AI agents for endpoint security - on your terms
Most security platforms are adding AI as an afterthought - a chatbot layered over a legacy UI. LightEDR was designed from the ground up to be operated by AI agents. The MCP server, webhook system, and scoped service account model are not integrations. They are first-class features.
Connect any MCP-compatible AI in two config lines
The LightEDR MCP server (pip install ledr-mcp) exposes 13 named, described tools covering every major platform operation. Any MCP-compatible client - Claude, Cursor, Zed - connects with two environment variables and a JSON config block. No custom SDK. No proprietary protocol.
Available MCP tools
list_alertsQuery alerts by severity, technique, host, or time rangeget_alertRetrieve full alert detail including raw event dataget_alert_contextSurrounding events, trust score, TI enrichment, similar past alertsacknowledge_alertAcknowledge with a note - logged to audit trailinvestigate_alertTrigger LLM-assisted triage analysis on demandisolate_agentNetwork-quarantine an endpoint via the response APIunisolate_agentRestore network access to a previously isolated hosthunt_eventsNatural language event search across the entire fleetget_mitre_coverageReturn the current MITRE ATT&CK coverage mapAre there any critical alerts in the last 4 hours? Investigate the highest-severity one and tell me if I should isolate the host.
Found 3 critical alerts. The highest-severity is T1003 credential dumping on web-01. Trust score is 0.42 - below the safe threshold. I recommend isolating the host. Want me to proceed?
Model-agnostic by design
You are not buying a "Claude integration" or a "GPT feature." You are buying a security platform that any agent can operate. When better models ship, you upgrade the model. The security stack stays the same.
Principle of least privilege
Service account keys are scoped to exactly the permissions the agent needs - analyst read access for investigations, agents:manage only if host isolation is required. A compromised agent key cannot exceed its scope.
Every agent action is visible
The AI agent calls the same authenticated endpoints your analysts use. Every action is written to the tamper-evident, hash-chained audit log with actor, timestamp, and payload. No back-channel. No shadow operations.
No vendor lock-in on the model
The integration layer is the MCP server and the REST API - not the model. Switch from Claude to GPT to a local Ollama instance without changing a single line of your security configuration.
Reactive, not polling
Autonomous agents that poll for alerts waste tokens and introduce latency. LightEDR calls your agent when a rule fires. The agent investigates and responds, then goes back to sleep.
- Event-driven wake-up
A detection rule matches. LightEDR POSTs the enriched alert payload to your registered webhook endpoint within milliseconds.
- HMAC request verification
Every webhook POST is signed with HMAC-SHA256. Your agent verifies the signature before processing - no spoofed alert payloads.
- Exponential backoff retry
If your endpoint is temporarily unavailable, LightEDR retries with exponential backoff. No alert is silently dropped.
- Async-safe
Webhook delivery is decoupled from detection. A slow or failing agent endpoint never delays alert processing or dashboard visibility.
Works with the tools you already use
The MCP server follows the open Model Context Protocol standard. If it speaks MCP, it works with LightEDR.
claude.ai · Claude Code
Set LEDR_URL and LEDR_KEY, add the MCP config block, and ask Claude about your alerts in plain English from the chat interface or directly from your terminal via Claude Code.
AI-native editors
Both Cursor and Zed support MCP servers. Add the LightEDR server to your editor config and query your security posture without leaving your development environment.
REST API + webhooks
Build your own orchestration layer on the full REST API. Every UI action has an API equivalent. Webhook channels give you event-driven trigger capability. No MCP client required.
Connect your AI agent in under 10 minutes.
Request a sandbox tenant and we'll walk you through the MCP setup, webhook config, and your first agent-driven investigation. 14 days free, no credit card.