This guide covers the Polarity Model Context Protocol (MCP) server: what it is, how to enable and authenticate against it, the tools it exposes, how data is optimized for LLM consumption, and how to use the MCP as a foundation for building AI-powered security applications.
Audience: Polarity administrators configuring the AI feature, developers integrating external AI agents or tools with Polarity, and security engineers building agentic workflows on top of Polarity's integration data.
What Is the Polarity MCP?
MCP stands for Model Context Protocol, an open standard for connecting AI models to external tools and data sources. Polarity implements an MCP server that allows any MCP-compatible AI client (Claude Desktop, custom agents, LangChain, and others) to call Polarity's integration lookup pipeline directly.
When an AI agent connects to the Polarity MCP endpoint, it gains the ability to:
Discover all integrations running on a Polarity server that the authenticated user can access.
Submit arbitrary text containing entities (IP addresses, domains, hashes, CVEs, usernames, and custom types) and receive enriched intelligence data back from any subscribed integration.
Parse and identify entity types from free-form text without performing a lookup.
The MCP server is built on the hermes\_mcp library (v0.14.1) and uses StreamableHTTP as its transport. This means it supports both standard HTTP request-response and server-sent event (SSE) streaming over the same connection.
Scope of the MCP endpoint: The /mcp endpoint exposes three tools intended for external AI agents. The built-in Polarity chat interface uses a larger set of tools (including notification context tools) that are available only through the internal WebSocket chat session, not through the external MCP endpoint.