Introduction
Learn how the BigFix Platform MCP Server extends the capabilities of BigFix by allowing compatible AI clients to use BigFix functionalities through the Model Context Protocol (MCP).
The BigFix MCP Server enables AI agents and clients to interact with BigFix endpoints and resources using natural language commands. This guide explains its features, benefits, and how it allows any AI client to seamlessly connect and interact with a BigFix deployment.
The Model Context Protocol (MCP) functions as an open standard enabling a secure, structured bridge between large language models (LLMs) and real-world tools, APIs, and endpoint repositories. In the context of the BigFix ecosystem, integrating an MCP server allows external agentic AI workflows to natively "understand" and command endpoint data without needing bespoke API connectors for every task.
The BigFix Platform MCP Server is a managed, standalone BigFix integration service. It runs in streamable HTTP mode over HTTPS for network-accessible MCP clients and acts as a token-forwarding gateway. The Authorization header received from the MCP client is forwarded directly to the BigFix Root Server REST API so that each request is evaluated with the BigFix identity represented by the supplied token.
The MCP Server does not create a shared privileged BigFix identity and does not bypass BigFix permissions. The BigFix Root Server validates the token, identifies the operator, applies role-based access control (RBAC), and decides whether the requested operation is permitted.
To safeguard operations further, administrators can enforce granular, policy-based guardrails natively within the MCP Server configuration, such as read-only mode and human in the loop (HITL).
The following diagram displays the high-level BigFix Platform MCP Server architecture and trust boundaries.
Important: The MCP Server uses the client-supplied BigFix REST API token. Human approval and MCP security controls do not grant additional BigFix permissions; Root Server RBAC remains authoritative.
The BigFix Platform MCP Server depends on REST API bearer-token support introduced in BigFix Version 11.0.6. For more details, see Configuring bearer token authentication.
TLS is supported natively. If a listener certificate and matching private key are configured, the MCP Server uses them. Otherwise, the service can generate a self-signed certificate in its workspace.