Anywhere MCP Server

What is Anywhere MCP Server?

Anywhere MCP Server is a Model Context Protocol (MCP) server that integrates with the Levelblue USM Anywhere platform, providing secure access to security monitoring data including alarms, events, and threat intelligence through the USM Anywhere API v2.0. It also offers legacy support for AlienVault OTX API. Built with TypeScript and Zod validation, it is intended for security analysts and developers who need to query security data via MCP-compatible clients.

How to use Anywhere MCP Server?

Clone the repository, install dependencies with npm install, build with npm run build, and configure a .env file with your USM Anywhere credentials (client ID, client secret, subdomain) and optionally an OTX API key. Start the server with npm start. Add the server to your MCP client configuration by providing the path to the built index.js and the required environment variables. Tools include get_alarms, get_events, get_alarm_details, get_event_details, search_pulses, get_indicator, and get_pulse.

Key features of Anywhere MCP Server

• OAuth 2.0 authentication using client credentials flow
• USM Anywhere API v2.0 integration for alarms and events
• Legacy OTX API support for threat intelligence
• Type-safe implementation with TypeScript and Zod
• Standard MCP protocol implementation
• Automatic OAuth token refresh and rate limit handling

Use cases of Anywhere MCP Server

• Retrieve and filter security alarms from USM Anywhere
• Query security events with source, page, and size filters
• Get detailed information on specific alarms or events
• Search threat intelligence pulses and indicators via legacy OTX
• Integrate security monitoring data into AI assistant workflows