Skip to content

Commit 633ac70

Browse files
authored
Add Active Directory Tools (#4)
* Add AD tools * Add community link * Update tool names in README * Update README * Updates * Sync from internal: Fix download URL * Sync from internal: Remove run SQL tool * Sync from internal: Remove run query tool log * Sync internal: clear up config example * Sync from internal: Don't output connection error * Sync review updates * Sync: Remove log santization method * Sync internal: Add encrypt param --------- Synced & co-authored-by: Brett Bodenburg <[email protected]>
1 parent c5b9369 commit 633ac70

File tree

17 files changed

+2628
-784
lines changed

17 files changed

+2628
-784
lines changed

README.md

Lines changed: 80 additions & 208 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# MCP Server for Netwrix Access Analyzer
1+
# Netwrix Access Analyzer MCP Server
22

3-
A FastMCP-based server for Netwrix Access Analyzer data analysis, designed to integrate with Claude Desktop for enhanced data analysis capabilities.
3+
An MCP server for Netwrix Access Analyzer, designed to integrate with Claude Desktop. Currently supports Active Directory and File System solutions.
44

55
## Features
66

@@ -21,218 +21,90 @@ This MCP server requires the following dependencies:
2121

2222
### Netwrix Access Analyzer (NAA) Dependencies
2323

24-
This MCP Server requires Netwrix Access Analyzer (NAA) File System scans to be completed.
25-
26-
## Installation
27-
28-
### System Dependencies
29-
30-
First, ensure you have the ODBC Driver for SQL Server installed:
31-
32-
- **macOS**: Install using Homebrew: `brew install microsoft/mssql-release/msodbcsql17`
33-
- **Windows**: Download and install from the [Microsoft ODBC Driver page](https://learn.microsoft.com/en-us/sql/connect/odbc/download-odbc-driver-for-sql-server)
34-
- **Linux**: Follow [Microsoft's instructions](https://learn.microsoft.com/en-us/sql/connect/odbc/linux-mac/installing-the-microsoft-odbc-driver-for-sql-server) for your distribution
35-
36-
### Python Dependencies
37-
38-
Install required Python packages using `uv`
39-
40-
### Database Setup
41-
42-
For development or testing purposes only:
43-
44-
1. Create a `.env` file in your project directory with your SQL Server connection details:
45-
46-
```
47-
# Database Connection Information
48-
DB_SERVER=your_server_name
49-
DB_NAME=your_database_name
50-
DB_USER=your_username
51-
DB_PASSWORD=your_password
52-
DB_USE_WINDOWS_AUTH=FALSE # Set to TRUE to use Windows Authentication
53-
```
54-
55-
2. Replace the example values with your actual database connection information.
56-
57-
## Integration with Claude Desktop
58-
59-
To make this MCP server available in Claude Desktop:
60-
61-
1. Open Claude Desktop
62-
2. Navigate to the Claude Desktop configuration file:
63-
- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
64-
- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
65-
3. Add the following configuration to the `mcpServers` section.
66-
4. Restart Claude Desktop
67-
68-
### Example Configuration
69-
70-
```json
71-
"NetwrixAccessAnalyzer": {
72-
"command": "/path/to/your/uv",
73-
"args": [
74-
"run",
75-
"--with",
76-
"pyodbc,fastmcp",
77-
"fastmcp",
78-
"run",
79-
"/path/to/mcp/main.py"
80-
],
81-
"env": {
82-
"DB_SERVER": "your_server_address",
83-
"DB_NAME": "your_database_name",
84-
"DB_USER": "your_username",
85-
"DB_PASSWORD": "your_password",
86-
"DB_USE_WINDOWS_AUTH": "FALSE"
87-
}
88-
}
89-
```
90-
91-
1. Replace `/path/to/your/uv` with the actual path to your `uv` executable (find with `which uv` or `where uv`), and update the path to your `main.py` file as well as the database connection information.
92-
2. Restart Claude Desktop to apply the changes
93-
94-
## Available Tools and Sample Prompts
95-
96-
The MCP server provides the following tools for interacting with database systems and analyzing access data:
97-
98-
### Database Connection Tools
99-
100-
#### Connect-Database
101-
102-
Connect to a MS SQL Server database.
103-
104-
**Parameters:**
105-
- `server`: SQL Server address
106-
- `database`: Database name
107-
- `username`: SQL Server username (optional if using Windows auth)
108-
- `password`: SQL Server password (optional if using Windows auth)
109-
- `trusted_connection`: Boolean flag for Windows Authentication
110-
111-
**Example prompt:**
112-
"Connect to our SQL Server database at [DBSERVER] with the name [DBNAME] using the [USERNAME] user and [PASSWORD] password."
113-
114-
#### Show-ConnectionStatus
115-
116-
Check the current database connection status.
117-
118-
**Example prompt:**
119-
"Is the database currently connected? Show me the connection status."
120-
121-
### Data Query and Schema Tools
122-
123-
#### Show-TableSchema
124-
125-
Get a detailed explanation of a database table's schema.
126-
127-
**Parameters:**
128-
- `table_name`: Name of the table to explain
129-
130-
**Example prompt:**
131-
"Explain the schema of the Permissions table. What columns does it have?"
132-
133-
#### Get-TableSchema
134-
135-
Retrieves the schema information for a specific table.
136-
137-
**Parameters:**
138-
- `table_name`: Name of the table to get schema for.
139-
140-
**Example prompt:**
141-
"Show me the schema for the Users table."
142-
143-
#### Get-TableSample
144-
145-
Retrieves a sample of 10 rows from the specified table.
146-
147-
**Parameters:**
148-
- `tablename`: Name of the table to sample
149-
150-
**Example prompt:**
151-
"Give me a sample of 10 rows from the Permissions table."
152-
153-
### Access Analysis Tools
154-
155-
#### Discover-SensitiveData
156-
157-
Identify locations containing sensitive data.
158-
159-
**Example prompt:**
160-
"Find all shares that contain sensitive data in our environment."
161-
162-
#### Get-TrusteeAccess
163-
164-
Identify where a specific user or group has access.
165-
166-
**Parameters:**
167-
- `trustee`: Domain\Username format
168-
- `levelsdown`: How many directory levels to traverse (default: 0)
169-
170-
**Example prompt:**
171-
"Where does DOMAIN\JohnDoe have access in our file systems?"
172-
173-
#### Get-TrusteePermissionSource
174-
175-
Determine the source of a user's permissions for a specific resource.
176-
177-
**Parameters:**
178-
- `trustee`: Domain\Username format
179-
- `resourcepath`: Path to the resource
180-
181-
**Example prompt:**
182-
"Why does DOMAIN\JaneDoe have access to \\server\share\folder? What's the source of this permission?"
183-
184-
#### Get-ResourceAccess
185-
186-
Show who has access to a specific resource.
187-
188-
**Parameters:**
189-
- `resource`: Path to the resource
190-
191-
**Example prompt:**
192-
"Who has access to \\server\finance? Show me all users and groups."
193-
194-
#### Get-UnusedAccess
195-
196-
Find users with unused access to a specific resource.
197-
198-
**Parameters:**
199-
- `resource`: Path to the resource
200-
201-
**Example prompt:**
202-
"Find all users who haven't accessed \\server\hr in the last year."
203-
204-
#### Get-ShadowAccess
205-
206-
Find users with shadow access to critical resources.
207-
208-
**Example prompt:**
209-
"Find all users who have shadow access to credit cards"
210-
"Find sbcloudlab\admins shadow access"
211-
212-
### Operational Tools
213-
214-
#### Get-RunningJobs
215-
216-
Check currently running Netwrix Access Analyzer jobs.
217-
218-
**Example prompt:**
219-
"Are there any Access Analyzer jobs running right now? Show me the status."
220-
221-
## Troubleshooting
222-
223-
### Connection Issues
24+
This MCP Server requires Netwrix Access Analyzer (NAA) File System or Active Directory scans to be completed.
25+
26+
## Available Tools
27+
28+
| Solution | Tool Name | Description |
29+
|------------------|---------------------------------|-------------|
30+
| Active Directory | Get-ADEffectiveMembership | Discovers effective group membership in AD with filters. |
31+
| Active Directory | Get-ADExceptions | Retrieves AD exceptions with optional filters. |
32+
| Active Directory | Get-ADPermissions | Retrieves AD permissions from the permissions view with filters. |
33+
| Active Directory | Get-DomainControllers | Lists domain controllers. |
34+
| Active Directory | Get-CertificateVulnerabilities | Lists certificate vulnerabilities. |
35+
| Active Directory | Get-ADCARights | Lists AD CA rights. |
36+
| Active Directory | Get-ADSecurityAssessment | Retrieves AD security assessment results. |
37+
| Active Directory | Get-ADUsers | Retrieves AD user details with filters. |
38+
| Active Directory | Get-ADGroups | Retrieves AD group details with filters. |
39+
| Active Directory | Get-ADComputers | Retrieves AD computer details with filters. |
40+
| Database | Connect-Database | Connects to a specified MSSQL database. |
41+
| Database | Show-ConnectionStatus | Shows the current DB connection status. |
42+
| Database | Show-TableSchema | Shows the schema for a given table. |
43+
| File System | Discover-SensitiveData | Discovers where sensitive data exists (DLP matches). |
44+
| File System | Get-OpenShares | Finds open shares accessible to broad groups. |
45+
| File System | Get-TrusteeAccess | Finds resources where a trustee has access. |
46+
| File System | Get-TrusteePermissionSource | Finds the source of access for a trustee/resource. |
47+
| File System | Get-ResourceAccess | Gets effective access for a resource path. |
48+
| File System | Get-UnusedAccess | Finds users with unused access to a share. |
49+
| File System | Get-RunningJobs | Lists running Netwrix Access Auditor jobs. |
50+
| File System | Get-ShadowAccess | Retrieves details about shadow access. |
51+
52+
## Installation Instructions (Claude Desktop)
53+
54+
1. **Install Claude Desktop**
55+
- Download and install Claude Desktop from the official website: https://claude.ai/download
56+
- Follow the installation prompts for your operating system (macOS, Windows, or Linux).
57+
58+
2. **Clone this repository**
59+
```sh
60+
git clone https://github.com/netwrix/mcp-server-naa.git
61+
cd mcp-server-naa
62+
```
63+
64+
3. **Connect Claude Desktop to this Server**
65+
- Add the following [`uv`](https://docs.astral.sh/uv/getting-started/installation/) configuration to your Claude Desktop MCP Configuration:
66+
```
67+
"NAA_AD": {
68+
"command": "/path/to/uv",
69+
"args": [
70+
"run",
71+
"--with",
72+
"pyodbc",
73+
"fastmcp",
74+
"run",
75+
"/path/to/mcp-server-naa/run.py"
76+
],
77+
"env": {
78+
"DB_SERVER": "HOST OR IP",
79+
"DB_NAME": "DATABASENAME",
80+
"DB_USER": "USERNAME",
81+
"DB_PASSWORD": "PASSWORD",
82+
"DB_USE_WINDOWS_AUTH": "FALSE|TRUE"
83+
}
84+
}
85+
```
86+
---
87+
88+
---
89+
# Troubleshooting
90+
91+
## Connection Issues
22492
22593
If you encounter connection issues:
22694
227-
1. Verify your SQL Server is running and accessible from your network
228-
2. Check your credentials in the `.env` file
95+
1. Verify your SQL Server is running and accessible from your network
96+
2. Check your credentials in the .env file
22997
3. Ensure the ODBC driver is correctly installed
23098
4. Check the logs for detailed error messages
23199
232-
### Claude Desktop Integration
100+
## Claude Desktop Integration
233101
234-
If Claude Desktop can't find the `uv` command:
102+
If Claude Desktop can't find the uv command:
235103
236-
1. Use the full path to `uv` in your configuration (use `which uv` or `where uv` to find it)
104+
1. Use the full path to uv in your configuration (use which uv or where uv to find it)
237105
2. Make sure you've restarted Claude Desktop after configuration changes
238-
3. Check the Claude logs for any error messages related to the MCP server
106+
3. Check the Claude logs for any error messages related to the MCP server
107+
108+
## Community
109+
110+
If you need help using this MCP server or understanding your results, just visit the [Netwrix Community](https://community.netwrix.com/) - we’re here to help!

0 commit comments

Comments
 (0)