand colours ──
+# -- Sophos brand colours --
 SOPHOS_BLUE = (0, 53, 128)
 SOPHOS_DARK = (34, 34, 34)
 SOPHOS_RED = (200, 30, 30)
@@ -14,192 +14,277 @@ SOPHOS_GREEN = (40, 140, 60)
 SOPHOS_GREY = (100, 100, 100)
 WHITE = (255, 255, 255)
 LIGHT_BG = (245, 247, 250)
-ROW_ALT = (235, 240, 248)
+ROW_ALT = (232, 238, 248)
+
+PAGE_W = 190  # usable width (A4 210mm - 10mm margins each side)
+
 
 class PDF(FPDF):
+    """Custom PDF with Sophos-branded header/footer."""
+
+    _skip_header = False  # flag for cover page
+
     def header(self):
-        self.set_font("Helvetica", "B", 9)
+        if self._skip_header:
+            return
+        self.set_font("Helvetica", "B", 8)
         self.set_text_color(*SOPHOS_GREY)
-        self.cell(0, 6, "Rodin Business Solutions  |  Sophos Central Estate Health Report  |  March 2026", align="L")
-        self.ln(4)
+        self.cell(0, 5, "Rodin Business Solutions  |  Sophos Central Estate Health Report  |  March 2026", align="L")
+        self.ln(3)
         self.set_draw_color(*SOPHOS_BLUE)
-        self.set_line_width(0.6)
+        self.set_line_width(0.5)
         self.line(10, self.get_y(), 200, self.get_y())
-        self.ln(6)
+        self.ln(5)
 
     def footer(self):
         self.set_y(-15)
         self.set_font("Helvetica", "", 8)
         self.set_text_color(*SOPHOS_GREY)
-        self.cell(0, 10, f"Page {self.page_no()}/{{nb}}  |  Generated {datetime.now().strftime('%d/%m/%Y %H:%M')}", align="C")
+        self.cell(0, 10, f"Page {self.page_no()}/{{nb}}", align="C")
+
+    # -- Helpers ----------------------------------------------------------
 
     def section_title(self, title, colour=SOPHOS_BLUE):
         self.set_font("Helvetica", "B", 14)
         self.set_text_color(*colour)
         self.cell(0, 10, title)
-        self.ln(8)
+        self.ln(9)
         self.set_text_color(*SOPHOS_DARK)
 
     def sub_title(self, title, colour=SOPHOS_DARK):
         self.set_font("Helvetica", "B", 11)
         self.set_text_color(*colour)
         self.cell(0, 8, title)
-        self.ln(6)
+        self.ln(7)
         self.set_text_color(*SOPHOS_DARK)
 
-    def body_text(self, text):
-        self.set_font("Helvetica", "", 10)
+    def body_text(self, text, size=10):
+        self.set_font("Helvetica", "", size)
         self.set_text_color(*SOPHOS_DARK)
         self.multi_cell(0, 5.5, text)
         self.ln(2)
 
     def table_header(self, cols):
-        self.set_font("Helvetica", "B", 9)
+        """Draw a header row. cols = [(label, width), ...]"""
+        self.set_font("Helvetica", "B", 8)
         self.set_fill_color(*SOPHOS_BLUE)
         self.set_text_color(*WHITE)
         for label, w in cols:
-            self.cell(w, 7, label, border=0, fill=True, align="C")
+            self.cell(w, 7, f" {label}", border=0, fill=True, align="L")
         self.ln()
         self.set_text_color(*SOPHOS_DARK)
 
-    def table_row(self, cols, row_idx=0):
-        self.set_font("Helvetica", "", 9)
+    def _row_height(self, cols, font_size=8):
+        """Calculate the row height needed for the tallest multi-cell."""
+        self.set_font("Helvetica", "", font_size)
+        max_lines = 1
+        for val, w, _align in cols:
+            text = str(val)
+            # Estimate number of lines: char width ~2.1mm at size 8
+            char_w = font_size * 0.23
+            chars_per_line = max(int(w / char_w), 1)
+            lines = 1
+            for paragraph in text.split("\n"):
+                lines += max(0, (len(paragraph) - 1) // chars_per_line)
+                if len(paragraph) > 0:
+                    pass
+                lines += 0  # already counted
+            # Simpler: use fpdf's internal string width
+            str_w = self.get_string_width(text)
+            est_lines = max(1, int(str_w / (w - 2)) + 1)
+            max_lines = max(max_lines, est_lines)
+        return max(6.5, max_lines * 4.2)
+
+    def table_row(self, cols, row_idx=0, font_size=8):
+        """Draw a data row with alternating colours. cols = [(val, width, align), ...]"""
+        self.set_font("Helvetica", "", font_size)
         if row_idx % 2 == 1:
             self.set_fill_color(*ROW_ALT)
-            fill = True
         else:
             self.set_fill_color(*WHITE)
-            fill = True
+
+        # Check if we need a page break (leave room for row + footer)
+        row_h = 6.5
+        if self.get_y() + row_h > self.h - self.b_margin - 5:
+            self.add_page()
+
         for val, w, align in cols:
-            self.cell(w, 6.5, str(val), border=0, fill=fill, align=align)
+            self.cell(w, row_h, f" {str(val)}", border=0, fill=True, align=align)
         self.ln()
 
+    def table_row_multi(self, cols, row_idx=0, row_h=6.5, font_size=8):
+        """Draw a row that may wrap text in the last column."""
+        self.set_font("Helvetica", "", font_size)
+        if row_idx % 2 == 1:
+            self.set_fill_color(*ROW_ALT)
+        else:
+            self.set_fill_color(*WHITE)
+
+        if self.get_y() + row_h > self.h - self.b_margin - 5:
+            self.add_page()
+
+        x_start = self.get_x()
+        y_start = self.get_y()
+
+        # Draw fixed cells
+        for val, w, align in cols[:-1]:
+            self.cell(w, row_h, f" {str(val)}", border=0, fill=True, align=align)
+
+        # Draw last cell as multi_cell for wrapping
+        last_val, last_w, last_align = cols[-1]
+        x_last = self.get_x()
+        self.multi_cell(last_w, row_h / max(1, len(str(last_val)) // 40 + 1),
+                        f" {str(last_val)}", border=0, fill=True, align=last_align)
 
+        y_end = self.get_y()
+        actual_h = y_end - y_start
+        if actual_h < row_h:
+            self.set_y(y_start + row_h)
+
+    def check_space(self, needed_mm=30):
+        """Add a page if less than needed_mm space remains."""
+        if self.get_y() + needed_mm > self.h - self.b_margin:
+            self.add_page()
+
+
+# ===========================================================================
+# BUILD THE PDF
+# ===========================================================================
 pdf = PDF(orientation="P", unit="mm", format="A4")
 pdf.alias_nb_pages()
 pdf.set_auto_page_break(auto=True, margin=20)
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# COVER / EXECUTIVE SUMMARY
-# ═══════════════════════════════════════════════════════════════════════════════
+# ===== COVER PAGE ==========================================================
+pdf._skip_header = True
 pdf.add_page()
-pdf.ln(15)
-pdf.set_font("Helvetica", "B", 28)
+pdf.ln(30)
+
+# Title block
+pdf.set_font("Helvetica", "B", 30)
 pdf.set_text_color(*SOPHOS_BLUE)
 pdf.cell(0, 14, "Sophos Central", align="C")
-pdf.ln(14)
-pdf.set_font("Helvetica", "B", 22)
-pdf.cell(0, 12, "Estate Health & Opportunity Report", align="C")
 pdf.ln(16)
-pdf.set_font("Helvetica", "", 13)
-pdf.set_text_color(*SOPHOS_GREY)
-pdf.cell(0, 8, "Rodin Business Solutions  |  March 2026", align="C")
-pdf.ln(8)
-pdf.cell(0, 8, "Prepared by Sophos Central MCP Automation", align="C")
-pdf.ln(20)
+pdf.set_font("Helvetica", "B", 20)
+pdf.cell(0, 12, "Estate Health & Opportunity Report", align="C")
+pdf.ln(18)
 
-# Summary boxes
+# Decorative line
 pdf.set_draw_color(*SOPHOS_BLUE)
-pdf.set_line_width(0.4)
+pdf.set_line_width(1.0)
+pdf.line(60, pdf.get_y(), 150, pdf.get_y())
+pdf.ln(12)
+
+pdf.set_font("Helvetica", "", 14)
+pdf.set_text_color(*SOPHOS_GREY)
+pdf.cell(0, 8, "Rodin Business Solutions  |  March 2026", align="C")
+pdf.ln(30)
 
+# Summary metric boxes
 metrics = [
     ("153", "Total Tenants"),
     ("115", "Healthy (75%)"),
     ("34", "With Gaps (22%)"),
-    ("$38,923", "Monthly AUD"),
+    ("$38,923/mo", "Monthly AUD"),
 ]
 box_w = 42
-start_x = 12
+gap = 4
+total_w = len(metrics) * box_w + (len(metrics) - 1) * gap
+start_x = (210 - total_w) / 2
+y_boxes = pdf.get_y()
+
 for i, (val, label) in enumerate(metrics):
-    x = start_x + i * (box_w + 4)
-    pdf.set_xy(x, pdf.get_y())
+    x = start_x + i * (box_w + gap)
     pdf.set_fill_color(*LIGHT_BG)
-    pdf.rect(x, pdf.get_y(), box_w, 24, style="FD")
-    pdf.set_xy(x, pdf.get_y() + 3)
-    pdf.set_font("Helvetica", "B", 18)
+    pdf.set_draw_color(*SOPHOS_BLUE)
+    pdf.set_line_width(0.4)
+    pdf.rect(x, y_boxes, box_w, 26, style="FD")
+    pdf.set_xy(x, y_boxes + 4)
+    pdf.set_font("Helvetica", "B", 20)
     pdf.set_text_color(*SOPHOS_BLUE)
     pdf.cell(box_w, 10, val, align="C")
-    pdf.set_xy(x, pdf.get_y() + 10)
+    pdf.set_xy(x, y_boxes + 15)
     pdf.set_font("Helvetica", "", 9)
     pdf.set_text_color(*SOPHOS_GREY)
     pdf.cell(box_w, 6, label, align="C")
 
-pdf.ln(32)
+pdf.set_y(y_boxes + 36)
 
+# Executive summary
 pdf.set_text_color(*SOPHOS_DARK)
 pdf.section_title("Executive Summary")
 pdf.body_text(
     "This report provides a comprehensive health assessment of the Rodin Business Solutions "
-    "managed Sophos Central estate for March 2026. It identifies security configuration gaps "
-    "requiring remediation and highlights commercial opportunities where customers could benefit "
-    "from additional Sophos products."
+    "managed Sophos Central estate for March 2026. Across 153 managed tenants, 75% are fully "
+    "healthy with no configuration gaps detected. 22% have identifiable security or licensing "
+    "gaps that require remediation. The remaining tenants represent commercial upsell opportunities."
 )
 pdf.body_text(
     "Key findings:\n"
-    "- 4 tenants have tamper protection completely disabled (0%) - critical risk\n"
-    "- 1 tenant has server protection at 0% despite having enrolled servers\n"
-    "- 18 tenants have partial tamper protection gaps across computers or servers\n"
-    "- 14 tenants have no server protection enrolled (upsell opportunity)\n"
-    "- Multiple customers lack MDR or Sophos Firewall coverage (detailed in Section 4)"
+    "  - 4 tenants have tamper protection completely disabled (0%) representing critical risk\n"
+    "  - 1 tenant has server protection at 0% despite having enrolled servers\n"
+    "  - 6 tenants have high-priority partial tamper protection gaps on servers\n"
+    "  - 10 tenants have moderate gaps (92-99% TP) likely from stale devices\n"
+    "  - 14 tenants have no server protection enrolled\n"
+    "  - Multiple customers lack MDR or Sophos Firewall coverage (detailed in sections 5-7)"
 )
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# SECTION 2: CRITICAL HEALTH GAPS
-# ═══════════════════════════════════════════════════════════════════════════════
+pdf._skip_header = False
+
+# ===== SECTION 2: CRITICAL HEALTH GAPS ====================================
 pdf.add_page()
 pdf.section_title("1. Critical Health Gaps", SOPHOS_RED)
 pdf.body_text(
     "The following tenants have tamper protection at 0% or server protection failures. "
-    "These represent the highest security risk and should be remediated immediately. "
-    "Without tamper protection, a threat actor who gains access can disable Sophos endpoint "
-    "protection entirely."
+    "These represent the highest security risk and must be remediated immediately. "
+    "Without tamper protection, a threat actor who gains endpoint access can disable "
+    "Sophos protection entirely."
 )
 
 critical = [
-    ("Marco Polo Aged Care Services", "TP 0% computers AND servers", "Re-enable global TP immediately - aged care is high compliance risk"),
-    ("Unibuild", "TP 0% computers", "Re-enable global TP; check if intentionally disabled during deployment"),
+    ("Marco Polo Aged Care Services", "TP 0% computers AND servers", "Re-enable global TP immediately"),
+    ("Unibuild", "TP 0% computers", "Re-enable global TP"),
     ("MasterCraft Windows and Doors", "TP 0% computers", "Re-enable global TP"),
-    ("Martin Morris & Jones Sydney", "TP 0% computers", "Re-enable global TP; may be a stale/test tenant"),
-    ("WIN Sports & Entertainment Centres", "Server protection 0% (2 servers)", "Investigate why 2 enrolled servers show 0% protection"),
+    ("Martin Morris & Jones Sydney", "TP 0% computers", "Re-enable global TP"),
+    ("WIN Sports & Entertainment Centres", "Server protection 0% (2 servers)", "Investigate enrolled servers"),
 ]
 
-cols = [("Customer", 55), ("Issue", 55), ("Recommended Action", 80)]
-pdf.table_header(cols)
+cols_def = [("Customer", 58), ("Issue", 58), ("Recommended Action", 74)]
+pdf.table_header(cols_def)
 for i, (cust, issue, action) in enumerate(critical):
-    pdf.table_row([(cust, 55, "L"), (issue, 55, "L"), (action, 80, "L")], i)
+    pdf.table_row([(cust, 58, "L"), (issue, 58, "L"), (action, 74, "L")], i)
 
-pdf.ln(6)
+pdf.ln(8)
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# SECTION 3: HIGH & MODERATE GAPS
-# ═══════════════════════════════════════════════════════════════════════════════
+# ===== SECTION 3: HIGH PRIORITY GAPS ======================================
 pdf.section_title("2. High Priority Gaps", SOPHOS_AMBER)
 pdf.body_text(
     "These tenants have tamper protection below 90% on servers or significant partial gaps. "
-    "In most cases this indicates 1-2 endpoints with TP disabled that need attention."
+    "In most cases, 1-2 specific endpoints or servers need TP re-enabled."
 )
 
 high = [
-    ("Durham Green", "TP 59% computers", "Multiple endpoints with TP off - audit and re-enable"),
-    ("Southern Truck Centre", "TP 99% PC, 66% servers", "1 of 3 servers has TP disabled"),
+    ("Durham Green", "TP 59% computers", "Audit and re-enable on multiple endpoints"),
+    ("Southern Truck Centre", "TP 99% PC, 66% servers", "1 of 3 servers TP disabled"),
     ("Gunderson Briggs", "TP 98% PC, 88% servers", "1 server + 1 computer TP disabled"),
-    ("IOH Injury & Occupational Health", "TP 99% PC, 88% servers", "1 server with TP disabled"),
-    ("Project Portfolio Management", "TP 80% servers", "1 server with TP disabled"),
-    ("Sydney Automotive Paints & Equipment", "TP 85% servers", "1 server with TP disabled"),
+    ("IOH Injury & Occupational Health", "TP 99% PC, 88% servers", "1 server TP disabled"),
+    ("Project Portfolio Management", "TP 80% servers", "1 server TP disabled"),
+    ("Sydney Automotive Paints & Equipment", "TP 85% servers", "1 server TP disabled"),
 ]
 
-cols = [("Customer", 60), ("Issue", 60), ("Action", 70)]
-pdf.table_header(cols)
+cols_def = [("Customer", 62), ("Issue", 60), ("Action", 68)]
+pdf.table_header(cols_def)
 for i, (cust, issue, action) in enumerate(high):
-    pdf.table_row([(cust, 60, "L"), (issue, 60, "L"), (action, 70, "L")], i)
+    pdf.table_row([(cust, 62, "L"), (issue, 60, "L"), (action, 68, "L")], i)
 
-pdf.ln(6)
+pdf.ln(8)
 
-pdf.section_title("3. Moderate Gaps - Cleanup Required")
+# ===== SECTION 4: MODERATE GAPS ===========================================
+pdf.check_space(60)
+pdf.section_title("3. Moderate Gaps (Cleanup Required)")
 pdf.body_text(
     "These tenants have tamper protection between 92-99%. Typically 1-2 stale or "
-    "decommissioned endpoints. Recommend checking if devices are still active and either "
-    "re-enabling TP or removing the stale device."
+    "decommissioned endpoints. Check if devices are still active; re-enable TP or "
+    "remove stale registrations."
 )
 
 moderate = [
@@ -215,152 +300,200 @@ moderate = [
     ("Cram Foundation", "99%", "1 endpoint"),
 ]
 
-cols = [("Customer", 70), ("TP Score", 30), ("Likely Scope", 70)]
-pdf.table_header(cols)
+cols_def = [("Customer", 80), ("TP Score", 40), ("Likely Scope", 70)]
+pdf.table_header(cols_def)
 for i, (cust, score, scope) in enumerate(moderate):
-    pdf.table_row([(cust, 70, "L"), (score, 30, "C"), (scope, 70, "L")], i)
+    pdf.table_row([(cust, 80, "L"), (score, 40, "C"), (scope, 70, "L")], i)
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# SECTION 4: UPSELL - NO MDR
-# ═══════════════════════════════════════════════════════════════════════════════
+# ===== SECTION 5: UPSELL - NO MDR =========================================
 pdf.add_page()
-pdf.section_title("4. Upsell Opportunities")
-
-pdf.sub_title("4a. Customers Without MDR", SOPHOS_BLUE)
+pdf.section_title("4. Upsell: Customers Without MDR")
 pdf.body_text(
-    "The following customers are on Sophos Endpoint only (no MDR Complete or Essentials). "
-    "These represent the highest-value upsell opportunity - MDR adds 24/7 threat detection "
-    "and response with the Sophos MDR team. Sorted by user count to prioritise larger estates."
+    "The following customers are on Sophos Endpoint only with no MDR coverage. "
+    "MDR adds 24/7 threat detection and response by the Sophos MDR team. "
+    "Sorted by monthly spend to prioritise the largest existing relationships."
 )
 
 no_mdr = [
-    ("Southern Truck Centre Wollongong", 41, 2, "$446.91", "Endpoint + XG 210 only. 43 protected assets with no MDR coverage."),
-    ("Kintyre Country Living", 3, 0, "$415.77", "XG 310 firewall + 3 users. Low user count but paying for premium firewall."),
-    ("Custom Built Frames & Trusses", 3, 1, "$33.57", "Endpoint only + XGS 107. Small but could bundle MDR with existing firewall."),
-    ("Gunderson Briggs", 23, 2, "$136.11", "Endpoint only + XGS 136. 25 assets - strong MDR candidate."),
-    ("The Illawarra ITEC Ltd", 3, 1, "$14.21", "Endpoint only. Small tenant."),
-    ("Tulich Project Management", 0, 2, "$13.24", "Servers only, no MDR. Should have at minimum MDR Essentials on servers."),
+    ("Southern Truck Centre Wollongong", 41, 2, "$446.91", "Endpoint + XG 210", "Strong MDR candidate (43 assets)"),
+    ("Kintyre Country Living", 3, 0, "$415.77", "XG 310 + Endpoint", "Low user count but premium FW"),
+    ("REI Process", 0, 0, "$392.30", "XGS 2100 + SF Virtual", "Device-only - check if endpoints needed"),
+    ("University of Wollongong SmartSpace", 0, 0, "$357.72", "XGS 3300", "Single large firewall"),
+    ("Autopact", 0, 0, "$306.32", "XGS 126 + SF Virtual", "Device-only estate"),
+    ("IOH Injury & Occupational Health", 0, 0, "$285.38", "Multiple firewalls", "7 devices no MDR"),
+    ("Community Gateway Limited", 0, 0, "$181.28", "XGS 126 + XGS 2100", "Firewall-only"),
+    ("Martin Morris & Jones Wollongong", 0, 0, "$159.72", "XGS 2100 + XGS 107", "Firewall-only"),
+    ("Gunderson Briggs", 23, 2, "$136.11", "Endpoint + XGS 136", "25 assets - strong candidate"),
+    ("Custom Built Frames & Trusses", 3, 1, "$33.57", "Endpoint + XGS 107", "Small but bundleable"),
+    ("The Illawarra ITEC Ltd", 3, 1, "$14.21", "Endpoint only", "Small tenant"),
+    ("Tulich Project Management", 0, 2, "$13.24", "Server Endpoint only", "Needs MDR Essentials minimum"),
 ]
 
-cols = [("Customer", 52), ("Users", 14), ("Servers", 14), ("Current $", 22), ("Notes", 88)]
-pdf.table_header(cols)
-for i, (cust, users, servers, rev, notes) in enumerate(no_mdr):
-    pdf.table_row([(cust, 52, "L"), (str(users), 14, "C"), (str(servers), 14, "C"), (rev, 22, "R"), (notes, 88, "L")], i)
+cols_def = [("Customer", 52), ("Users", 12), ("Svrs", 12), ("Monthly $", 20), ("Current Products", 42), ("Opportunity", 52)]
+pdf.table_header(cols_def)
+for i, (cust, users, servers, rev, products, opp) in enumerate(no_mdr):
+    pdf.table_row([
+        (cust, 52, "L"), (str(users), 12, "C"), (str(servers), 12, "C"),
+        (rev, 20, "R"), (products, 42, "L"), (opp, 52, "L")
+    ], i)
 
-pdf.ln(6)
-
-pdf.sub_title("4b. Customers Without Sophos Firewall", SOPHOS_BLUE)
+# ===== SECTION 6: UPSELL - NO FIREWALL ====================================
+pdf.add_page()
+pdf.section_title("5. Upsell: Customers Without Sophos Firewall (20+ Users)")
 pdf.body_text(
-    "The following customers with 20+ users have no Sophos firewall (XGS, SF Virtual, or XG) "
-    "in their billing. These are candidates for Sophos Firewall or SF Virtual deployment, "
-    "especially those already on MDR Complete who would benefit from firewall-endpoint integration."
+    "Customers with 20 or more users and no Sophos firewall (XGS, SF Virtual, or XG) "
+    "in their billing. Sorted by monthly spend. Those already on MDR Complete "
+    "would benefit most from firewall-endpoint integration via Synchronized Security."
 )
 
 no_fw = [
-    ("Sydwest Multicultural Services", 114, 5, "$1,253.48", "MDR Complete, 119 assets. Large estate with NO firewall - top priority."),
-    ("Master Builders Assoc NSW", 94, 11, "$1,163.00", "MDR Complete, 105 assets. Major opportunity for XGS deployment."),
-    ("Martin Moris & Jones", 79, 2, "$967.30", "MDR Complete. 81 assets, no firewall."),
-    ("QCC", 82, 2, "$871.58", "MDR Complete. 84 assets, no network protection."),
-    ("Ingenuity Design Group", 67, 17, "$557.20", "MDR Essentials, 84 assets. Also upgrade path to MDR Complete."),
-    ("Community Gateway", 54, 2, "$586.82", "MDR Complete. 56 assets, no firewall."),
-    ("Macarthur Diversity Services", 42, 0, "$427.14", "MDR Complete. 42 users, no firewall, no servers."),
-    ("Arrow Electrical Services", 54, 0, "$408.20", "MDR Complete + ZTNA. No firewall and no servers - check if needed."),
+    ("Sydwest Multicultural Services", 114, 5, "$1,253.48", "Complete", "TOP PRIORITY - largest no-FW customer"),
+    ("Master Builders Assoc NSW", 94, 11, "$1,163.00", "Complete", "105 assets with no network protection"),
+    ("ReadiNow Corporation", 58, 66, "$1,121.98", "Essentials", "124 assets - also MDR upgrade candidate"),
+    ("Martin Moris & Jones", 79, 2, "$967.30", "Complete", "81 assets no firewall"),
+    ("QCC", 82, 2, "$871.58", "Complete", "84 assets no network protection"),
+    ("Community Gateway", 54, 2, "$586.82", "Complete", "56 assets"),
+    ("Ingenuity Design Group", 67, 17, "$557.20", "Essentials", "84 assets - also MDR upgrade candidate"),
+    ("Macarthur Diversity Services", 42, 0, "$427.14", "Complete", "No FW, no servers"),
+    ("Atlas Engineering Group", 30, 1, "$323.92", "Complete", "31 assets"),
+    ("Regupol", 26, 3, "$320.88", "Complete", "29 assets"),
+    ("Gordon MacDonald", 31, 0, "$294.45", "Complete", "31 users"),
+    ("MMJ Real Estate", 23, 0, "$233.91", "Complete", "23 users"),
+    ("QE Innovations", 19, 1, "$212.05", "Complete", "20 assets"),
+    ("IAP2 Australasia", 20, 0, "$203.40", "Complete", "20 users"),
+    ("Market St", 19, 0, "$193.23", "Complete", "19 users"),
+    ("Southern Pumping", 18, 0, "$183.06", "Complete", "18 users"),
+    ("Andrew Webb Accounting", 18, 0, "$183.06", "Complete", "18 users"),
+    ("Anisimoff Legal", 17, 0, "$172.89", "Complete", "17 users"),
 ]
 
-cols = [("Customer", 52), ("Users", 14), ("Servers", 14), ("Current $", 22), ("Opportunity", 88)]
-pdf.table_header(cols)
-for i, (cust, users, servers, rev, notes) in enumerate(no_fw):
-    pdf.table_row([(cust, 52, "L"), (str(users), 14, "C"), (str(servers), 14, "C"), (rev, 22, "R"), (notes, 88, "L")], i)
+cols_def = [("Customer", 52), ("Users", 14), ("Svrs", 14), ("Monthly $", 22), ("MDR Tier", 22), ("Opportunity", 66)]
+pdf.table_header(cols_def)
+for i, (cust, users, servers, rev, mdr, opp) in enumerate(no_fw):
+    pdf.table_row([
+        (cust, 52, "L"), (str(users), 14, "C"), (str(servers), 14, "C"),
+        (rev, 22, "R"), (mdr, 22, "C"), (opp, 66, "L")
+    ], i)
 
-pdf.ln(6)
-
-pdf.sub_title("4c. MDR Essentials to Complete Upgrade Path", SOPHOS_BLUE)
+# ===== SECTION 7: MDR ESSENTIALS TO COMPLETE ===============================
+pdf.add_page()
+pdf.section_title("6. MDR Essentials to Complete Upgrade Path")
 pdf.body_text(
-    "These customers have MDR Essentials and could be upgraded to MDR Complete for full "
-    "24/7 managed threat response. MDR Complete adds human-led threat hunting, incident "
-    "response, and a dedicated response team."
+    "These customers currently have MDR Essentials and are candidates for upgrade to "
+    "MDR Complete. MDR Complete adds human-led threat hunting, full incident response, "
+    "and a dedicated Sophos response team. Sorted by monthly spend."
 )
 
-essentials_upgrade = [
-    ("ReadiNow Corporation", 58, 66, "$1,121.98", "124 assets on Essentials. Largest Essentials customer - high value upgrade."),
-    ("Moduplay Group", 125, 2, "$816.40", "127 assets on Essentials + 3 firewalls. Large estate."),
-    ("Ingenuity Design Group", 67, 17, "$557.20", "84 assets on Essentials. Also no firewall."),
-    ("National Justice Project", 29, 0, "$149.64", "29 users on Essentials."),
+essentials = [
+    ("ReadiNow Corporation", 58, 66, "$1,121.98", "124 assets on Essentials - largest upgrade opportunity"),
+    ("Moduplay Group", 125, 2, "$816.40", "127 assets + 3 firewalls"),
+    ("Ingenuity Design Group", 67, 17, "$557.20", "84 assets - also no firewall"),
+    ("National Justice Project", 29, 0, "$149.64", "29 users on Essentials"),
 ]
 
-cols = [("Customer", 52), ("Users", 14), ("Servers", 14), ("Current $", 22), ("Notes", 88)]
-pdf.table_header(cols)
-for i, (cust, users, servers, rev, notes) in enumerate(essentials_upgrade):
-    pdf.table_row([(cust, 52, "L"), (str(users), 14, "C"), (str(servers), 14, "C"), (rev, 22, "R"), (notes, 88, "L")], i)
+cols_def = [("Customer", 52), ("Users", 16), ("Servers", 16), ("Monthly $", 24), ("Notes", 82)]
+pdf.table_header(cols_def)
+for i, (cust, users, servers, rev, notes) in enumerate(essentials):
+    pdf.table_row([
+        (cust, 52, "L"), (str(users), 16, "C"), (str(servers), 16, "C"),
+        (rev, 24, "R"), (notes, 82, "L")
+    ], i)
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# SECTION 5: NO SERVER PROTECTION
-# ═══════════════════════════════════════════════════════════════════════════════
-pdf.add_page()
-pdf.section_title("5. No Server Protection Enrolled")
+pdf.ln(8)
+
+# ===== SECTION 8: NO SERVER PROTECTION =====================================
+pdf.section_title("7. No Server Protection Enrolled (14 Tenants)")
 pdf.body_text(
-    "14 tenants have no server protection enrolled in Sophos Central. These customers either "
-    "have no servers or their servers are unprotected. For customers with on-premises or "
-    "cloud infrastructure, server protection is essential."
+    "These tenants have no server protection enrolled in Sophos Central. For customers "
+    "with on-premises or cloud servers, Sophos Server Protection or MDR Server should "
+    "be deployed. Some may genuinely have no servers (SaaS-only organisations)."
 )
 
 no_server = [
-    "Big Fat Smile", "Intrec Management Pty Ltd", "ROKT Pty Limited",
-    "Golden West Holden", "Etheridge Ford", "Gateway Motor Group",
-    "C-Lite Pty Ltd", "C-Lite", "True Blue Chemicals",
-    "Sydney Auto Paint", "CHL Wollongong Pty Limited", "Pumps United",
-    "Seapost Pty Ltd t/as Dion's Bus Service", "Kiama Community College",
+    "Big Fat Smile",
+    "Intrec Management Pty Ltd",
+    "ROKT Pty Limited",
+    "Golden West Holden",
+    "Etheridge Ford",
+    "Gateway Motor Group",
+    "C-Lite Pty Ltd",
+    "C-Lite",
+    "True Blue Chemicals",
+    "Sydney Auto Paint",
+    "CHL Wollongong Pty Limited",
+    "Pumps United",
+    "Seapost Pty Ltd t/as Dion's Bus Service",
+    "Kiama Community College",
 ]
 
-cols = [("Customer", 95), ("Recommended Action", 95)]
-pdf.table_header(cols)
+cols_def = [("Customer", 95), ("Recommended Action", 95)]
+pdf.table_header(cols_def)
 for i, cust in enumerate(no_server):
     action = "Assess server estate; deploy Sophos Server Protection or MDR Server"
     pdf.table_row([(cust, 95, "L"), (action, 95, "L")], i)
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# SECTION 6: ACTION PLAN
-# ═══════════════════════════════════════════════════════════════════════════════
-pdf.ln(8)
-pdf.section_title("6. Recommended Action Plan")
+# ===== SECTION 9: ACTION PLAN =============================================
+pdf.add_page()
+pdf.section_title("8. Recommended Action Plan")
+
+# Immediate
+pdf.sub_title("Immediate - This Week", SOPHOS_RED)
+imm = [
+    ("Fix Critical TP Gaps", "Re-enable tamper protection on 4 tenants at 0%: Marco Polo Aged Care, Unibuild, MasterCraft Windows and Doors, Martin Morris & Jones Sydney"),
+    ("Investigate WIN Sports", "2 enrolled servers showing 0% protection - determine root cause"),
+    ("Fix Durham Green", "TP at 59% - multiple endpoints need TP re-enabled"),
+]
+cols_def = [("Action", 50), ("Detail", 140)]
+pdf.table_header(cols_def)
+for i, (action, detail) in enumerate(imm):
+    pdf.table_row([(action, 50, "L"), (detail, 140, "L")], i)
 
-pdf.sub_title("Immediate (This Week)", SOPHOS_RED)
-pdf.body_text(
-    "1. Re-enable tamper protection on the 4 critical tenants (Marco Polo Aged Care, "
-    "Unibuild, MasterCraft, Martin Morris & Jones Sydney)\n"
-    "2. Investigate WIN Sports server protection at 0%\n"
-    "3. Fix Durham Green (59% TP) - multiple endpoints need TP re-enabled"
-)
+pdf.ln(6)
 
-pdf.sub_title("Short Term (This Month)", SOPHOS_AMBER)
-pdf.body_text(
-    "4. Remediate all server TP gaps (Southern Truck, Gunderson Briggs, IOH, PPM, Sydney Auto Paints)\n"
-    "5. Clean up moderate TP gaps (10 tenants with 92-99% scores - likely stale devices)\n"
-    "6. Begin conversations with top MDR upsell targets: Southern Truck Centre (41 users), "
-    "Gunderson Briggs (25 assets)"
-)
+# Short term
+pdf.sub_title("Short Term - This Month", SOPHOS_AMBER)
+short = [
+    ("Fix Server TP Gaps", "Southern Truck Centre, Gunderson Briggs, IOH, Project Portfolio Management, Sydney Automotive Paints & Equipment"),
+    ("Clean Up Moderate Gaps", "10 tenants with 92-99% TP scores - likely stale devices to remove or re-enable"),
+    ("Begin MDR Conversations", "Top targets: Southern Truck Centre (43 assets), Gunderson Briggs (25 assets), Tulich Project Management (servers with no MDR)"),
+]
+cols_def = [("Action", 50), ("Detail", 140)]
+pdf.table_header(cols_def)
+for i, (action, detail) in enumerate(short):
+    pdf.table_row([(action, 50, "L"), (detail, 140, "L")], i)
 
-pdf.sub_title("Quarterly Business Review Conversations", SOPHOS_BLUE)
-pdf.body_text(
-    "7. Firewall opportunities: Sydwest Multicultural (114 users, no FW), Master Builders (105 assets, no FW), "
-    "QCC (84 assets, no FW)\n"
-    "8. MDR Complete upgrades: ReadiNow (124 assets), Moduplay (127 assets), Ingenuity Design (84 assets)\n"
-    "9. Server protection for the 14 tenants with no server enrollment\n"
-    "10. Review all 142 billing customers against the 153 tenants - 11 tenants have no billing "
-    "(may be trial, internal, or decommissioned)"
-)
+pdf.ln(6)
 
+# QBR
+pdf.sub_title("QBR Conversations", SOPHOS_BLUE)
+qbr = [
+    ("Firewall Opportunities", "Sydwest Multicultural (114 users), Master Builders (94 users), QCC (82 users) - all MDR Complete with no firewall"),
+    ("MDR Complete Upgrades", "ReadiNow (124 assets), Moduplay (127 assets), Ingenuity Design (84 assets) - all on MDR Essentials"),
+    ("Server Protection", "14 tenants with no server enrolment - assess server estates and deploy protection"),
+]
+cols_def = [("Action", 50), ("Detail", 140)]
+pdf.table_header(cols_def)
+for i, (action, detail) in enumerate(qbr):
+    pdf.table_row([(action, 50, "L"), (detail, 140, "L")], i)
+
+pdf.ln(10)
+
+# Data source note
+pdf.set_draw_color(*SOPHOS_BLUE)
+pdf.set_line_width(0.3)
+pdf.line(10, pdf.get_y(), 200, pdf.get_y())
 pdf.ln(4)
-pdf.set_font("Helvetica", "I", 9)
+pdf.set_font("Helvetica", "I", 8)
 pdf.set_text_color(*SOPHOS_GREY)
-pdf.multi_cell(0, 5, (
-    "Data sourced from Sophos Central API via MCP Server v0.2.6. "
+pdf.multi_cell(0, 4.5, (
+    "Data sourced from Sophos Central API via MCP Server v0.2.4. "
     "Health data from Account Health Check API. Billing data from Partner Billing Usage API (March 2026). "
     "All monetary values in AUD at partner net pricing."
 ))
 
-# ── Save ──
+# == Save ==================================================================
 out_dir = r"C:\Users\Aaron.Jacobs\OneDrive - Sophos Ltd\projects"
 out_path = os.path.join(out_dir, "Rodin_Sophos_Estate_Health_Report_March_2026.pdf")
 pdf.output(out_path)
 print(f"Report saved to: {out_path}")
+print(f"Pages: {pdf.page_no()}")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sophos-central-mcp-server",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "MCP server for Sophos Central API - SOC monitoring, endpoint management, admin automation, and XDR investigation",
   "type": "module",
   "main": "dist/index.js",