User Guide Functional Overview Requirements Architecture System Installation NetEye Additional Components Installation Setup The neteye Command Director NetEye Self Monitoring Tornado Business Service Monitoring IT Operation Analytics - Telemetry Geo Maps NagVis Audit Log Shutdown Manager Reporting ntopng Visual Monitoring with Alyvix Elastic Stack IT Operations (Command Orchestrator) Asset Management Service Level Management Cyber Threat Intelligence - SATAYO NetEye.Cloud Solution Monitoring Business Service Monitoring Asset Management ELK - Log Analytics SOC System Administrator SOC Attacker Centric Cyber Threat Intelligence - SATAYO NetEye Update & Upgrade Backup and Restore How To NetEye Extension Packs Troubleshooting Security Policy Glossary
module icon Cyber Threat Intelligence - SATAYO
About SATAYO Getting Started Threat Intelligence and Security Operations How SATAYO works MITRE ATT&CK Coverage Dashboard SATAYO Findings SATAYO REST API SaaS & Managed Mode SATAYO MCP Server
NetEye.Cloud Solution Monitoring Business Service Monitoring Asset Management ELK - Log Analytics SOC System Administrator SOC Attacker Centric Cyber Threat Intelligence - SATAYO Introduction to NetEye Monitoring Business Service Monitoring IT Operation Analytics Visualization Network Visibility Log Management & Security Orchestrated Datacenter Shutdown Application Performance Monitoring User Experience Service Management Service Level Management & Reporting Requirements for a Node Cluster Requirements and Best Practices Kubernetes Networking NetEye Satellite Requirements TCP and UDP Ports Requirements Additional Software Installation Introduction Single Node Cluster Kubernetes NetEye Master Master-Satellite Architecture Underlying Operating System Acquiring NetEye ISO Image Installing ISO Image Single Nodes and Satellites Cluster Nodes Configuration of Tenants Satellite Nodes Only Nodes behind a Proxy Additional NetEye Components Satellites Nodes only Verify if a module is running correctly Accessing the New Module Cluster Satellite Security Backup and Restore Identity and Access Management External Identity Providers Configure federated LDAP/AD Emergency Reset of Keycloak Configuration Keycloak Hostname Configuration Advanced Configuration Roles Single Page Application in NetEye Module Permissions and Single Sign On Within NetEye Importing User Federation Groups inside another Group Importing OIDC IdP Groups inside another Group Resource Tuning Advanced Topics Basic Concepts & Usage Advanced Topics Monitoring Environment Templates Monitored Objects Import Monitored Objects Data Fields Deployment Icinga 2 Agents Configuration Baskets Dashboard Monitoring Status Integration with Elasticsearch VMD Permissions Notifications Jobs API Configuring Icinga Monitoring Retention Policy NetEye Self Monitoring Concepts Collecting Events Add a Filter Node WHERE Conditions Iterating over Event fields Retrieving Payload of an Event Extract Variables Create a Rule Tornado Actions Test your Configuration Export and Import Configuration Example Under the hood Development Retry Strategy Configuration Thread Pool Configuration API Reference Configure a new Business Process Create your first Business Process Node Importing Processes Operators The ITOA Module Configuring User Permissions Telegraf Metrics in NetEye Telegraf Configuration Telegraf on Monitored Hosts Visualizing Dashboards Customizing Grafana The NetEye Geo Map Visualizer Map Viewer Configuring Geo Maps NagVis Audit Log Overview Shutdown Manager user Shutdown Manager GUI Shutdown Commands Advanced Topics Overview User Role Management Cube Use Cases ntopng and NetEye Integration Permissions Retention Advanced Topics Overview User Roles Install Alyvix Core Install Alyvix Service Nodes RDP Client Tutorial Overview Example: Windows Start Button Example: Open Windows Settings Example: Web Browser Test Case Example: Authentication Test Case Alyvix Tutorial Video Index Building Tools Editor: Interface Overview Editor: Script Building Editor: Managing Scripts Designer: Interface Overview Designer: Interface Options Designer: Component Tree Selector: Interface Overview Test Case Execution Test Case Format Test Case Management Dashboard Use Cases Overview Architecture Authorization Kibana Elasticsearch Cluster Elasticsearch Configuration Replicas on a Single Node Elasticsearch Performance tuning Overview Enabling El Proxy Sending custom logs to El Proxy Configuration files Commands Elasticsearch Templates and Retentions El Proxy DLQ Blockchain Verification Handling Blockchain Corruptions El Proxy Metrics El Proxy Security El Proxy REST Endpoints Agents Logstash Rsyslog Elastic APM Elastic RUM Multitenant OpenTelemetry Collector Elastic XDR Overview Authorization in the Command Orchestrator Module Configuring CLI Commands Executing Commands Overview Permissions Installation Plugins Single Tenancy Multitenancy Communication through a Satellite Asset collection methods Display asset information in monitoring host page Overview Customers Availability Event Adjustment Outages Resource Advanced Topics Introduction The Intelligence We Produce Mitre Attack Coverage Getting Started Settings SATAYO Items Intelligence Requirements Managed Service Request Form FAQ Changelog SATAYO Community NetEye.Cloud as a SaaS solution NetEye.Cloud Subscription Base Concepts Authentication Options Authentication via IdP Group Claims for Authorization Management Authentication via Microsoft Entra ID Roles and Permissions Authorization Navigating the UI Monitoring with NetEye.Cloud Monitored Objects Finding and Filtering Hosts Exporting Monitoring Data Viewing Host and Service Details Organizing with Groups Tactical Overview Problems View Dashboard Typical Daily Interactions Scheduled Downtime Notifications and Alerts AutoDiscovery VMD Business Service Monitoring Business Process Logic Business Process View Asset Management in NetEye.Cloud Automatic Inventory Collection Software & License Management Contract & Supplier Management Change & Lifecycle Management Getting Started with ELK Analytics SOC System Administrator (AdS) Access to NetEye and Elastic Elastic Dashboards Elastic Discover Elastic Alerts Elastic Rules Introduction to SOC Attacker Centric Service Description NetEye SIEM About SATAYO Getting Started Threat Intelligence and Security Operations How SATAYO works MITRE ATT&CK Coverage Dashboard SATAYO Findings SATAYO REST API SaaS & Managed Mode SATAYO MCP Server Before you start Update Procedure Single Node Upgrade from 4.50 to 4.51 Cluster Upgrade from 4.50 to 4.51 Satellite Upgrade from 4.50 to 4.51 DPO machine Upgrade from 4.50 to 4.51 Create a mirror of the RPM repository Sprint Releases Feature Troubleshooting Backup and Restore Tornado Networking Service Management - Incident Response IT Operation Analytics - Telemetry Identity Provider (IdP) Configuration NetEye Cluster on Microsoft Azure NetEye Cluster on AWS Introduction to NEP Getting Started with NEPs Online Resources Obtaining NEP Insights Available Packages Advanced Topics NEP Updates & Upgrades Setup Configure swappiness Restarting Stopped Services Enable stack traces in web UI How to access standard logs Director does not deploy when services assigned to a host have the same name How to enable/disable debug logging Activate Debug Logging for Tornado Modules/Services do not start Sync Rule fails when trying to recreate Icinga object How to disable InfluxDB query logging Managing an Elasticsearch Cluster with a Full Disk Some logs are not indexed in Elasticsearch Elasticsearch is not functioning properly Reporting: Error when opening a report Debugging Logstash file input filter Bugfix Policy Reporting Vulnerabilities Cyber Resilience Act Compliance Glossary

SATAYO MCP Server

Warning

This is an experimental feature: it can be changed or removed at any time, without prior notice.

The SATAYO MCP Server lets you connect an AI assistant, such as Claude Code, to SATAYO, so that you can ask questions about your findings in natural language, for example “Which exposed credentials were found for my domains in the last month?”. The assistant retrieves the answer directly from SATAYO.

The server uses the Model Context Protocol (MCP), an open standard supported by many AI assistants and tools.

Key points:

  • Read-only: the assistant can read your SATAYO data, but it cannot create, modify or delete anything.

  • Your own permissions: you sign in with your SATAYO account, and the assistant sees exactly what you see in the SATAYO web interface, nothing more.

  • No secret to manage: you do not need an API key or a client secret. Signing in happens in your browser, on the usual SATAYO login page.

Requirements

To use the SATAYO MCP Server you need:

  • A SATAYO account, the same you use to log in to the SATAYO web interface.

  • An AI assistant that supports remote MCP servers over Streamable HTTP transport, with OAuth authentication, and version 2026-07-28 of the MCP specification. Older clients that support only earlier versions of the specification cannot connect, so keep your assistant up to date.

Connection Settings

These are the only settings you need to configure in your AI assistant. Replace <satayo-host> with the host name of your SATAYO instance.

Setting

Value

Server URL

https://<satayo-host>/satayo/api/mcp/v0

Transport

Streamable HTTP (often called just HTTP)

Authentication

OAuth

OAuth Client ID

satayo2-mcp-client

OAuth Client Secret

None, leave it empty

OAuth Callback URL

Any address on http://localhost, on any port

Most assistants find all the other information, such as the address of the SATAYO login page, automatically.

Note

The OAuth Client ID is required because SATAYO does not support the automatic registration of new clients. If your assistant does not let you set a Client ID, it cannot connect to SATAYO.

Example: Claude Code

This example shows how to connect Claude Code to SATAYO. Make sure you are using a recent version of Claude Code.

Step 1: Add the Server

Run the following command in a terminal, replacing <satayo-host> with the host name of your SATAYO instance:

claude mcp add --transport http satayo \
  https://<satayo-host>/satayo/api/mcp/v0 \
  --client-id satayo2-mcp-client \
  --callback-port 7777

The options mean:

  • satayo: The name you give to the server in Claude Code. You can choose any name.

  • --client-id satayo2-mcp-client: The OAuth Client ID to use for signing in.

  • --callback-port 7777: The local port where Claude Code receives the result of the login. You can use any free port.

By default the server is available only to you, and only in the current directory. To make it available in all your directories, add --scope user to the command.

Step 2: Sign In

Start Claude Code and type:

/mcp

Select the satayo server and choose to authenticate. Your browser opens the SATAYO login page: log in with your SATAYO account as usual. When the browser confirms that the authentication succeeded, go back to Claude Code.

You need to sign in only once: Claude Code keeps the connection active and renews it automatically. If the session expires, run /mcp again and sign in.

Step 3: Check the Connection

Run the following command in a terminal:

claude mcp get satayo

If everything works, the output will show Status: ✔ Connected. You can also type /mcp in Claude Code and select the satayo server to see the list of available tools.

Step 4: Ask Your Questions

You can now ask Claude Code about your SATAYO data in natural language. For example:

  • “Use SATAYO to tell me which organizations and monitored domains I can see.”

  • “Show me the open credential findings in SATAYO, most recent first.”

  • “Are there any SATAYO findings related to the domain example.com?”

  • “Summarize the SATAYO attack surface composition and tell me which findings I should look at first.”

The first time Claude Code uses a SATAYO tool, it will ask for your permission. You can allow it once or for the whole session.

Sharing the Configuration with Your Team

To share the configuration with your team, create a file named .mcp.json in the root folder of your project, with the following content:

{
  "mcpServers": {
    "satayo": {
      "type": "http",
      "url": "https://<satayo-host>/satayo/api/mcp/v0",
      "oauth": {
        "clientId": "satayo2-mcp-client",
        "callbackPort": 7777
      }
    }
  }
}

This file does not contain any credentials, so you can safely commit it to your repository. Each team member signs in with their own SATAYO account, as described in Step 2: Sign In, and sees only the data they are allowed to see.

Other AI Assistants

Any AI assistant that meets the Requirements can connect to SATAYO using the Connection Settings. The exact steps depend on the assistant: please refer to its documentation on how to add a remote MCP server with OAuth authentication.

To try the server without an AI assistant, you can use the MCP Inspector, a tool that lets you call the server manually:

npx @modelcontextprotocol/inspector

In the MCP Inspector, select Streamable HTTP transport, enter the Server URL and the OAuth Client ID from the Connection Settings, and connect.

Troubleshooting

Problem

Solution

The assistant reports that it needs authentication, or answers with 401

You are not signed in, or your session expired. In Claude Code, run /mcp and sign in again.

The SATAYO login page shows Invalid parameter: redirect_uri

The callback URL of your assistant is not on localhost. Configure the assistant to use a callback URL on http://localhost.

The assistant reports Unsupported protocol version

Your assistant does not support version 2026-07-28 of the MCP specification. Update it to the latest version.

The assistant cannot register a client, or asks for a Client ID

Set the OAuth Client ID satayo2-mcp-client, as described in Connection Settings.

Questions do not return results

Ask the assistant to call the whoami tool to check which organizations and monitored domains you can see.
Blog Online Demo Training
Contact Us
© 2026, Würth IT Italy s.r.l.
VAT ID 01054690217
Privacy Cookies