> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> Connect AI assistants to Hilt telemetry with the MCP server.

The Hilt query service ships with a built-in [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server. It exposes the same tools that power the [Query](https://hilt.ai/docs/dashboard/query.md) page — the 15 telemetry tools, the Sensitivity list tool, plus 2 documentation tools — so any MCP-compatible client (Cursor, Claude Desktop, or your own agent) can search events, investigate anomalies, draft detection rules, and look up how Hilt works directly against your Hilt data.

> [!NOTE]
>
> The MCP server is currently in **early access**. It is intended for use within your secured environment by authorized operators. Contact your account team for access and configuration guidance.

***

## Capabilities

The MCP server provides read-only access through 15 telemetry tools, the Sensitivity list tool, and 2 documentation tools:

### Discovery and events

| Tool | What it does |
| - | - |
| `list_hosts` | List monitored hosts and when they were last seen |
| `search_events` | Search raw kernel telemetry with filters (event type, command, identity, destination, file prefix) |
| `get_event_detail` | Full payload of a single event by its composite key |
| `summarize_activity` | High-level counts: event types, total events, unique users/processes/hosts |

### Processes and users

| Tool | What it does |
| - | - |
| `get_process_tree` | Parent-child process hierarchy for a host and time window |
| `get_process_events` | Everything one process did: files, network, children |
| `list_users` | Active users with event counts and host access patterns |
| `user_activity` | Detailed activity for one identity: files, processes, connections |

### Anomalies and investigation

| Tool | What it does |
| - | - |
| `get_anomaly_alerts` | Curated alerts that exceeded detection thresholds |
| `get_anomaly_scores` | Per-epoch anomaly scores by detection group |
| `get_alert_context` | Raw events in a time window around an alert |
| `investigate_alert` | One-call investigation bundle: activity summary, process tree, network flows, and anomaly score |

### Data flow

| Tool | What it does |
| - | - |
| `get_network_flows` | Aggregated connection summaries: which processes reached which destinations, bytes transferred |
| `get_file_activity` | File reads, opens, deletes, renames, and permission changes, filterable by path prefix |

### Detection rules

| Tool | What it does |
| - | - |
| `build_detection_rule` | Validates a detection-rule draft and returns it. **Does not save the rule.** Take the draft to the [Alerts → Rules](https://hilt.ai/docs/dashboard/alerts.md) tab to review and create it |

### Sensitivity list

| Tool | What it does |
| - | - |
| `list_sensitive_objects` | List the objects on your Sensitivity list — file paths, destinations, people, and hosts you marked as sensitive — with each entry's sensitivity level and classification. Filter by kind, or search the pattern and label |

On the [Query](https://hilt.ai/docs/dashboard/query.md) page this tool requires the `manage_alerts` permission, the same permission that gates the Sensitivity list in the dashboard. An MCP session is not tied to a dashboard user, so it reads the list without that check — one more reason to treat MCP access as operator-level.

### Documentation

These tools answer product and how-to questions ("how does Hilt work") from the documentation bundled with your deployment. They contain no customer data and work fully offline.

| Tool | What it does |
| - | - |
| `search_docs` | Search the Hilt product documentation and return ranked sections with their page path and section, for citation |
| `get_doc_page` | Return the full text of a documentation page (or a single section) by its path |

***

## Client configuration

A typical MCP client entry (Cursor, Claude Desktop, or similar):

```json theme={null}
{
  "mcpServers": {
    "hilt": {
      "command": "/path/to/hilt-query",
      "env": {
        "MODE": "mcp"
      }
    }
  }
}
```

Contact your account team for the correct binary path and environment configuration for your deployment.

***

## Example prompts

Once connected, you can ask your AI assistant questions like:

* "What hosts have been active in the last 24 hours?"
* "Show me network flows from web-01 to external destinations"
* "Investigate the latest anomaly alert. What happened?"
* "List all file activity under /etc/ on prod-db-03 today"
* "Draft a detection rule for processes connecting to new external IPs after midnight"

***

## Verifying the server

You can smoke-test the protocol with a JSON-RPC handshake:

```bash theme={null}
MODE=mcp ./hilt-query <<'EOF'
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}
{"jsonrpc":"2.0","id":2,"method":"tools/list"}
EOF
```

A healthy server responds with the handshake and the tool catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.