Who it is for
Security operations teams automating detection, response and cloud posture work.
LimaCharlie
SecOps automation across EDR, XDR, vulnerability and cloud security
Overview
What LimaCharlie does
LimaCharlie is a security operations platform covering EDR, XDR, vulnerability management and cloud security, and this connector automates against it.
The surface is unusually large, and its shape reflects a platform rather than a product: detection and response rules can be set, investigations and cases managed, LCQL queries run against telemetry, cloud security graphs traversed for public access and neighbour relationships, and CVEs mapped to affected hosts. Administration is included down to groups, secrets, quota usage and billing plans. Community tier, documentation published.
Tool surface
Three hundred and thirty-nine tools answered against 175 claimed, a gap of well over a hundred. They span detection rules such as set_rule and set_dr_managed_rule, investigations and cases, LCQL queries, cloud security graph traversal, vulnerability-to-host mapping, and tenant administration down to billing plans and quotas.
Availability
Where LimaCharlie is listed
LimaCharlie is listed in the Claude connectors directory only. LimaCharlie has no app under the same domain in the ChatGPT directory; 392 of the 3,150 products here are on both marketplaces, and this is not one of them.
The MCP server behind a Claude connector is usually the same server a ChatGPT app would need, so the absence is a distribution decision rather than a technical one.
Claude listing
In the Claude connectors directory
LimaCharlie publishes 175 tools to Claude. Only 8 of the 1,253 Claude-listed connectors expose more, one of the widest tool surfaces in the directory.
The median Claude-listed connector filed under the Other bucket publishes 10, so this one runs 165 tools above its bucket's median and ranks 1st of 22 by tool count.
It falls in the 51+ tools band, which holds 9.6% of the Claude directory.
Measured against the live endpoint
A direct call to the endpoint returned 339 tools, 164 more than the 175 the listing publishes. Probed 2026-08-07.
Tools the server actually returns
vulnerability_cve_hostscloudsec_get_public_accessdelete_saved_queryget_driverslist_investigationsadd_case_entityset_dr_managed_ruleset_ruleget_quota_usagecloudsec_get_graph_neighborsrun_lcql_query_freeset_exfil_watch_rulecreate_grouplist_billing_plansdisable_secretcloudsec_export_csvanalyze_lcql_queryget_process_modulesget_autorunsget_packagesadd_tagexpand_investigationdelete_ai_skillrun_lcql_queryget_usage_statsremove_feedback_channelgenerate_dr_rule_respondgenerate_detection_summarylc_call_toolcloudsec_get_fleet_overviewget_dr_managed_ruleenable_fp_ruleget_lookupset_hive_record_commentcloudsec_list_caasm_assetsget_process_stringsremove_org_from_groupstart_ai_sessionlist_ai_usagecloudsec_run_queryfind_sensors_by_tagget_case_reportvulnerability_bulk_set_finding_resolutionvalidate_hive_recordyara_scan_directorysearch_case_entitiesadd_org_userquery_lookupdelete_extension_configlist_feedback_channelsget_adapter_sensorsdelete_ai_memorydelete_reliable_taskadd_case_telemetryset_org_noteget_saved_querydelete_cloud_sensorcloudsec_test_providervulnerability_snapshot_listrun_saved_querycloudsec_set_finding_ticketlist_playbookslist_api_keysrequest_feedback_ackgenerate_dr_rule_detectionisolate_networkget_fp_ruleget_mitre_reportget_org_noteget_artifacttask_sensorget_case_dashboarddelete_dr_service_ruledelete_rulecloudsec_get_identity_facetscloudsec_get_policy_vocabularyreliable_taskingget_users_permissionslist_audit_logslist_payloadsdelete_org_notelist_available_extensionslist_dr_service_rulesset_dr_service_rulelist_user_orgsget_installation_keyget_ai_session_historylist_external_adaptersenable_adapterget_ai_chatsearch_iocsget_billing_detailsget_org_oid_by_namelist_outputscloudsec_list_attack_pathslist_sensor_tagswait_sensor_onlineset_org_descriptiongenerate_lcql_queryget_online_sensorslist_ai_sessionscloudsec_list_chokepointscloudsec_list_compliance_frameworksget_historic_eventsget_event_by_atomdir_find_hashenable_dr_ruledelete_groupget_sopcloudsec_list_changesestimate_lcql_queryget_detectionset_saved_querylist_cloud_sensorsexport_sensorscreate_orgvulnerability_get_cvecloudsec_get_overviewcloudsec_list_finding_causescloudsec_get_identityget_sensor_infolist_with_platformget_network_connectionscloudsec_set_finding_ownerlist_dr_general_rulescloudsec_get_risk_trendwho_am_iget_fp_rulesadd_group_memberset_lookupget_extension_configset_extension_configset_sopcloudsec_get_data_security_facetsset_dr_general_ruleremove_org_userset_ai_memoryyara_scan_processset_fp_ruleget_secretrequest_feedback_approvalset_org_valueget_playbookgenerate_sensor_selectorcloudsec_get_topologycloudsec_list_identitiescloudsec_get_provider_manifestsvulnerability_reset_asset_findingsget_hive_schemadelete_sensordelete_lookupget_payloadresolve_arlget_platform_namescollect_velociraptor_artifactget_cloud_sensorcloudsec_ingest_caasm_recordslist_extension_subscriptionsvulnerability_scandir_listcloudsec_dismiss_chokepointdelete_fp_rulevulnerability_dashboardset_hive_record_enabledbatch_search_iocsget_group_infodelete_external_adaptervulnerability_query_endpointsrename_hive_recordcloudsec_simulate_finding_matchget_registry_keysmerge_casesvalidate_dr_rule_componentsget_os_versionset_cloud_sensordelete_investigationget_external_adaptervulnerability_query_cvesreset_event_schemaslist_saved_queriesshow_velociraptor_artifactmass_remove_tagupgrade_sensorsget_detection_rulesis_onlinetest_tooldelete_yara_ruledelete_outputextension_requestcreate_caseget_caseget_extension_schemacreate_payloadlist_org_notesget_event_schemaget_processeslist_velociraptor_artifactslist_reliable_taskslist_casescloudsec_bulk_set_finding_statuscloudsec_get_scan_statusdelete_dr_general_rulelist_dr_managed_ruleslist_exfil_rulesimport_dr_rulesadd_user_permissiondelete_api_keycloudsec_get_finding_facetscloudsec_list_compliance_assignmentscreate_installation_keydisable_fp_ruledismiss_org_errorenable_secretget_event_types_with_schemas_for_platformadd_org_to_grouplist_yara_sourceslist_org_usersget_ai_chat_historyget_atom_childrenadd_case_detectiondelete_exfil_rulereplay_dr_rulerequest_feedback_questionlist_ai_chatscloudsec_get_caasm_policydelete_playbookvulnerability_cve_packagescloudsec_resolve_sensorsget_event_schemas_batchget_investigationbulk_update_caseslist_yara_rulesvalidate_yara_rulelist_lookupsvalidate_lcql_queryremove_user_permissionget_org_delete_confirmationgenerate_python_playbookget_serviceslist_artifactscloudsec_set_caasm_policyset_yara_rulesetdelete_yara_rulesetget_org_invoice_urlsubscribe_to_extensioncloudsec_suggest_policy_valuesget_dr_general_rulecreate_api_keyvulnerability_host_packagesdisable_adaptercloudsec_get_compliance_reportyara_scan_memoryget_usersget_org_urlsadd_case_noteremove_group_memberset_secretdelete_secretset_playbookget_ruleget_ai_sessionterminate_ai_sessioncloudsec_list_queriescloudsec_list_caasm_coveragecloudsec_resolve_assetsfind_stringsmass_add_tagupdate_caselist_ai_skillsdelete_orgget_historic_detectionscloudsec_list_inventoryyara_scan_filerejoin_networkdelete_installation_keyget_yara_rulevalidate_usp_mappingadd_outputis_isolatedmemory_dump_sensorlist_installation_keyscloudsec_restore_chokepointdelete_payloadcloudsec_get_resourceget_org_infoget_group_logsset_hive_record_tagsset_adapter_tagslist_case_entitiesdelete_dr_managed_ruleget_ai_skillget_billing_statusget_org_valuecloudsec_simulate_resource_matchget_time_when_sensor_has_dataremove_tagunsubscribe_from_extensionlist_sopsadd_feedback_channelget_adapter_schemaset_exfil_event_rulelist_rulesrename_orgcloudsec_get_inventory_facetsset_yara_ruleset_user_roleremove_group_ownerlist_secretsvulnerability_epss_historyrekey_extensioncloudsec_get_findingcloudsec_set_finding_statusadd_group_ownerset_external_adapterdelete_sopvulnerability_list_finding_resolutionsvulnerability_set_finding_resolutionget_ai_usagetest_dr_rule_eventsget_org_errorscloudsec_list_findingscloudsec_list_finding_classeslist_extension_configsset_ai_skillcloudsec_list_data_storescloudsec_get_free_tier_statusseal_sensoradd_case_artifactget_sku_definitionslist_groupsset_group_permissionsset_org_quotalist_sensorssearch_hostsget_event_types_with_schemasunseal_sensorset_investigationdisable_dr_rulelist_groups_detailed
LimaCharlie publishes a remote MCP endpoint. Claude connects to it over HTTP; there is nothing to install locally.
Every connector in the Claude directory is remote, all 1,253 of them, so transport is not a differentiator there.
- Publisher
- LimaCharlie
- Verification
- Community-listed (61.5% of the Claude directory)
- Filed under
- Other
- Endpoint
-
https://mcp.limacharlie.io/mcp - Documentation
- Publisher setup docs
- Published tools
- 175 · 51+ tools band
- Depth rank in Other
- 1 of 22
- Snapshot
- August 2026
LimaCharlie is community-listed in the Claude directory, the tier 770 of 1,253 connectors sit in (61.5%). It is the default for a self-published server, and says nothing either way about quality.
In the publisher's words
How LimaCharlie describes it
Automate using the LimaCharlie cybersecurity operation platform, from EDR, XDR, Vulnerability, Cloud Security and more.
Quoted from the connector's own Claude directory listing as captured in August 2026. Node8 did not write it and does not vouch for it.
Nearby
Other Other connectors
TaqMan Assay Search
Search Thermo Fisher TaqMan assays for gene expression work
ChatGPT
Tarteel
Quran text, tafsir, recitation, and prayer times
Claude · ChatGPT
Tawadoo: Buy, Sell, Auctions
Moroccan classifieds and live auction marketplace
ChatGPT
Telgani
Car rental offers from Telgani in one call
Claude
Tessie
Tesla vehicle access and control from chat
ChatGPT
The Lonely Door
Scripture responses drawn from a large translation corpus
ChatGPT
This is an independent catalogue entry compiled by Node8 from LimaCharlie's public marketplace listing as it stood in August 2026. Listing facts come from the marketplaces; the comparisons against the rest of the directory and any live-endpoint measurements are Node8's. Node8 is not affiliated with LimaCharlie, and inclusion here is not an endorsement.
Want your company reachable inside ChatGPT and Claude?
Node8 builds MCP servers end to end: deciding which tools are worth exposing, the authentication and permission model, the review submissions, and the onboarding that gets them used. One server serves ChatGPT, Claude, and Microsoft Copilot.