Security Architecture Flow

The MCP Server runs as a standalone service and acts as a controlled bridge between an external MCP client and the BigFix Root Server REST API.

  1. An MCP client connects to the MCP Server through the streamable HTTP endpoint, normally over HTTPS on port 9494.
  2. The MCP client sends a BigFix REST API token in the HTTP Authorization header..
  3. The MCP Server extracts the Authorization value and stores it only in the request context needed for the current call.
  4. The selected MCP tool validates its inputs and builds the corresponding BigFix REST API request.
  5. Before write-capable operations are dispatched, the MCP Server applies its effective read-only policy and, when enabled, Human-in-the-Loop approval.
  6. The MCP Server forwards the same Authorization value to the BigFix Root Server REST API, normally on port 52315.
  7. The Root Server validates the token, identifies the BigFix operator, applies RBAC, processes the request, and returns the response.
  8. The MCP Server formats the result and returns it to the MCP client.

Security boundary: The MCP client is external. The MCP Server and Root Server are BigFix-managed components, but they remain separate services connected through HTTPS. The MCP Server is not an in-process extension of the Root Server.