Press CTRL+K to open search

Integrate Resolve with MCPs

  • Published on Oct 14, 2026
  • 1 minute(s) read
Prev Next

Adding MCP connectors lets you expand the scope of actions Resolve is able to perform.

Without MCP connectors, Resolve is limited to actions that can be run directly by the agent running on the end user's device. By adding an MCP connector to external software, Resolve can run additional actions through that software.

For example, you could:

  • Add an MCP connector to MS Graph to allow Resolve to reset a user's password
  • Add an MCP connector with your security software to isolate a device if a critical threat is identified.

You have full control over which actions in the MCP are accessible to Resolve, and which ones require an administrator approval.

Step 1: Add the MCP connection details

  1. Go to Settings > Investigations > Integrations > MCP Connectors > Add Integration.
  2. Select from one of the built-in options or select Custom MCP Server and add the connection details.

Step 2: Decide which actions to make available to Resolve

  1. Click the Investigation Config icon to view the list of actions available through the MCP server.
  2. On the left side, enable the actions that you want Resolve to be able to perform.
  3. For each action that you enabled, use the Requires Approval toggle on the right side to decide whether Resolve can perform the action autonomously, or whether an administrator must review and approve the action.
Relation between general approval requirements and MCP action approval requirements

Your MCP action approval requirements allow you to be more restrictive than your general admin approval settings, but not less restrictive.

If your general settings require a certain category of action (diagnostic or mitigation) to be approved, then all MCP actions from that category must also be approved, regardless of how you configure them.

If your general settings allow a certain category of actions to run without approval, you can set an MCP action from that category to require approval and it will be enforced.

Step 3: Enable the use of MCP tools

After you've configured your MCP connectors, you can enable the "master switch" to start using them in investigations.

Under Settings > MCP Connectors, enable Allow external connector tools in investigations.