MCP Interface (AI Integration)

DATAZONE Control provides an MCP (Model Context Protocol) interface that allows AI assistants like Claude Code, Claude Desktop, or Cursor to directly access the platform.

Overview

The Model Context Protocol (MCP) is an open standard by Anthropic that enables AI assistants to access external tools and data sources. With the DATAZONE MCP integration, you can:

• Ask questions: "Which servers have critical alerts?"
• Analyze hosts: "Analyze the status of srv-web-01"
• Generate reports: "Create a security report for customer XY"
• Execute actions: "Trigger an update on all Linux servers"

MCP Tokens

Creating a Token

1. Navigate to Settings > MCP Tokens
2. Click Create Token
3. Enter a descriptive name (e.g., "Claude Code Florian")
4. Select the permission scope:
   • Read: Query hosts, alerts, compliance, dashboard
   • Read + Write: Additionally execute scripts, create tasks, trigger updates
   • Admin: Full access including user management and settings
5. Optional: Set an expiration date (30 days, 90 days, 1 year)
6. Important: Copy the displayed token immediately — it is only shown once!

Security

• Tokens are stored as SHA-256 hashes (never in plain text)
• Each token inherits the permissions of its creator
• Expired tokens are automatically deactivated
• Rate limiting protects against abuse (60/30/20 requests per minute depending on scope)

Client Configuration

Claude Code (VSCode)

Create .vscode/mcp.json in your project:

{
  "servers": {
    "datazone": {
      "type": "sse",
      "url": "http://control.datazone.de:8080/mcp/sse"
    }
  }
}

Claude Desktop

Add to your Claude Desktop configuration:

{
  "mcpServers": {
    "datazone": {
      "url": "http://control.datazone.de:8080/mcp/sse",
      "transport": "sse"
    }
  }
}

Available Tools

Read Tools (Read Scope)

Tool	Description
list_hosts	List all hosts, optionally filter by module
get_host	Get host details
get_alerts	Get security alerts from Wazuh
get_compliance	Get SCA compliance scores
get_dashboard	Dashboard statistics
get_customers	Customer list
get_groups	Host groups
get_audit_log	Audit log entries
search_hosts	Search hosts by name/IP
get_update_status	Pending updates overview
analyze_host	Smart Tool: Combined host analysis (details + alerts + compliance)
get_problems	Smart Tool: All current problems at a glance
get_windows_updates	Global Windows update overview with approval status
list_schedules	List update/script/playbook schedules

Search Tools (Read Scope)

Search across all host detail data across all modules:

Tool	Description	Example
search_software	Search installed software on Windows hosts	search_software("Chrome")
search_hardware	Search hardware info: CPU, RAM, GPU, serial number	search_hardware("Xeon")
search_disks	Search disks by usage or mount point	search_disks(min_usage=90)
search_services	Search Windows, Linux, and OPNsense services	search_services("nginx")
search_ports	Search open ports on Linux/PVE/PBS	search_ports(port=443)
search_network	Search network interfaces: IP, MAC, name	search_network("10.100.")
search_docker	Search Docker containers on Linux hosts	search_docker("postgres")
search_vms	Search virtual machines on PVE hosts	search_vms("windows")
search_updates	Search pending updates (Linux + Windows)	search_updates("kernel")
search_cron	Search cron jobs on Linux/PVE/PBS	search_cron("backup")
search_ssh	Search active SSH sessions	search_ssh("root")
search_backups	Search backups on PVE + PBS	search_backups("failed")
search_vpn	Search VPN tunnels on OPNsense firewalls	search_vpn("wireguard")

Write Tools (Read-Write Scope)

Tool	Description
execute_script	Execute script on hosts
create_task	Create agent task (update, reboot, etc.)
trigger_update	Trigger system update
execute_check	Execute compliance check
create_tunnel	Create SSH tunnel
execute_playbook	Execute playbook
generate_report	Generate security or infrastructure report

Admin Tools

Tool	Description
manage_users	Manage users (list, create, delete)
update_settings	Change system settings

Prompt Templates

MCP Prompts are pre-built workflows that the AI assistant can execute:

Prompt	Description
security-report	Comprehensive security report with alerts, compliance, and recommendations
infrastructure-summary	Infrastructure status overview across all modules
incident-response	Guided incident response workflow

Examples

Query Hosts

"Show me all Linux servers and their status"
→ Claude uses list_hosts(module="linux")

Identify Problems

"Are there any critical problems right now?"
→ Claude uses get_problems()

Analyze Host

"Analyze the server fw-main"
→ Claude uses analyze_host("fw-main")

Security Report

"Create a security report"
→ Claude uses the security-report prompt and calls multiple tools

Search Infrastructure

"Which servers have Google Chrome installed?"
→ Claude uses search_software("Chrome")

"Which server has 128 GB RAM?"
→ Claude uses search_hardware("128")

"Where are disks more than 90% full?"
→ Claude uses search_disks(min_usage=90)

"Which hosts have port 443 open?"
→ Claude uses search_ports(port=443)

"Which servers run the Docker container nginx?"
→ Claude uses search_docker("nginx")

"Show all running VMs"
→ Claude uses search_vms("running")

"Which hosts have pending security updates?"
→ Claude uses search_updates("security")

"Who is currently logged in via SSH?"
→ Claude uses search_ssh("")

"Show all VPN tunnels"
→ Claude uses search_vpn("")