# Kolide MCP for AI Agents AI Agent Connect

> Kolide lets you audit fleet security and monitor device health across your organization. Use it to list managed hardware, track active security vulnerabilities, and see which users are linked to specific machines. It turns your fleet data into an interactive inventory that your AI agent can query instantly.

## Overview
- **Category:** cloud-infrastructure
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_IxpJHD6HTbvQIvcvAz5O4PvMjzMVYwv1YW8pZf8H/ai-agent-connect
- **Tags:** endpoint-security, device-management, fleet-inventory, vulnerability-scanning, security-auditing

## Description

Managing a company's hardware is usually a game of whack-a-mole. You're constantly switching between tabs to see who has a laptop, which ones are missing security patches, and who owns what. This Connector changes that by giving your AI agent direct access to your Kolide environment. Instead of digging through rows of data, you can just ask your agent to find the most vulnerable devices or summarize your current fleet status. You'll get a clear picture of your endpoint security posture without the manual heavy lifting. It's one of the reasons the Vinkius catalog is so useful for IT teams; it bridges the gap between a static dashboard and an active, queryable database. You can audit compliance, check specific device details, and monitor administrative logs using plain English. It makes handling large-scale device management feel like a conversation rather than a chore. You can quickly identify machines that are out of compliance, see which users are missing their assigned hardware, and pull logs to see exactly what happened during a security event. It's about moving from manual data entry to active security management.

## Tools

### get_device_details
Pulls specific data for a single machine when you need to troubleshoot a particular unit. It gives you the granular details you need.

### list_kolide_issues
Shows all security problems across the fleet so you can prioritize repairs. Use it to spot the most critical risks first.

### list_kolide_people
Shows all users managed in your system to help with ownership tracking. It makes it easy to see who is active in your fleet.

### get_person_details
Retrieves specific profile information for a user in your fleet. Use this to verify user assignments and status.

### list_kolide_checks
Lists every security check currently running so you know what's being audited. It gives you a full view of your security policy.

### get_check_details
Explains the specific parameters and results of a single security check. It helps you see exactly why a device failed a requirement.

### list_kolide_audit_logs
Pulls the chronological history of admin actions and security events. It's essential for maintaining a clear audit trail.

### get_kolide_fleet_stats
Gives you a quick snapshot of total devices, online status, and issue counts. It's the best way to get a high-level health summary.

### list_kolide_devices
Lists every device in your fleet to help you understand your total hardware footprint. It's the quickest way to see everything you're managing.

### get_issue_details
Provides deep-dive information on a specific vulnerability or configuration error. It helps you understand the root cause of a problem.

## Prompt Examples

**Prompt:** 
```
Which devices are currently offline?
```

**Response:** 
```
I've checked your fleet and found 14 devices are currently offline. Most of these were last seen active 48 hours ago. 

**Offline Summary:**
* Total Offline: 14
* Last Seen: 2 days ago

Would you like me to list the specific device IDs or the users associated with them?
```

**Prompt:** 
```
Give me a summary of our security issues.
```

**Response:** 
```
Here is the current status of your fleet security:

| Issue Type | Count | Severity |
| --- | --- | --- |
| Outdated OS | 12 | High |
| Disk Encryption Off | 5 | Critical |
| Missing Patch | 8 | Medium |

There are 25 total active issues. Should I pull details on the critical ones?
```

**Prompt:** 
```
Who owns the device with ID 'KB-9921'?
```

**Response:** 
```
Device **KB-9921** is currently assigned to Sarah Jenkins. 

**User Details:**
* **Owner:** Sarah Jenkins
* **Compliance Status:** Good
* **Current Status:** Online
```

## Capabilities

### Audit device security
Identify specific security vulnerabilities and configuration errors across your entire fleet.

### Track fleet inventory
List every managed device to see your total hardware footprint in one place.

### Map user ownership
See which employees are associated with which company devices and their compliance status.

### Review security checks
View all available security checks and dive into the results for individual machines.

### Access audit logs
Pull a chronological history of administrative actions and security events.

### Get fleet snapshots
Get high-level stats on online status, total devices, and active issue counts.

## Use Cases

### Identifying high-risk machines
A security engineer needs to find all devices with disabled encryption. Use list_kolide_issues and get_issue_details to identify and report the specific machines.

### Verifying hardware ownership
An IT admin wants to know who owns a specific laptop found in the office. Use list_kolide_devices to find the ID and then list_kolide_people to see the owner.

### Generating fleet health reports
A manager needs a weekly report on fleet health. Use get_kolide_fleet_stats to get a summary of online status and compliance in seconds.

### Reviewing administrative changes
An auditor needs to see recent admin changes. Use list_kolide_audit_logs to pull the chronological history of all events for compliance reviews.

## Benefits

- Get instant answers on device ownership by using list_kolide_people to see who has what hardware without searching through records.
- Prioritize your daily work by using list_kolide_issues to see which machines need immediate security attention first.
- Monitor fleet health in seconds with get_kolide_fleet_stats instead of manually counting online units or checking statuses.
- Audit your security posture regularly by pulling the history from list_kolide_audit_logs to keep a clear record of changes.
- Deep dive into specific failures using get_check_details to understand exactly why a device failed a security requirement.
- Quickly identify specific hardware specs using get_device_details to help with troubleshooting and hardware lifecycle management.

## How It Works

The bottom line is you get a natural language interface for your entire fleet's security data.

1. Subscribe to the Kolide MCP on Vinkius.
2. Generate a Bearer Token in your Kolide settings under the API section.
3. Paste the token into your configuration and start asking questions.

## Frequently Asked Questions

**Can I use Kolide MCP to see who has which company laptop?**
Yes, you can ask your agent to list all people and their associated devices to see exactly who owns what hardware in your fleet.

**How does Kolide MCP help with security audits?**
It lets you query your entire fleet for specific security issues and audit logs, making it much faster to identify vulnerabilities and maintain compliance.

**Can I get a summary of my fleet's health?**
You can ask for a high-level summary of your fleet stats, including total devices, online status, and active issue counts in one go.

**Does Kolide MCP show me specific security check failures?**
Yes, you can pull details on any specific security check to see exactly why a device failed a certain requirement or policy.

**Can I see the history of admin actions with Kolide MCP?**
You can use the audit logs to see a chronological history of all administrative and security events in your fleet for better oversight.

**Is Kolide MCP good for tracking new device enrollments?**
It's great for this because you can quickly check fleet stats and list new devices to monitor your inventory growth as it happens.

**Where do I find my Kolide API Token?**
Log in to the Kolide dashboard, navigate to **Settings** in the bottom left, and select the **API** tab to generate a token.

**Can I see hardware details of a device?**
Yes, the `get_device_details` tool returns hardware specifications along with security data.

**Does this support multi-tenant accounts?**
The API key is typically scoped to a specific organization. Ensure you are using the token for the desired fleet.