MCP Servers

MCP Server detection is integrated into the BigFix Scanner process, specifically designed for Windows endpoints. It operates alongside existing scans to ensure visibility into AI server configurations.

  • Prerequisites: This detection runs exclusively on Windows endpoints where the BigFix Scanner (Fixlet 103: Install or Upgrade Scanner) is installed together with the bfi-utils executable in version 11.0.43
  • Process: The "Initiate Software Scan" fixlet incorporates a mandatory MCP scan step that executes in parallel with the standard SLM tag scan (Resource Utilization scan). These steps cannot be disabled or skipped.
  • Monitoring: Scan execution progress and status can be tracked via the log file located at: <BES_Client>\LMT\CIT\<endpoint_id>_citlog.log.
  • Output Preparation: Both the MCP scan and the SLM tag scan produce outputs that are subsequently consumed by the bfi-utils.exe parseTagsXmlAndPrepareZip compression step.

Output and Mapping

The scan results are stored in the <BES_Client>\LMT\CIT\mcpscanOutputDir directory, which contains:
  1. MCP Tags: Zero or more mcp_output_<num>.slmtag_ files. Each file represents a single discovered MCP server.
  2. Mapping Index: The mcp_output_map.json file serves as an index, mapping each .slmtag_ destination file (dst) to its corresponding source configuration file (src).

    Example: {"dst": "mcp_output_0.slmtag_", "src": "C:\\Users\\jsmith\\.config\\claude-code\\mcp.json"}

Configuration and Constraints

  • Supported Formats: The process supports MCP server configuration files in JSON and TOML formats.
  • Monitored Paths: Only files residing at specific known relative paths are processed. These monitored paths are defined in the configuration file: <BES_Client>\LMT\CIT\mcpscan_config.json.
  • File Size Limit: To maintain performance, any MCP server configuration files exceeding 100 KB are automatically skipped.

Inventory Server Reporting

Discovered MCP server connections are reflected in the Resource Utilization panel with the following attributes:
  • Software Name: The display name of the discovered AI tool.
  • Instance: The identifier formatted as `<server name>:<transport type>`.
  • Path: The file system path where the configuration file was discovered.
  • Metric Type: Labeled as MCP_SERVER to distinguish these entries from other metric types.
  • First/Last Measured: Records the last modification date of the configuration file

    and the date of the most recent scan detection, respectively.