CLI Commands

Basic Usage

Run the server with default settings (stdio transport):

claroty-ctd-mcp

Run with SSE transport:

claroty-ctd-mcp --transport sse

Run with streamable-http transport:

claroty-ctd-mcp --transport streamable-http

Run with streamable-http on a custom port:

claroty-ctd-mcp --transport streamable-http --host 0.0.0.0 --port 8080

Run with stateless HTTP mode (for scalable deployments like AWS AgentCore):

claroty-ctd-mcp --transport streamable-http --stateless-http

Run with API key authentication:

claroty-ctd-mcp --transport streamable-http --api-key your-secret-key

Module Selection

Enable specific modules by name (comma-separated):

claroty-ctd-mcp --modules inventory,detections,vulnerabilities

Enable only one module:

claroty-ctd-mcp --modules detections

If no --modules flag is provided, all available modules are enabled.

All Options

claroty-ctd-mcp --help

Flag	Env Variable	Default	Description
`--transport`	`CLAROTY_CTD_MCP_TRANSPORT`	`stdio`	Transport methods: `stdio` `sse` `streamable-http`
`--host`	`CLAROTY_CTD_MCP_HOST`	`127.0.0.1`	Host for HTTP transports. Accepts IPv4 and IPv6 addresses.
`--port`	`CLAROTY_CTD_MCP_PORT`	`8000`	Port for HTTP transports
`--modules`	`CLAROTY_CTD_MCP_MODULES`	all	Comma-separated list of modules to enable: `inventory` `detections` `vulnerabilities` `insights` `active_detection` `administration` `threat_content` `appliance_updates`
`--debug`	`CLAROTY_CTD_MCP_DEBUG`	`false`	Enable debug logging. Debug diagnostics go to stderr; sensitive HTTP-library debug logging remains suppressed.
`--stateless-http`	`CLAROTY_CTD_MCP_STATELESS_HTTP`	`false`	Stateless mode for scalable deployments

Using as a Library

Python embedding is now supported through ClarotyCTDMCPServer.

Pass CTD credentials using the username and password constructor arguments:

from claroty_ctd_mcp.server import ClarotyCTDMCPServer

server = ClarotyCTDMCPServer(
    base_url="https://your-ctd-URL.com",
    username=os.environ["CTD_USERNAME"],
    password=os.environ["CTD_PASSWORD"],
    debug=True,
    enabled_modules=["detections", "insights"]
)

# Run with stdio transport (default)
server.run()

# Or with a specific transport
# server.run("streamable-http")

For enterprise deployments using secret management systems (HashiCorp Vault, AWS Secrets Manager, etc.), you can pass credentials directly:

server = FalconMCPServer(
    client_id="your-client-id",
    client_secret="your-client-secret",
    base_url="https://your-ctd-URL.com",
    enabled_modules=["detections", "hosts"]
)
server.run()

CLI arguments take precedence over environment variables. Invalid transports, IP addresses, ports, module names, and boolean values stop startup with a clear error.