Loading ToolBench
MCP server for Sophos Central — endpoint management, EDR/XDR detections, alerts, Live Discover queries, and security policy management
The Sophos Central MCP server demonstrates solid definition quality with consistent tool naming, descriptions, and parameter schemas across 28 tools. All tools follow a clear verb_noun pattern (list_*, get_*, acknowledge_*, etc.). Descriptions are present and substantive (ranging 80-250 chars), exceeding the 20-char minimum. Input schemas are properly defined with JSON Schema types, enums for constrained inputs, and descriptive parameter annotations. However, there are notable gaps: (1) output schemas are not documented, the rubric requires documenting return types for all tools, and only 0% of tools have explicit output schema documentation in the source; (2) no tool annotations (readOnlyHint, destructiveHint, idempotentHint) are present despite the server exposing destructive tools like shutdown_endpoint; (3) error handling is not visible in the source excerpts, recovery guidance and error categorization are absent; (4) some parameter relationships are undocumented (e.g., the interaction between severity/type filters in list_detections). The server does accept human-friendly identifiers (endpoint_id can be either ID or hostname per get_endpoint description), which is good. Pagination is properly implemented with pageSize and page parameters across discovery tools. The strongest tools are the discovery/read tools (list_alerts, get_endpoint, search_events) which have clear enum constraints and well-scoped parameters. Weakest aspect is the lack of output documentation and error handling guidance.
Acknowledge a Sophos Central alert — marks it as reviewed without resolving it
Get full details of a specific Sophos Central alert including description, managed agent info, and available response actions
List available response actions for a specific Sophos Central alert — determines what actions can be performed
Get all detections within a Sophos threat case — shows every detection that contributed to the case
Get full details of a Sophos EDR/XDR detection including process tree, MITRE ATT&CK mapping, indicators, and raw event data
Get full details of a specific endpoint including health status, agent version, policies, and installed products
No output schemas documented for any tool. The rubric requires 100% of A+ tools to have documented return types. Agents cannot plan downstream calls or extract needed fields without knowing output structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 56 | 2025-06-18+ | v2 |
| 2026-03-09 | D | 51 | - | v1 |
Get installed software and applications on a specific endpoint
Get full details of a specific security event including process information, network connections, and file modifications
Retrieve results from a previously executed Live Discover query
Get full details and settings of a specific security policy
Get configuration settings for a specific security policy including threat detection rules and protection levels
Get details of a saved Live Discover query including the SQL template and variable definitions
Get overall security health and risk assessment for the Sophos Central tenant
Get detailed information about the Sophos Central tenant including subscription details and feature enablement
List Sophos threat cases — groups of related EDR/XDR detections that form a single incident narrative
Network-isolate an endpoint to contain a threat — prevents outbound connections while maintaining Sophos console access
List Sophos Central alerts with optional filters for severity, category, product, and date range
List Sophos EDR/XDR detections with optional filters for severity, type, endpoint, and date range
List all endpoints in Sophos Central with optional filters for health status, OS, and agent version
List all scanning exclusions defined in a security policy
List all security policies in Sophos Central with optional filters
List all saved Live Discover queries available in the tenant
Resolve and close a Sophos Central alert with a description of the action taken
Execute a Live Discover osquery SQL query on endpoints to collect forensic and operational data
Trigger an on-demand antivirus/threat scan on a specific endpoint
Search security events across endpoints with optional filters for event type, severity, and date range
Force shutdown a specific endpoint remotely
Remove network isolation from an endpoint to restore normal connectivity
No tool annotations present. Destructive/reversible tools (shutdown_endpoint, isolate_endpoint, unisolate_endpoint, resolve_alert, acknowledge_alert, scan_endpoint) lack readOnlyHint, destructiveHint, or idempotentHint annotations. This prevents clients from applying appropriate caution UI or safety logic.
Error handling and recovery guidance not visible in source. Tools lack documented error categories (retryable, user-fixable, fatal) and actionable error messages. For example, shutdown_endpoint and isolate_endpoint (destructive/reversible operations) should support dry-run or confirmation steps; no such pattern is evident.
shutdown_endpoint description is terse (60 chars: 'Force shutdown a specific endpoint remotely'). Missing: 'This is a destructive, irreversible action that will immediately shut down the endpoint, terminating all processes and user sessions.'
Undocumented parameter relationships. Example: in resolve_alert, the 'action' enum includes values like 'cleanPua', 'clean', 'authPua', but the tool description does not explain when each is appropriate or how they map to different alert types. In list_detections, 'severity' and 'type' filters are available but their interaction is not documented.
Some discovery tools (get_tenant_health, get_tenant_info, get_alert_actions) lack detail on when to call them and what structure they reveal. Per pattern, discovery tools should explain 'Call this first to see available options before generating.'