Fleet MCP Server for Device Management & Security

Overview

Fleet MCP Server is an open-source Model Context Protocol (MCP) implementation designed for device management and security at scale. It acts as a centralized back end for host lifecycle management, live query execution, policy enforcement, software inventory, vulnerability tracking, and mobile device management (MDM). By exposing a consistent MCP-compatible API, it integrates with agents and orchestration layers to provide real-time visibility and automated remediation across a fleet of devices.

This server is useful for teams that need a programmatic, auditable way to manage endpoints. It supports live SQL-style queries for immediate diagnostics, scheduled policies for compliance, software and vulnerability inventories for risk assessment, and MDM actions for mobile or managed devices. The project is maintained on GitHub: https://github.com/SimplyMinimal/fleet-mcp

Features

• Host management (enrollment, metadata, grouping)
• Live queries with ad-hoc SQL execution against device datasets
• Policy management (create, schedule, evaluate, and enforce)
• Software inventory collection and reporting
• Vulnerability tracking and CVE mapping
• Mobile Device Management (MDM) actions: install, lock, wipe, profile management
• RESTful MCP-compatible API with token-based authentication
• Pluggable storage (SQLite / Postgres) and TLS support
• Audit logging and event history for compliance

Installation / Configuration

Prerequisites: Go toolchain (optional for building), Docker (recommended), a Postgres database for production.

Quick start with Docker:

# Run with SQLite (simplest, not for production)
docker run --rm -p 8080:8080 \
  -e DATABASE_URL=sqlite:///data/fleet-mcp.db \
  -e MCP_JWT_SECRET=replace-with-secret \
  simplyminimal/fleet-mcp:latest

# Run with Postgres
docker run --rm -p 8080:8080 \
  -e DATABASE_URL=postgres://user:pass@db:5432/fleet_mcp?sslmode=disable \
  -e MCP_JWT_SECRET=replace-with-secret \
  simplyminimal/fleet-mcp:latest

Build from source (for contributors or custom builds):

git clone https://github.com/SimplyMinimal/fleet-mcp.git
cd fleet-mcp
# Build binary
go build -o fleet-mcp ./cmd/server
# Run
./fleet-mcp --config config.yaml

Example config.yaml (minimal):

server:
  listen: ":8080"
  tls:
    cert: ""
    key: ""
database:
  url: "postgres://user:pass@localhost:5432/fleet_mcp?sslmode=disable"
auth:
  jwt_secret: "replace-with-secret"
logging:
  level: "info"

Database migration and initialization:

# If using the binary, the server auto-runs migrations on startup.
# Or run explicit migration command if provided:
./fleet-mcp migrate --database "$DATABASE_URL"

Environment variables commonly used:

• DATABASE_URL — connection string for SQLite/Postgres
• MCP_JWT_SECRET — JWT secret for API/auth tokens
• MCP_PORT / SERVER_LISTEN — listening address (example: :8080)
• TLS_CERT / TLS_KEY — paths for TLS certificate and key

Available Resources

• GitHub repository (source, issues, contributions): https://github.com/SimplyMinimal/fleet-mcp
• REST API: MCP-compatible endpoints for enrollment, queries, policies, inventory, vulnerabilities, and MDM
• OpenAPI / Swagger (if present in repo) for interactive API exploration
• Agent integrations: use MCP-capable agents to enroll devices and execute queries
• Example clients: curl examples, CLI utilities, and minimal SDKs can be created against the API

Common endpoints (example):

Usage Examples

Enroll a device (simplified):

curl -X POST https://mcp.example.com/enroll \
  -H "Content-Type: application/json" \
  -d '{"hostname":"host-01","platform":"linux","public_key":"..."}'
# Returns device token to use for subsequent requests

Run a live query against a host:

curl -X POST https://mcp.example.com/queries \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query":"SELECT name, version FROM packages WHERE installed = 1",
    "targets":["host-01"]
  }'

Create a policy (compliance rule):

curl -X POST https://mcp.example.com/policies \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"SSH Password Authentication Disabled",
    "query":"SELECT value FROM system_settings WHERE key='sshd_password_auth'",
    "condition":"value = 'no'",
    "remediation":"disable_password_auth.sh",
    "frequency":"24h"
  }'

Trigger an MDM action (example: lock device):

curl -X POST https://mcp.example.com/mdm/actions \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action":"lock",
    "target":["device-uuid-1234"],
    "reason":"Lost device"
  }'

Use Cases

• Compliance automation: define policies that run automatically and report noncompliant hosts. Use scheduled remediation to enforce configurations.
• Incident response: run live queries across a subset of devices to quickly collect indicators of compromise, then isolate or remediate affected hosts.
• Software inventory and licensing: maintain an authoritative inventory of installed software across the fleet to support licensing audits and upgrades.
• Vulnerability tracking: map software packages to known CVEs and prioritize patching workflows based on exposure and asset criticality.
• MDM for mobile devices: deploy configuration profiles, push apps, remotely lock or wipe devices when compromised or lost.

Next Steps

• Clone the repository and review the README and OpenAPI specs: https://github.com/SimplyMinimal/fleet-mcp
• Try the Docker image for a quick evaluation, then connect an MCP-capable agent to enroll test hosts.
• Integrate with your CI/CD or SIEM systems to surface inventory, vulnerability, and compliance events into existing workflows.