macadmins / macadmins/osquery-extension

Add MCP server table

Open
#127 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
132
Forks
41
Avg merge
1d 48m
Merged PRs (30d)
3

Description

Currently it is difficult to audit what mcp servers are in use (specifically as configured in popular IDEs) and what options (in general - redaction is in play to attempt to not make poor auth situations worse by letting the SIEM find out about it) are used for connecting to them. We were using an augeus lens to parse the specific known json locations, but that's a bit clunky. This is otherwise a blind spot to know what's being used/pointed where and how many of those connections are following 'best practices' vs leaving auth on disk in plaintext 😅
The redaction process is imperfect as a known issue, but the feature works and the people who worked on this before I came along iterated on it a few times to clean out just about all failure cases we saw. We've only pushed it out to Macs is why it's Darwin-only, but linux should be relatively low-effort to add. There's an 'inert' feature hinted at about user being a column you can constrain by, but there's other things currently under-optimized we can address along with that in a subsequent planned PR... it involves bumping the osquery-go for a big fix, the newer micromdm/plist also bundles better error handling/result retention when an issue is encountered
It's a fair amount of code - 30 files changed, ~2k lines (plus over 1k lines of tests) added, we're moving/promoting golang.org/x/sys from indirect to direct as a dependency, (and I also have some ideas for additional schema/usage docs and such,) just checking if sounds like a reasonable thing to contribute as-is?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No specific files, tests, or entry points are named. Start by reviewing the existing Darwin-only MCP server implementation and its tests, then confirm the proposed schema, IDE configuration locations, redaction behavior, and Linux scope with the maintainers. Done should include the table, coverage for its connection options, and passing tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.