ArmorEDR datastore for Claude

ArmorEDR's datastore query plane, for Claude: the datastore's read-only tools, served to Claude as a connector. It is read only.

Add it to Claude

In claude.ai or the Claude app: Settings, Connectors, Add custom connector, with the URL https://mcp.edrlab.armoredr.com/mcp, then Connect, and sign in with your Google account.

In Claude Code: claude mcp add --transport http armor https://mcp.edrlab.armoredr.com/mcp, then /mcp in a session to sign in.

What it can do

Ask the datastore questions through these tools:

• alert_context
• alert_spread
• alert_story
• catalog
• draft_detection_request
• draft_interface_request
• list_views
• preview_spec
• query
• run_view
• whoami

The two draft tools write a request document for a person and return it in the answer.

What it cannot do

It takes no response actions on an endpoint, changes no configuration, and writes nothing to the datastore. It asks the API with one read-only token of its own; who asked each question is in this service's own audit log.

Who is admitted

The Google accounts the operator lists, each until its expiry, checked again on every request. Signing in shows a consent page here first, then Google.

The Portal, for the same data on screens: https://portal.edrlab.armoredr.com