The BigFix Platform Team is pleased to announce the availability of the BigFix Platform MCP Server, a new component that lets you plug your AI assistant of choice directly into BigFix. Through the MCP Server an LLM can retrieve data from your BigFix environment and help you author and run BigFix actions on your endpoints, using natural language. Security controls are provided and enforced on interaction of the LLM with the BigFix Platform, allowing you to tailor the solution to your needs.
AI meets BigFix through an open standard!
The BigFix Platform MCP Server is built on the Model Context Protocol (MCP), an open standard that allows AI clients, such as Copilot, to connect to external tools and services through a consistent interface. A MCP server exposes APIs that an AI assistant can call to retrieve data or perform operations in connected systems.
The BigFix Platform MCP Server introduces a managed MCP service for BigFix that runs in streamable HTTP mode over HTTPS, so it can be reached by any network-accessible MCP client.
What you can do with it
The new component supports the following BigFix scenarios:
- Action lifecycle management: list actions, retrieve details and status, inspect and retry downloads, stop actions, create actions, and delete actions.
- Custom action authoring: author custom actions with the assistance of your LLM.
- Fixlet and Task deployment: deploy existing Fixlets or Tasks through action creation.
- Computer listing: list managed computers and retrieve the details of a specific computer.
- Fixlet discovery: list the Fixlets in a site and retrieve full Fixlet details by site and ID.
- Session Relevance evaluation: evaluate Session Relevance through BigFix Web Reports or BigFix Explorer
Secure by default
The BigFix Platform MCP Server is intentionally conservative from a security perspective, with layered guardrails that reduce the risk of autonomously executing destructive operations:
- Token-based authentication: the service is designed as a token-forwarding gateway. Each MCP request must carry a valid BigFix REST API token in the Authorization header, which is forwarded to the BigFix Platform REST API, so every request runs with the permissions of its own token. This relies on the REST API token support introduced in BigFix 11.0.6. For details, see Configuring bearer token authentication.
- Strict read-only mode by default: write-capable tool families are disabled and hidden unless an administrator explicitly enables them in the server configuration (mcp_server.read_only: false) and the MCP client also opts in on the request with the X-Bes-Mcp-Read-Only: false header.
- Human-in-the-Loop protection enabled by default: for critical write operations, the AI client is instructed to stop and request explicit user confirmation before sending any payload that triggers persistent modifications to the environment. This protection remains active even when write access is enabled, unless it is explicitly disabled.
- TLS supported natively: you can provide your own certificate and key, or let the service automatically generate self-signed certificates in its workspace.
Getting started
- Requirements: BigFix Platform Version 11.0.6 or later is required
- Supported targets: Windows Server 2022 or later (64-bit) and Red Hat Enterprise Linux 9 or 10 (64-bit).
- Installation: Task 6073: "Install BigFix MCP Server (Version 1.0.0)" is available in BES Support site version 1514 or later. The server can be installed either directly on the BigFix Root Server or on a separate endpoint, as long as that endpoint can reach the Root Server on port 52311.
Useful links
– HCL BigFix – Platform Team