Blumira MCP
Search Blumira findings, detections, and agents across accounts from one offline MCP-backed store.
Overview
Blumira MCP is a MCP server for the Operate phase that unifies cross-account Blumira findings, detections, and agents in an offline-searchable store for agents.
What is this MCP server?
- Aggregates Blumira findings, detections, and agents cross-account
- Offline-searchable store for agent queries without repeated live API round-trips
- Supports JWT via BLUMIRA_CLIENT_ID and BLUMIRA_CLIENT_SECRET or BLUMIRA_API_TOKEN
- stdio mcpb release v0.1.0 from Servosity msp-skills
- OAuth2 client_credentials flow with auto-refresh when using client id/secret
- Server version 0.1.0
- Transport: stdio; package type mcpb
- Auth: BLUMIRA_API_TOKEN or BLUMIRA_CLIENT_ID + BLUMIRA_CLIENT_SECRET (JWT mint/refresh)
Community signal: 1 GitHub stars.
What problem does it solve?
Blumira data is split across accounts and live API calls, so investigating detections with an AI agent means manual exports and context switching.
Who is it for?
Small security-focused teams and MSPs using Blumira who want multi-tenant detection search and agent visibility inside their coding agent.
Skip if: Builders without Blumira, or teams that only need generic OWASP checklists without a Blumira tenant.
What do I get? / Deliverables
After MCP registration with Blumira credentials, your agent can query consolidated findings, detections, and agent inventory from the offline store.
- Cross-account Blumira findings, detections, and agent data exposed to the agent
- Offline-searchable consolidated store for security queries
Recommended MCP Servers
Journey fit
SIEM findings and detection review are ongoing Operate work once production systems generate security telemetry. Centralized offline search across accounts fits monitoring and response workflows more than one-off build tasks.
How it compares
Blumira SIEM MCP with offline multi-account search, not a standalone penetration-testing skill.
Common Questions / FAQ
Who is Blumira MCP for?
It is for Blumira customers and MSPs who need agent-driven access to findings, detections, and agents across more than one account.
When should I use Blumira MCP?
Use it during Operate when triaging alerts, auditing detection coverage, or correlating agent health with open findings in your agent IDE.
How do I add Blumira MCP to my agent?
Install blumira-mcp mcpb (stdio), set BLUMIRA_CLIENT_ID and BLUMIRA_CLIENT_SECRET for auto JWT refresh or provide BLUMIRA_API_TOKEN, then add the server to your MCP client.