x=hub

your toolset

    build deployment
    sign in

    Sophos Central MCP

    mcpother
    io.github.Servosity/sophos-central-mcp · v0.1.1
    deploy just this

    The Sophos Central partner, organization and tenant APIs, routed to the right tenant and region

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # once, as root:
docker build -t mcp-local/sophos-central:latest 'https://github.com/servosity/msp-skills.git#:skills/sophos-central'

#!/usr/bin/env bash
# sophos-central (io.github.Servosity/sophos-central-mcp), recipe docker (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-sophos-central.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec docker run --rm --name mcp-my-agent-sophos-central -p 127.0.0.1:${PORT}:8000 -e SOPHOS_CENTRAL_CLIENT_ID -e SOPHOS_CENTRAL_CLIENT_SECRET -e SOPHOS_CENTRAL_TENANT_ID -e SOPHOS_CENTRAL_BASE_URL -e SOPHOS_CENTRAL_TOKEN_URL -e SOPHOS_CENTRAL_OAUTH_SCOPE -e SOPHOS_CENTRAL_MCP_READ_ONLY -e SOPHOS_CENTRAL_MCP_HTTP_TOKEN -e SOPHOS_CENTRAL_USER_AGENT -e PRINTING_PRESS_CLIENT_PROFILE mcp-local/sophos-central:latest

[Unit]
Description=MCP server sophos-central (toolset my-agent), generated by Hub
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
SupplementaryGroups=docker
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/sophos-central
WorkingDirectory=/var/lib/mcp/sophos-central
ExecStart=/opt/mcp/my-agent/bin/sophos-central.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/sophos-central

[Install]
WantedBy=multi-user.target
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    docker build -t sophos-central 'https://github.com/servosity/msp-skills.git#:skills/sophos-central'
docker run --rm -p 127.0.0.1:8101:8000 -e SOPHOS_CENTRAL_CLIENT_ID -e SOPHOS_CENTRAL_CLIENT_SECRET -e SOPHOS_CENTRAL_TENANT_ID -e SOPHOS_CENTRAL_BASE_URL -e SOPHOS_CENTRAL_TOKEN_URL -e SOPHOS_CENTRAL_OAUTH_SCOPE -e SOPHOS_CENTRAL_MCP_READ_ONLY -e SOPHOS_CENTRAL_MCP_HTTP_TOKEN -e SOPHOS_CENTRAL_USER_AGENT -e PRINTING_PRESS_CLIENT_PROFILE sophos-central
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-19T00:31:41+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
#   cp .env.example .env    # fill the ${VAR}s
#   docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
  sophos-central:
    build:
      context: https://github.com/servosity/msp-skills.git#:skills/sophos-central
    ports:
    - 127.0.0.1:8101:8000
    restart: unless-stopped
    x-note: 'CHANGE_ME: built from the repository''s Dockerfile, assuming it serves streamable HTTP at
      :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.'
    environment:
      SOPHOS_CENTRAL_CLIENT_ID: ${SOPHOS_CENTRAL_CLIENT_ID}
      SOPHOS_CENTRAL_CLIENT_SECRET: ${SOPHOS_CENTRAL_CLIENT_SECRET}
      SOPHOS_CENTRAL_TENANT_ID: ${SOPHOS_CENTRAL_TENANT_ID}
      SOPHOS_CENTRAL_BASE_URL: ${SOPHOS_CENTRAL_BASE_URL}
      SOPHOS_CENTRAL_TOKEN_URL: ${SOPHOS_CENTRAL_TOKEN_URL}
      SOPHOS_CENTRAL_OAUTH_SCOPE: ${SOPHOS_CENTRAL_OAUTH_SCOPE}
      SOPHOS_CENTRAL_MCP_READ_ONLY: ${SOPHOS_CENTRAL_MCP_READ_ONLY}
      SOPHOS_CENTRAL_MCP_HTTP_TOKEN: ${SOPHOS_CENTRAL_MCP_HTTP_TOKEN}
      SOPHOS_CENTRAL_USER_AGENT: ${SOPHOS_CENTRAL_USER_AGENT}
      PRINTING_PRESS_CLIENT_PROFILE: ${PRINTING_PRESS_CLIENT_PROFILE}
volumes:
  npm-cache: {}
  uv-cache: {}
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-19T00:31:41+00:00).
#   kubectl create namespace mcp
#   kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
#   kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
  name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sophos-central
  namespace: mcp
  labels: &id001
    app: sophos-central
spec:
  replicas: 1
  selector:
    matchLabels: *id001
  template:
    metadata:
      labels: *id001
    spec:
      containers:
      - name: sophos-central
        image: CHANGE_ME
        ports:
        - containerPort: 8000
          name: http
        env:
        - name: SOPHOS_CENTRAL_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_CLIENT_ID
        - name: SOPHOS_CENTRAL_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_CLIENT_SECRET
        - name: SOPHOS_CENTRAL_TENANT_ID
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_TENANT_ID
        - name: SOPHOS_CENTRAL_BASE_URL
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_BASE_URL
        - name: SOPHOS_CENTRAL_TOKEN_URL
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_TOKEN_URL
        - name: SOPHOS_CENTRAL_OAUTH_SCOPE
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_OAUTH_SCOPE
        - name: SOPHOS_CENTRAL_MCP_READ_ONLY
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_MCP_READ_ONLY
        - name: SOPHOS_CENTRAL_MCP_HTTP_TOKEN
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_MCP_HTTP_TOKEN
        - name: SOPHOS_CENTRAL_USER_AGENT
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: SOPHOS_CENTRAL_USER_AGENT
        - name: PRINTING_PRESS_CLIENT_PROFILE
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: PRINTING_PRESS_CLIENT_PROFILE
---
apiVersion: v1
kind: Service
metadata:
  name: sophos-central
  namespace: mcp
spec:
  selector:
    app: sophos-central
  ports:
  - port: 8000
    targetPort: http
    name: http
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-19T00:31:41+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
  sophos-central:
    enabled: true
    replicas: 1
    port: 8000
    path: /mcp
    container:
      name: sophos-central
      image: CHANGE_ME
      ports:
      - containerPort: 8000
        name: http
      env:
      - name: SOPHOS_CENTRAL_CLIENT_ID
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_CLIENT_ID
      - name: SOPHOS_CENTRAL_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_CLIENT_SECRET
      - name: SOPHOS_CENTRAL_TENANT_ID
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_TENANT_ID
      - name: SOPHOS_CENTRAL_BASE_URL
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_BASE_URL
      - name: SOPHOS_CENTRAL_TOKEN_URL
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_TOKEN_URL
      - name: SOPHOS_CENTRAL_OAUTH_SCOPE
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_OAUTH_SCOPE
      - name: SOPHOS_CENTRAL_MCP_READ_ONLY
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_MCP_READ_ONLY
      - name: SOPHOS_CENTRAL_MCP_HTTP_TOKEN
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_MCP_HTTP_TOKEN
      - name: SOPHOS_CENTRAL_USER_AGENT
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: SOPHOS_CENTRAL_USER_AGENT
      - name: PRINTING_PRESS_CLIENT_PROFILE
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: PRINTING_PRESS_CLIENT_PROFILE

# helm install my-agent helm/my-agent -n mcp

    in the cloud

    one click: the provider's deploy form opens filled in, in your own account
    koyeb
    deploy to koyeb

    The form opens with CHANGE_ME for each value you supply: SOPHOS_CENTRAL_CLIENT_ID, SOPHOS_CENTRAL_CLIENT_SECRET, SOPHOS_CENTRAL_TENANT_ID, SOPHOS_CENTRAL_BASE_URL, SOPHOS_CENTRAL_TOKEN_URL, SOPHOS_CENTRAL_OAUTH_SCOPE, SOPHOS_CENTRAL_MCP_READ_ONLY, SOPHOS_CENTRAL_MCP_HTTP_TOKEN, SOPHOS_CENTRAL_USER_AGENT, PRINTING_PRESS_CLIENT_PROFILE. Fill them in before you deploy.

    Koyeb builds the repository's Dockerfile from branch main; change the branch in the form if the default one has another name.

    Clients connect to the service's https://…koyeb.app address plus /mcp.

    cloud run
    run on google cloud

    Cloud Shell clones the repository, builds its Dockerfile and deploys it to Cloud Run.

    Cloud Run sends requests to $PORT (8080); the recipe expects :8000, so the server has to read PORT, or set the container port on the service afterwards.

    Set SOPHOS_CENTRAL_CLIENT_ID, SOPHOS_CENTRAL_CLIENT_SECRET, SOPHOS_CENTRAL_TENANT_ID, SOPHOS_CENTRAL_BASE_URL, SOPHOS_CENTRAL_TOKEN_URL, SOPHOS_CENTRAL_OAUTH_SCOPE, SOPHOS_CENTRAL_MCP_READ_ONLY, SOPHOS_CENTRAL_MCP_HTTP_TOKEN, SOPHOS_CENTRAL_USER_AGENT, PRINTING_PRESS_CLIENT_PROFILE on the service afterwards: the button asks only for what the repository's own app.json lists.

    connect to it

    copy what your client needs
    {
  "mcpServers": {
    "sophos-central": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add sophos-central -- CHANGE_ME

    {
  "mcpServers": {
    "sophos-central": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    {
  "servers": {
    "sophos-central": {
      "type": "stdio",
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.Servosity/sophos-central-mcp
    • not probed yet: tools unpinned, ingest lists them
    • no recipe for target 'local': fill the files by hand

    tools

    Not probed yetThe tools appear once the hub or its worker has listed this entry. Running it still works: your client lists them on first start.