Welcome
MCP Server for Vulnerability Remediation
Learn how to install, configure, secure, operate, and troubleshoot the MCP Server for Vulnerability Remediation, which connects compatible Model Context Protocol (MCP) clients to patch intelligence services and produces BigFix Fixlet content.
Installing the server
Use the Windows AMD64 release package to install the MCP Server for Vulnerability Remediation as a Windows service.

BigFix Documentation Homepage
BigFix Platform
Patch Documentation
Insights Documentation
The Insights feature of BigFix 11 provides you with advanced analytics and visualizations that you can use to identify risks in your environment and make appropriate business decisions.
CVE Search dashboard and Web Report
BigFix CVE Search dashboard and Web Report are available as part of a new Vulnerability Reporting site.
CyberFOCUS Analytics dashboard
From the BigFix CyberFOCUS Analytics dashboard, you can view various reports that display critical information related to vulnerabilities. The data are represented in the form of graphs and tables, so that the user can quickly become aware of the IT assets and the threats in the environment and take informed decisions to mitigate vulnerabilities.
ServiceNow Data Flow
This module provides an overview and features of BigFix ServiceNow Data Flow.
BigFix Insights for Vulnerability Remediation (IVR)
Welcome to the BigFix Insights for Vulnerability Remediation (IVR) documentation, where you can find information about how to install, maintain and use IVR service.
Extended third-party Windows Applications
Updates for Windows Applications Extended provides an automated, standardized process of managing software updates and packages in the BigFix environment. This provides updates for a wide range of third-party software packages.
Extended third-party Mac Applications
Updates for Mac Applications Extended provides an automated, standardized process of managing software updates and packages in the BigFix environment. This provides updates for a wide range of third-party software packages.
Extended third-party NIX Applications
Updates for NIX Applications Extended provides an automated, standardized process of managing software updates and packages in the BigFix environment. This provides updates for a wide range of third-party software packages.
Software Installer Library Dashboard for Windows
Learn how to use the Software Install Dashboard for deploying applications on Windows endpoints.
MCP Server for Vulnerability Remediation
Learn how to install, configure, secure, operate, and troubleshoot the MCP Server for Vulnerability Remediation, which connects compatible Model Context Protocol (MCP) clients to patch intelligence services and produces BigFix Fixlet content.
- Introduction
  The MCP Server for Vulnerability Remediation enables compatible AI clients to discover security patch information and generate BigFix Fixlet XML through the Model Context Protocol (MCP).
- Supported scenarios
  The MCP Server for Vulnerability Remediation supports CVE patch discovery, vendor patch file discovery, and Fixlet generation for a defined set of update flows.
- Security architecture
  The MCP Server for Vulnerability Remediation is a standalone service with separate trust boundaries for MCP clients, the BigFix Server, and external patch intelligence providers.
- Requirements
  Verify the following requirements before you install the MCP Server for Vulnerability Remediation.
- Installing the server
  Use the Windows AMD64 release package to install the MCP Server for Vulnerability Remediation as a Windows service.
  - Server configuration
    Configure the listener, logging, and BigFix connection settings in config.yaml.
- Using the server
  The MCP Server for Vulnerability Remediation exposes a streamable HTTP MCP endpoint and requires a BigFix REST API bearer token on every client request.
- Tool reference
  The server exposes three MCP tools. The input schemas are discoverable through MCP and are summarized here for operational review.
- Troubleshooting
  Use the operational log configured by log.file_path, the workspace mcp_audit.log, and the MCP client's output log when you diagnose a problem.
- Uninstalling the server
  Uninstalling the service does not replace data-retention decisions. Back up required logs and any Fixlets exported through the client workflow before you delete the installation or workspace.
Remediate Guides in PDF
Following is a link to the BigFix Remediate user guide in PDF format:

Installing the server

Use the Windows AMD64 release package to install the MCP Server for Vulnerability Remediation as a Windows service.

About this task

Keep the binary, configuration, CA certificate, logs, and any client-exported output under locations protected by operating-system permissions.

A release package contains:

The bes-mcp-fixlet-gen executable, with an .exe suffix on Windows.
data/config.example.yaml.
Supporting deployment documentation.

Create data/config.yaml from the example before you start the server. Do not place a BigFix token in this file.

Procedure

To install the server on Windows, complete the following steps:

Extract the Windows package into a protected installation directory, for example C:\Program Files\BES MCP Fixlet Generator.
Copy data\config.example.yaml to data\config.yaml.
Copy the organization-approved BigFix CA certificate into the data directory or another location readable by the service account.
Edit data\config.yaml as described in Server configuration.
Open an Administrator PowerShell session in the installation directory.

Install and start the Windows service.

.\bes-mcp-fixlet-gen.exe service install --workspace "C:\Program Files\BES MCP Fixlet Generator\data"
.\bes-mcp-fixlet-gen.exe service start

Optional: To run under a dedicated service account, install the service with the account credentials.

.\bes-mcp-fixlet-gen.exe service install `
  --workspace "C:\Program Files\BES MCP Fixlet Generator\data" `
  --user "DOMAIN\service-user" `
  --password "<password>"
.\bes-mcp-fixlet-gen.exe service start

Results

The service runs from the configured installation and workspace paths.

What to do next

Confirm the binary identity:

bes-mcp-fixlet-gen version

Confirm that TCP port 9495 is listening and connect with a client that trusts the listener certificate. A plain HTTP GET can return an MCP protocol error; successful TLS connection without connection refusal is sufficient for this transport check.