[BESAdmin-Announcements] The BigFix Platform MCP Server is now available!

[Announcements for BES Administrators]

The BigFix Platform Team is pleased to announce the availability of the BigFix
Platform MCP Server, a new component that lets you plug your AI assistant
of choice directly into BigFix. Through the MCP Server an LLM can retrieve
data from your BigFix environment and help you author and run BigFix
actions on your endpoints, using natural language. Security controls are
provided and enforced on interaction of the LLM with the BigFix Platform,
allowing you to tailor the solution to your needs.

AI meets BigFix through an open standard!

The BigFix Platform MCP Server is built on the Model Context Protocol (MCP),
an open standard that allows AI clients, such as Copilot, to connect to
external tools and services through a consistent interface. A MCP server
exposes APIs that an AI assistant can call to retrieve data or perform
operations in connected systems.

The BigFix Platform MCP Server introduces a managed MCP service for BigFix
that runs in streamable HTTP mode over HTTPS, so it can be reached by any
network-accessible MCP client.

What you can do with it

The new component supports the following BigFix scenarios:

   -

   Action lifecycle management: list actions, retrieve details and status,
   inspect and retry downloads, stop actions, create actions, and delete
   actions.
   -

   Custom action authoring: author custom actions with the assistance of
   your LLM.
   -

   Fixlet and Task deployment: deploy existing Fixlets or Tasks through
   action creation.
   -

   Computer listing: list managed computers and retrieve the details of a
   specific computer.
   -

   Fixlet discovery: list the Fixlets in a site and retrieve full Fixlet
   details by site and ID.
   -

   Session Relevance evaluation: evaluate Session Relevance through BigFix
   Web Reports or BigFix Explorer


Secure by default

The BigFix Platform MCP Server is intentionally conservative from a
security perspective, with layered guardrails that reduce the risk of
autonomously executing destructive operations:

   -

   Token-based authentication: the service is designed as a
   token-forwarding gateway. Each MCP request must carry a valid BigFix REST
   API token in the Authorization header, which is forwarded to the BigFix
   Platform REST API, so every request runs with the permissions of its own
   token. This relies on the REST API token support introduced in BigFix
   11.0.6. For details, see Configuring bearer token authentication
   <https://help.hcl-software.com/bigfix/11.0/platform/Platform/Config/c_token_authentication.html>
   .
   -

   Strict read-only mode by default: write-capable tool families are
   disabled and hidden unless an administrator explicitly enables them in the
   server configuration (mcp_server.read_only: false) and the MCP client also
   opts in on the request with the X-Bes-Mcp-Read-Only: false header.
   -

   Human-in-the-Loop protection enabled by default: for critical write
   operations, the AI client is instructed to stop and request explicit user
   confirmation before sending any payload that triggers persistent
   modifications to the environment. This protection remains active even when
   write access is enabled, unless it is explicitly disabled.
   -

   TLS supported natively: you can provide your own certificate and key, or
   let the service automatically generate self-signed certificates in its
   workspace.


Getting started

   -

   Requirements: BigFix Platform Version 11.0.6 or later is required
   -

   Supported targets: Windows Server 2022 or later (64-bit) and Red Hat
   Enterprise Linux 9 or 10 (64-bit).
   -

   Installation: Task 6073: "Install BigFix MCP Server (Version 1.0.0)" is
   available in BES Support site version 1514 or later. The server can be
   installed either directly on the BigFix Root Server or on a separate
   endpoint, as long as that endpoint can reach the Root Server on port 52311.

Useful links

   -

   BigFix MCP Platform documentation
   <https://help.hcl-software.com/bigfix/11.0/platform/Platform/MCP/c_introduction.html>
   -

   Configuring bearer token authentication (BigFix 11.0.6)
   <https://help.hcl-software.com/bigfix/11.0/platform/Platform/Config/c_token_authentication.html>



Continue to discuss on the forum
<https://forum.bigfix.com/t/the-bigfix-platform-mcp-server-is-now-available/55245>

– HCL BigFix – Platform Team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260805/0b90e375/attachment.html>