Sysdig MCP

Sysdig covers cloud native security and monitoring in one platform: vulnerability scanning for registries, pipelines, and running workloads, runtime threat detection built on Falco, cloud and Kubernetes posture management, and infrastructure metrics. The official MCP server gives an AI assistant read access to that data so an investigation can happen in a chat window instead of across several dashboards and saved searches. Security tools cover vulnerability findings by image, registry, or running workload, with severity, fix availability, and whether the package is actually in use at runtime; runtime security events showing the rule that fired along with the process, container, cluster, and namespace involved; and inventory queries that list cloud and Kubernetes resources together with their posture and compliance status. A second family of tools reports Kubernetes health, including unavailable and restarting pods, HTTP and network error rates by pod, workloads consuming the most CPU or memory, and pods sitting far below their requested quota. It authenticates with a Sysdig API token, so the tools return only what the associated team is permitted to see, and the surface stays read only. The users are security operations and platform engineering teams that need to triage a detection, scope a newly disclosed CVE across clusters, or connect a runtime alert to the workload and image that produced it.