"See everything. Validate everything. Protect everything." -- now from Claude.

UTEM MCP Server is a TypeScript Model Context Protocol server that exposes the full UTEM (Unified Threat Exposure Management) platform as 100 tools accessible to Claude and other MCP-compatible AI assistants.

It wraps the entire UTEM security platform -- vulnerability scanning, attack path analysis, API security testing, cloud asset discovery, compliance automation, threat intelligence, and platform operations -- into a single MCP server that Claude can use directly.

Who it's for:

• Security analysts running scans, triaging vulnerabilities, and hunting threats via conversational AI
• CISOs pulling executive dashboards, compliance scores, and risk heatmaps through natural language
• Developers integrating security checks into CI/CD pipelines via Claude

export UTEM_BASE_URL=https://api.utem.innavoto.com
export UTEM_API_KEY=your-api-key-here

npx utem-mcp

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "utem": {
      "command": "npx",
      "args": ["utem-mcp"],
      "env": {
        "UTEM_BASE_URL": "https://api.utem.innavoto.com",
        "UTEM_API_KEY": "your-api-key-here"
      }
    }
  }
}

For self-hosted UTEM instances, replace UTEM_BASE_URL with your platform URL.

API Key (default): Set UTEM_AUTH_MODE=api-key and provide UTEM_API_KEY. The key is sent as a Bearer token on every request.

OAuth/JWT: Set UTEM_AUTH_MODE=oauth and provide UTEM_CLIENT_ID, UTEM_CLIENT_SECRET, and optionally UTEM_TOKEN_URL. The server handles token acquisition and refresh automatically.

By default all 8 modules are enabled. To load only specific modules, set:

UTEM_MODULES=scan-engine,exposure-manager,attack-path

Valid module names: scan-engine, exposure-manager, attack-path, api-security, cloud-assets, compliance, threat-intel, platform-ops.

OSINT reconnaissance, vulnerability scanning, CVE database lookups, and scan scheduling.

Vulnerability tracking, identity exposures, leaked sessions, risk scoring, and false-positive management.

Attack graph analysis, MITRE ATT&CK mapping, Monte Carlo simulation, remediation prioritization, and executive reporting.

API discovery, OWASP security testing, toxic combination detection, and CI/CD integration.

Multi-cloud (AWS, GCP, Azure) and on-prem (VMware, Hyper-V, OpenStack, Nutanix) asset discovery.

Framework scoring (SOC2, ISO 27001, PCI-DSS, HIPAA), gap analysis, control tracking, and SIEM integration.

Risk management, AI-powered threat hunting, correlation engine, and threat intelligence feeds.

Dashboards, health monitoring, notifications, integrations, audit trail, and billing.

Claude / AI Assistant
        |
   MCP Protocol (stdio or SSE)
        |
  UTEM MCP Server (TypeScript)
   |    |    |    |    |    |    |    |
   v    v    v    v    v    v    v    v
  Scan  Exp  Atk  API  Cloud Comp Threat Plat
  Eng   Mgr  Path Sec  Asset      Intel  Ops
        |
  UTEM API Client (axios, auth, cache, rate-limit)
        |
  UTEM Platform APIs
  (utem-platform-backend, utem-apm, utem-apiwatch, utem-platform-multitenant)

The server uses a modular architecture where each capability module registers its own tools and handles API calls independently. The shared API client provides authentication, caching, and rate limiting. A job manager tracks long-running operations (scans, discovery, analysis) across all modules.

npm install

npm run dev

npm run build

npm test
npm run test:coverage

npm run lint
npm run typecheck

utem-mcp/
  src/
    index.ts              # Entry point and transport setup
    server.ts             # MCP server registration and routing
    core/
      api-client.ts       # HTTP client with auth, cache, rate-limit
      job-manager.ts      # Long-running job tracker
    modules/
      base.ts             # CapabilityModule interface and helpers
      scan-engine/        # 15 tools — scanning and CVE
      exposure-manager/   # 12 tools — vulnerabilities and risk
      attack-path/        # 20 tools — APM and MITRE
      api-security/       # 15 tools — API testing
      cloud-assets/       # 10 tools — asset discovery
      compliance/         #  8 tools — frameworks and SIEM
      threat-intel/       # 10 tools — hunting and correlation
      platform-ops/       # 10 tools — dashboard and ops
    types/
      common.ts           # Shared type definitions
      mcp.ts              # MCP protocol types
      utem.ts             # UTEM domain types

• Node.js >= 20.0.0
• UTEM platform access -- either api.utem.innavoto.com (cloud) or a self-hosted UTEM instance
• A valid API key or OAuth credentials for the target UTEM platform

MIT -- Innavoto Technologies