Bitdefender MCP

Bitdefender + AI - for ChatGPT, Claude, GitHub Copilot, Microsoft 365 Copilot, Gemini, and any agent that speaks MCP

Unofficial. Community-built Claude Code Skill and MCP server for the Bitdefender API. Not affiliated with, endorsed by, or sponsored by Bitdefender SRL.

_{▶ Watch the 30-second demo - demo data is simulated; every command shown exists in the real CLI.}

140 GravityZone API methods, plus fleet health, billing and incident views across child companies. Works with the AI you already use - ChatGPT (Plus/Pro+, paused until this connector is reprinted; see mcp-install.md), Claude Desktop, Codex, Claude Code, Claude Cowork, and GitHub Copilot - plus Microsoft 365 Copilot / Copilot Studio and Google Gemini via the remote path. Free, open source, runs on your laptop. Built for MSP owners. No code required.

Works with your agent

Security note (until this connector is reprinted). Do not run HTTP mode (--transport http), not even on localhost. This build checks a token, but it predates the fix release's request size and time limits. The MCP tools can also make changes with your credentials. Use the default stdio transport. If you set up a tunnel for a remote agent, shut it down. A fix is on the way.

The six agents MSP owners actually use (self-serve, works today):

Your AI agent	How to install the Bitdefender skill
Claude Desktop	Run installer, then Settings > Extensions to register bitdefender-mcp (no JSON editing).
ChatGPT (paid plans)	Paused until this connector is reprinted: ChatGPT needs its HTTP mode, and in this build that mode checks a token but has no request size or time limits yet. See the security note in mcp-install.md.
Codex CLI	Paste the install prompt below.
Claude Code	Paste the install prompt below.
Claude Cowork	Paste the install prompt below.
GitHub Copilot (VS Code)	Run installer, add bitdefender-mcp to mcp.json under the servers key, then pick Agent mode.

ChatGPT needs a remote HTTPS server, which means this connector's HTTP mode, and that is paused until the connector is reprinted: in this build that mode checks a token but has no request size or time limits yet. See the security note in mcp-install.md.

Also for the Microsoft and Google stacks

Big install base, but an honest heads-up: these are the remote / enterprise path, not the local binary you just installed.

Agent	What it takes
Microsoft 365 Copilot / Copilot Studio	Paused until this connector is reprinted: Copilot Studio needs its HTTP mode, and in this build that mode checks a token but has no request size or time limits yet. See the security note in mcp-install.md.
Google Gemini	Gemini CLI is local - same as Claude Code. The Gemini app is remote and needs the same paused HTTP mode as ChatGPT. See mcp-install.md.

Skill-native agents (also covered): Hermes and OpenClaw read this skill's SKILL.md directly and speak MCP - see their install sections below. Also works with Cursor, Windsurf, Cline, Continue.dev, and Zed via MCP. Full per-tool wire-up: docs/which-agent.md.

Run more than one agent? Install across all 51+ supported agents in one command: npx skills add Servosity/msp-skills@latest (requires Node.js, then run the per-skill installer for the CLI/MCP binaries). See docs/which-agent.md.

Install in 60 seconds

Fastest for Claude Desktop - one-click .mcpb

Download Bitdefender MCP (.mcpb) - then open Claude Desktop > Settings > Extensions and select the file. One click, no JSON, no shell. (Browse every Bitdefender release on the releases page.)

Prefer the Claude Code plugin? Add the marketplace once, then install - works immediately, no directory listing required:

/plugin marketplace add Servosity/msp-skills
/plugin install bitdefender@msp-skills

Path A - paste one prompt into your AI agent (recommended)

Copy this into Claude Code, Codex CLI, or Claude Cowork:

Install the Bitdefender Skill and MCP server from Servosity/msp-skills in this agent workspace. If this workspace uses a POSIX shell (macOS, Linux, WSL, or Bash), run bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/bitdefender/install.sh). If it uses Windows PowerShell, run iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/bitdefender/install.ps1 | iex. Then authenticate per the README and run bitdefender-cli --help to explore.

The same prompt works in any agent that can run shell.

Path B - run the installer yourself

Windows (PowerShell):

iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/bitdefender/install.ps1 | iex

macOS / Linux:

bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/bitdefender/install.sh)

The installer drops both bitdefender-cli (the CLI) and bitdefender-mcp (the MCP server) into your user bin path. Claude Code, Codex, and Cowork discover the Skill via SKILL.md in this directory.

Verify:

bitdefender-cli --version

Upgrade to the latest version

The installer always fetches the current release - re-run it to upgrade:

macOS / Linux:

bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/bitdefender/install.sh)

Windows (PowerShell):

iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/bitdefender/install.ps1 | iex

Claude Desktop .mcpb users: download the latest .mcpb (top of this section) and re-select it in Settings > Extensions. Claude Code plugin users: /plugin update bitdefender@msp-skills.

Add to Claude Desktop, GitHub Copilot, Gemini CLI, Microsoft 365 Copilot, or another MCP client

After the installer runs, see mcp-install.md and docs/which-agent.md for the per-agent wire-up - one section per agent, including the GitHub Copilot servers key and the remote Microsoft 365 Copilot / Copilot Studio path. Claude Desktop's Settings > Extensions panel is the simplest path; the MCP config block (for users who prefer editing JSON) is documented in mcp-install.md.

Install for Hermes

From the Hermes CLI:

hermes skills install servosity/msp-skills/skills/bitdefender --force

Inside a Hermes chat session:

/skills install servosity/msp-skills/skills/bitdefender --force

Hermes speaks MCP natively, so it can also use the bitdefender-mcp server directly - same install path, same env vars.

Install for OpenClaw

Tell your OpenClaw agent (copy this):

Install the bitdefender skill from https://github.com/servosity/msp-skills/tree/main/skills/bitdefender. The skill defines how its required CLI (bitdefender-cli) can be installed via the openclaw: frontmatter block.

OpenClaw isn't generally available yet; the frontmatter wiring is pre-shipped and will activate the moment OpenClaw launches.

Authenticate

Set the API key from GravityZone Control Center (user icon > My Account > Control Center API). BITDEFENDER_BASE_URL is only needed when your Access URL is not https://cloud.gravityzone.bitdefender.com/api:

BITDEFENDER_API_KEY=<value> bitdefender-cli doctor

On Windows (PowerShell):

$env:BITDEFENDER_API_KEY = "<value>"
bitdefender-cli doctor

doctor checks config, paths and API reachability, and sends the key to GravityZone's getApiKeyDetails method, so a rejected or deleted key shows up as a Credentials: ERROR row and a wrong base URL as an API: ERROR row. It exits 0 even then, so scripts should add --fail-on error. bitdefender-cli api-key --json shows which API areas the key has.

What this skill does

Question your MSP keeps asking	Command
Which customers have unmanaged, outdated or unscanned endpoints?	bitdefender-cli fleet health
What changed in endpoint protection since last week?	bitdefender-cli fleet changes --since 7d
What open incidents across every client are high or critical?	bitdefender-cli fleet incident-queue --priority high,critical
Is the same malware quarantined at several customers, and is it blocklisted?	bitdefender-cli fleet threats --window 7d
Which customer is this machine in, and what is its endpoint id?	bitdefender-cli fleet locate "LAPTOP-7"
Which machines in my RMM have no Bitdefender agent?	bitdefender-cli fleet rmm-gap --devices ninja-devices.csv
What did each customer use last month, after the partner rollup?	bitdefender-cli usage billing --month 09/2026
List every child company and sub-partner with its id and parent	bitdefender-cli companies tree

Full command reference: guide.md. For the AI-agent operating contract (--agent, --dry-run, when to confirm before mutating), see AGENTS.md.

What makes this different

Most Bitdefender GravityZone integrations and MCP servers proxy each question into a live API call. That's fine for one record. It dies at scale, when you're asking "which of my 60 customers have unmanaged machines or agents that went out of date since last week".

GravityZone's Public API is JSON-RPC, one method per call, and the company tree comes back one level per getCompaniesList call. This skill walks the whole partner tree for you and fans each question out across every child company. fleet health saves each run as a dated local snapshot (SQLite), so fleet changes diffs two runs, and fleet locate and fleet rmm-gap answer from the latest one without another fan-out. A company it could not read completely is listed in fetch_failures, never counted as clean.

Integrations such as Liongard's GravityZone inspector and Sumo Logic's GravityZone automation integration bring GravityZone data into their own platforms. This one puts the cross-customer answers in whichever AI agent you already use. It complements GravityZone Control Center rather than replacing it: the console stays the place for policy authoring, investigations and day-to-day response.

The pain this closes

The GravityZone Public API is JSON-RPC, and getCompaniesList answers one level of the company tree at a time, so every MSP script walks sub-partners and folders itself, then pages getEndpointsList per company. A Bitdefender Expert Community thread shows a hand-built PowerShell paging loop that still returned the wrong group of the hierarchy. Meanwhile the morning questions live on different Control Center pages (Network, Incidents, Quarantine, the monthly usage reports), and month-end billing means working out each partner's own share of rolled-up usage by hand.

• bitdefender-cli fleet health - every child company ranked by unmanaged, outdated, unscanned, policy-not-applied and isolated endpoints.
• bitdefender-cli fleet incident-queue --sla 24h - one open EDR/XDR incident queue across every customer, worst and oldest first, unassigned incidents flagged.
• bitdefender-cli fleet threats - the same quarantined file (SHA256) at two or more customers, and whether each one blocklists it.
• bitdefender-cli usage billing --month 09/2026 - per-company usage with each partner's own share after the rollup, ready to check against PSA agreements.

See pain-point.md for the longer narrative.

Frequently asked questions

Does this work with ChatGPT?

Not with this build. ChatGPT (Plus, Pro, Team, Business, Enterprise, and Education plans; Free does not yet expose Developer Mode) connects only to remote MCP servers over HTTPS, which means running the Bitdefender MCP server in HTTP mode. In this build HTTP mode checks a token but has no request size or time limits yet, so do not run it or put it behind a tunnel until the connector is reprinted; the security note in mcp-install.md explains why. Until then, use Claude Desktop, Claude Code or Codex.

Does this work with Codex, Cursor, Windsurf, Cline, Copilot, or Gemini?

Yes - all of them speak MCP. Cross-tool install commands are in the matrix above and the deep-dive in docs/which-agent.md.

Do I need to know how to code?

No. The recommended install is to paste one sentence into Claude Code or Codex - your agent reads SKILL.md and does the install. The fallback is a one-line installer per OS (bash or PowerShell). Neither path requires writing code. You'll enter your Bitdefender credentials once.

Is my Bitdefender data safe?

Your data stays on your machine. The CLI and MCP server are local binaries. The fleet snapshot store (SQLite) sits in a directory under your user account. The AI agent only sees what the CLI returns - typically a query result, not raw bulk data. Credentials are read from your environment or your agent's config; never bundled into this repo or transmitted anywhere by MSP Skills.

What GravityZone API key do I need?

A Control Center API key: click the user icon in Control Center, choose My Account and use the Control Center API section, which also shows the Access URL. Keys are scoped per API area when you create them, with no read/write split inside an area. The fleet commands need the Companies and Network APIs, plus Licensing for usage billing, Incidents for fleet incident-queue, and Quarantine and Incidents for fleet threats. Set BITDEFENDER_API_KEY, and set BITDEFENDER_BASE_URL to your Access URL if it is not https://cloud.gravityzone.bitdefender.com/api.

Does it need a partner account?

For the cross-customer views, yes: walking child companies needs a partner-level key, because getCompaniesList is a partner API. A customer-level key works, but every fleet view then covers only that one company.

Will this hit GravityZone API rate limits?

Control Center limits each API key to a number of requests per second and answers 429 with a Retry-After header when you go over. The CLI paces itself at 5 requests per second by default (--rate-limit) and waits out a 429. getIncidentsList allows about 3 calls a minute, so fleet incident-queue makes one partner-wide call and spaces any extra pages 21 seconds apart.

Can the AI isolate a machine or run a command on an endpoint by itself?

Only if you let it. Generated commands run as soon as they are invoked and do not prompt, so preview with --dry-run first: it prints the JSON-RPC method and parameters it would send, without sending. Over MCP, the generic bitdefender_execute tool can call any GravityZone method, including isolation, kill process, remote command execution and deletes, gated only by your AI app's approval prompt. For an agent that should only read, set BITDEFENDER_MCP_READ_ONLY=1 in the MCP server's environment: bitdefender_execute then runs only GravityZone read methods, refuses every write and the Credential-tier reads, and the import tool is hidden. Incident reads stay allowed, and XDR evidence can hold connection headers captured on the endpoint, so treat incident output as sensitive. Keep the approval prompt on.

Why does fleet changes say it has nothing to compare?

It diffs saved snapshots, and each fleet health run saves one (unless you pass --no-save). Run fleet health at least twice, for example daily, and fleet changes reports endpoints added or removed, managed/unmanaged flips, newly outdated agents, policies no longer applied and isolation changes between them.

Does it see endpoints from GravityZone's Active Directory integration?

Not in the fleet commands. They read getEndpointsList, which returns the Computers and Groups inventory; Bitdefender documents that endpoints living only under the Active Directory integration come from getNetworkInventoryItems instead. So fleet health counts, --fail-on and fleet rmm-gap cover Computers and Groups, and the fleet health, fleet locate, fleet rmm-gap and fleet changes results carry an inventory_scope field that says so. Before deploying an agent to a device rmm-gap lists as missing, check it with inventory list (a Credential-tier read, because its company rows carry license keys).

Does it work with on-premises GravityZone?

It speaks the same JSON-RPC Public API, so set BITDEFENDER_BASE_URL to your Control Center's Access URL. It has not yet been verified against a live on-premises console.

Does it replace GravityZone Control Center?

No. Control Center stays best for policy authoring, investigations and day-to-day console work. This skill answers the across-every-customer questions and runs scripted actions from your AI agent.

What does it cost?

Free. Apache-2.0 licensed. You pay only for whichever AI agent you use (Claude, ChatGPT, Codex, etc.), and that's billed by your AI provider, not by us.

Safety model

Tier	Examples	Recommended agent policy
Read	fleet health, fleet incident-queue, fleet threats, fleet locate, fleet rmm-gap, fleet changes, companies tree, usage billing, usage monthly, companies list, endpoints list, endpoints get, incidents list, quarantine list, policies list, patches missing, tasks status, reports list	Allow
Endpoint response	isolation isolate, isolation restore, endpoints kill-process, investigation run-command, investigation kill-process, investigation collect-package, investigation retrieve-file, tasks scan, tasks reconfigure, quarantine remove, quarantine restore, quarantine empty, live-search, yara, response-actions create	Human-in-the-loop, explicit confirmation - these reach real customer machines
Protection and policy config	policies set-modules, endpoints assign-policy, blocklist add, blocklist remove, custom-rules create, custom-rules update, custom-rules delete, phasr apply, maintenance-windows create, push set, integrations create, aws-ec2 configure, endpoints move, groups move	Preview with --dry-run, then a human-approved write - an exclusion rule, a weaker policy or a move into another group's policy can open a hole
Write (routine)	incidents note, incidents set-status, incidents assign, endpoints set-label, groups create, company-folders create, reports create, packages create	Preview with --dry-run, then a reviewed write
Credential and access	push get (returns the webhook Authorization value), license get (returns the license key), companies get-by-user (takes a user's password), packages get, packages install-links, integrations get, policies get (policy password settings), inventory list (can return license keys), accounts create, accounts update, accounts delete, email-verification, auth set-token	Human-in-the-loop only
Destructive and commercial	import (one create per JSONL line, so it can reach any tier above), endpoints delete, endpoints move-to-company, company-folders move, companies create, companies suspend, companies delete, company-folders delete, groups delete, packages delete, license set-key, license add-product-key, license remove-product-key, license set-monthly-subscription	Human-in-the-loop only, explicit confirmation

Generated commands run as soon as they are invoked; preview with --dry-run. Over MCP, the generic bitdefender_execute tool can reach every write in the table; set BITDEFENDER_MCP_READ_ONLY=1 for an agent that should only read.

The strongest control is the scope you grant the Bitdefender credentials - the CLI can only do what the credentials are permitted to do. Full details, including how to lock it down, are in governance.md.

Status

Beta. Validated against the Bitdefender API surface and being validated with MSPs running it live against their own production tenant in our weekly Build Sessions. RSVP at compoundingteams.com/build-sessions.

---

Standards. Conforms to the open Agent Skills spec (Anthropic, Dec 2025; 40+ agents). MCP-compatible - works with any MCP-capable agent including Hermes. OpenClaw-ready (frontmatter pre-wired, awaiting OpenClaw launch).

Maintained by Servosity. Apache-2.0 licensed. Built with CLI Printing Press. Last updated: 2026-10-16.