MCP server - Hilt Documentation

The Hilt query service ships with a built-in Model Context Protocol (MCP) server. It exposes the same tools that power the Query page — the 15 telemetry tools, the Sensitivity list tool, plus 2 documentation tools — so any MCP-compatible client (Cursor, Claude Desktop, or your own agent) can search events, investigate anomalies, draft detection rules, and look up how Hilt works directly against your Hilt data.

The MCP server is currently in early access. It is intended for use within your secured environment by authorized operators. Contact your account team for access and configuration guidance.

Capabilities

The MCP server provides read-only access through 15 telemetry tools, the Sensitivity list tool, and 2 documentation tools:

Discovery and events

Tool	What it does
`list_hosts`	List monitored hosts and when they were last seen
`search_events`	Search raw kernel telemetry with filters (event type, command, identity, destination, file prefix)
`get_event_detail`	Full payload of a single event by its composite key
`summarize_activity`	High-level counts: event types, total events, unique users/processes/hosts

Processes and users

Tool	What it does
`get_process_tree`	Parent-child process hierarchy for a host and time window
`get_process_events`	Everything one process did: files, network, children
`list_users`	Active users with event counts and host access patterns
`user_activity`	Detailed activity for one identity: files, processes, connections

Anomalies and investigation

Tool	What it does
`get_anomaly_alerts`	Curated alerts that exceeded detection thresholds
`get_anomaly_scores`	Per-epoch anomaly scores by detection group
`get_alert_context`	Raw events in a time window around an alert
`investigate_alert`	One-call investigation bundle: activity summary, process tree, network flows, and anomaly score

Data flow

Tool	What it does
`get_network_flows`	Aggregated connection summaries: which processes reached which destinations, bytes transferred
`get_file_activity`	File reads, opens, deletes, renames, and permission changes, filterable by path prefix

Detection rules

Tool	What it does
`build_detection_rule`	Validates a detection-rule draft and returns it. Does not save the rule. Take the draft to the Alerts → Rules tab to review and create it

Sensitivity list

Tool	What it does
`list_sensitive_objects`	List the objects on your Sensitivity list — file paths, destinations, people, and hosts you marked as sensitive — with each entry’s sensitivity level and classification. Filter by kind, or search the pattern and label

On the Query page this tool requires the manage_alerts permission, the same permission that gates the Sensitivity list in the dashboard. An MCP session is not tied to a dashboard user, so it reads the list without that check — one more reason to treat MCP access as operator-level.

Documentation

These tools answer product and how-to questions (“how does Hilt work”) from the documentation bundled with your deployment. They contain no customer data and work fully offline.

Tool	What it does
`search_docs`	Search the Hilt product documentation and return ranked sections with their page path and section, for citation
`get_doc_page`	Return the full text of a documentation page (or a single section) by its path

Client configuration

A typical MCP client entry (Cursor, Claude Desktop, or similar):

{
  "mcpServers": {
    "hilt": {
      "command": "/path/to/hilt-query",
      "env": {
        "MODE": "mcp"
      }
    }
  }
}

Contact your account team for the correct binary path and environment configuration for your deployment.

Example prompts

Once connected, you can ask your AI assistant questions like:

“What hosts have been active in the last 24 hours?”
“Show me network flows from web-01 to external destinations”
“Investigate the latest anomaly alert. What happened?”
“List all file activity under /etc/ on prod-db-03 today”
“Draft a detection rule for processes connecting to new external IPs after midnight”

Verifying the server

You can smoke-test the protocol with a JSON-RPC handshake:

MODE=mcp ./hilt-query <<'EOF'
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}
{"jsonrpc":"2.0","id":2,"method":"tools/list"}
EOF

A healthy server responds with the handshake and the tool catalog.