Security your own AI tools can operate.
Convoy's MCP server is scoped to your tenant and works with any MCP client. The assistants your team already uses can list leads, run queries, write rules and contain hosts, under the same permissions and the same audit trail as the console.
Any MCP client
Access OAuth sign-in or an API key Scope your tenant, nothing else Record every call in your audit trail
Live session
{{typed}}
Getting started
Three steps. The second one takes a minute.
1
Sign in or make a key
Connect with OAuth as yourself, or make an API key in the console. Either way it carries your role and nothing more.
2
Add the server to your client
Add your tenant's address to any MCP client, then sign in or paste the key. No SDK, no plugin.
3
Ask your own assistant for what you need
Triage the overnight leads, explain a noisy rule, draft a case summary, pull every sign-in for one account across every source.
Tool reference
Pick a task. See which tools fire.
100+ tools is a list. This is what they're for. Every call runs under the connected user's role. Your AI tool sees the full set the moment it connects.
Leads · 4 calls
Triage the overnight leads
What came in since 18:00, what matters, and why the rest can close.
Everything new since 18:00, newest first, with severity and state.
Open the one that matters: narrative, entities, confidence score.
Who did what to it and when, including the triage determinations.
Close the rest as non-concern, each with a written reason.
Respond · 4 calls
Contain a host
Isolate rdweb01, open the case, tell the owner.
What containment this tenant can perform, and the fields each one needs.
Isolate rdweb01 through Convoy Agent. One step reverses it.
Open a case from the lead with the evidence attached.
Find the incident thread so the right people hear it first.
Guard · 4 calls
Write and test a rule
A new detection for scheduled tasks created by service accounts.
What fields the Sysmon and Windows security logs actually carry.
Draft the rule, mapped to T1053.005, scoped to svc-* accounts.
Dry-run it against 30 days of your own events before it goes anywhere.
Send it up the review ladder. Nothing goes live on its own.
Query · 4 calls
Sweep for an indicator
Has anything talked to the IP from this morning's advisory?
Queries firewall, proxy and Convoy Agent telemetry for the last 30 days.
The rows, paginated, ready to drop into a case.
Keep it as a shared query the whole team can re-run.
Turn the sweep into a standing rule so the next match is a lead.
Email · 4 calls
Pull a phishing email
Fourteen mailboxes got it. Two clicked.
Which mailboxes received the message and who opened the link.
Delete it from every inbox in one action.
Close the lead as contained, with the mailbox list in the reason.
Note the two users who clicked and the reset that went out.
Insights · 4 calls
Brief the board
Numbers a board can read, straight from your data.
Score, tier, ATT&CK coverage and the trend.
Assets protected, agent coverage, the ten riskiest.
Cases closed this quarter, by severity and time to contain.
Every action taken in the quarter, by person or by playbook.
readwritecontainA read-only role stops at the first ring. Containment needs a role that can contain in the console, too.
Permissions
A tool can never do more than the person who connected it.
Checked on every call
Permissions are re-checked on every tool call. Reads need read, writes need write.
Same roles as the console
Connections follow the role ladder your team already has. Nothing new to govern.
Errors it can explain
When a role doesn't clear a tool, you get a machine-readable reason, not a silent failure.
Threads stay private
Incident threads keep their parties-only rule. Your AI tool only reads or posts where the connected user is a party.
Prefer plain HTTP? There's an API for that.
Everything your AI tool can reach is there too, with OAuth or an API key and the same permissions. The reference lives in your console.
Let any system fire an Autopilot playbook.
Webhook-triggered automations carry their own secret, so a ticketing system, a form or a script can start a playbook without holding an API key. Every firing is a recorded run.
- Its own secret, so no API key changes hands
- Only armed webhook automations fire
- Each run audited like any other
Your SOC, inside whatever your engineers already have open.
Connect your own assistant to your tenant and ask it something you'd normally ask us.