Skip to main content

Set up the Fleet MCP server

The Fleet MCP server gives AI agents access to Fleet's endpoint management platform: querying hosts, running live osquery, checking policy compliance, and investigating CVEs across managed devices. This guide covers creating an API-only Fleet user and adding the connector from the MintMCP store.

Fleet marks this feature experimental.

Prerequisites​

  • A MintMCP admin account
  • A self-hosted Fleet instance (v4.x or later)

Two requirements apply:

  • Network access: The Fleet instance must be reachable from MintMCP's runtime. Public endpoints work directly. For private or VPN-only instances, allowlist MintMCP's dedicated egress IP on your Fleet server.
  • API-only credentials: Fleet requires a dedicated API-only user account for the connector. Standard user session tokens are rejected at startup.

Create an API-only token​

The connector authenticates with FLEET_API_KEY, which must belong to an API-only Fleet user (a service account with no web UI access). Standard user tokens are rejected at connector startup.

The required role depends on which tools you need:

RoleAccess
ObserverAll tools except run_live_query — sufficient for most deployments
Observer+All tools, including run_live_query (executes osquery live on endpoints)

Do not use the Admin or Maintainer role — observer-level access is all the connector needs.

  1. Authenticate with fleetctl:
fleetctl login --address https://your-fleet.example.com
  1. Create the API-only user. Choose the role that matches your needs:

For Observer (read-only; recommended):

fleetctl user create --name 'MintMCP' --api-only

For Observer+ (enables run_live_query):

fleetctl user create --name 'MintMCP' --api-only --global-role 'observer_plus'
  1. Copy the API token from the terminal — it displays once and cannot be retrieved again.

Add Fleet to MintMCP​

The Fleet connector is pre-listed in the MintMCP MCP store. Installing it opens a Configure Fleet screen with two fields.

  1. In MintMCP, go to MCP store > Manage store.
  2. Find Fleet in the recommended servers list and click Install.
  3. In FLEET_BASE_URL field, enter your Fleet instance address (e.g., https://fleet.example.com).
  4. In FLEET_API_KEY field, paste the token from the previous step, or an existing API-only user's token if you already have one.
  5. Click Install.

Security considerations​

  • The API key belongs to a single shared account, so all tool calls run as that identity. Fleet audit logs attribute activity to the API-only user, not to individual people.
  • Observer role is sufficient for read-only access. Grant Observer+ only when your use case requires live query execution.
  • run_live_query executes osquery live on managed endpoints. Document that the connector has this capability when granting Observer+ access.
  • API tokens for API-only users do not expire by default. Rotate by creating a new API-only user and updating the connector's API key field.
  • The connector connects outbound to your Fleet instance only. No endpoint data is stored in MintMCP beyond what individual tool calls return.

Troubleshooting​

  • Connection timeout: Fleet is not reachable from MintMCP. Verify the Fleet URL is publicly accessible, or contact enterprise@mintmcp.com to get the dedicated egress IP and add it to your Fleet server's allowlist.
  • "User is not an API-only user": The API key belongs to a regular Fleet user. Create a new user with fleetctl user create --api-only and update the connector.
  • run_live_query permission denied: The API-only user has Observer role. Create a new user with --global-role 'observer_plus' and update the connector's API key.

Next steps​