Use Defendingo with AI assistants

What it is, in plain words

MCP is the standard way for an AI assistant to use tools on your computer. Defendingo's MCP server is a set of nine tools the assistant can call: "which programs went online this week", "what is this address", "run this installer and tell me where it connects". The assistant asks, Defendingo answers from your own guard's records, and the assistant explains the result in conversation. Nothing is uploaded anywhere: the server runs on your computer and talks only to the Defendingo guard on 127.0.0.1:34646 or reads the local history file.

Why it matters: a network monitor shows you data; an assistant that can read that data answers questions. "Did anything on my PC contact a paste site, a tunnel service or the Telegram bot API this month?" becomes one sentence instead of a search.

Setup

Print ready-to-paste settings with the real installed path:

defendingo mcp --print-config

On Windows the installed path is C:\Program Files\Defendingo\defendingo.exe; on Linux it is /opt/defendingo/defendingo. The snippets below show the Windows path; on Linux, replace it with yours. Every snippet is exactly what --print-config prints.

Claude Code

One command in a terminal:

claude mcp add defendingo -- "C:\Program Files\Defendingo\defendingo.exe" mcp

claude mcp add defendingo -- /opt/defendingo/defendingo mcp      # Linux

Then type /mcp in Claude Code to see the server, and ask away.

Claude Desktop

Edit %APPDATA%\Claude\claude_desktop_config.json on Windows (~/.config/Claude/claude_desktop_config.json on Linux) and add:

{
  "mcpServers": {
    "defendingo": {
      "command": "C:\\Program Files\\Defendingo\\defendingo.exe",
      "args": ["mcp"]
    }
  }
}

Restart Claude Desktop. The tools appear under the tools icon in the chat box.

Cursor

Edit %USERPROFILE%\.cursor\mcp.json on Windows (~/.cursor/mcp.json on Linux). It uses the same mcpServers shape as Claude Desktop:

{
  "mcpServers": {
    "defendingo": {
      "command": "C:\\Program Files\\Defendingo\\defendingo.exe",
      "args": ["mcp"]
    }
  }
}

VS Code (GitHub Copilot agent mode)

Add to .vscode/mcp.json in a project, or to the user-level mcp.json:

{
  "servers": {
    "defendingo": {
      "type": "stdio",
      "command": "C:\\Program Files\\Defendingo\\defendingo.exe",
      "args": ["mcp"]
    }
  }
}

Any other client

Any client that can start a stdio MCP server works: command <path to defendingo>, arguments ["mcp"]. The server speaks JSON-RPC 2.0, one message per line, MCP protocol version 2025-06-18 (clients asking for 2025-03-26 or 2024-11-05 are accepted too). Test it by hand:

echo {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}} | defendingo mcp

Does the guard need to run?

It should. With the guard running, answers are live and complete, and on Windows with the installed guard, kernel events catch connections that last a split second. Without it, the tools still work from the history file, and live_connections falls back to a one-time snapshot. Every answer carries a source field (guard, history_file or snapshot), so the assistant can tell you which it used. Start the guard by opening the Defendingo app or with defendingo ui; on Linux with the system service, sudo systemctl start defendingo.

The nine tools

All tools return one JSON object as text (and as structuredContent), capped at about 120 KB. Times are unix seconds. since and until take 30m, 2h, 7d, today, yesterday, a unix time or 2026-10-30 14:05; the default window is the last 24 hours and history is kept 90 days. min_risk is info, notice, warning or high. The field names are the same as in the command line reference.

get_status

Is the guard running, how it records, open connections and programs right now, today's counts and the update state. Assistants call this first. No arguments.

list_apps

Which programs used the network: path, signature and signer, connections, destinations, categories and worst warning, worst first. since, until, limit, warnings_only

live_connections

What is happening right now, newest first, with first_ever for first-time places. A snapshot without the guard. limit, warnings_only

search_history

Recorded connections by program, free text (host, address, owner, path, category), port, protocol, direction, category, minimum risk and time window. since, until, app, text, port, proto, direction, category, min_risk, limit, offset

list_warnings

Everything worth a look, grouped by program and warning code, with what it means and what to check. An empty list means nothing was flagged. since, until, min_risk, limit

explain

Who or what an address, host name, program, warning code or category is, with what the history shows. An empty target returns the whole glossary. target

watch_program

Starts a program (full path, your normal rights), follows it and its helpers for up to 120 seconds and reports every place it contacted and every warning, with a one-sentence verdict. The only tool that starts something. program, args, seconds

capture_packets

Packets for a few seconds (max 60), summed per program and place, plus a short plain-words sample. Needs administrator or root rights. seconds, limit

export_history

Recorded connections as CSV or JSON text, same filters as search_history, 500 rows per call. Writes no file itself; the assistant can save the text for you. format, since, until, app, text, min_risk, limit, offset

A tool that cannot answer (the guard is not running and there is no history, no administrator rights for packets, a time it does not understand) returns a result with isError: true and a plain-language error field, never a crash.

Things to ask

• "Which program on my PC talks to unknown servers?"
• "Is anything on this computer worth worrying about since yesterday?"
• "What is 162.159.134.234 and which of my programs talk to it?"
• "Show me everything Discord connected to in the last hour."
• "Which programs listen for incoming connections, and are they signed?"
• "Explain what RISKY_LOCATION means and what I should do."
• "Run C:\Users\me\Downloads\setup.exe with Defendingo for a minute and tell me where it connects."
• "Export this week's connections from chrome.exe as CSV."
• "Did anything on my PC contact a paste site, a tunnel service or the Telegram bot API this month?"

A good assistant starts with get_status, reads list_warnings for the headline, uses explain on anything you don't recognise, drills down with list_apps and search_history, and reaches for watch_program only when you ask to run or test a specific program. The server tells the assistant exactly that when it connects.

Safety

Prefer scripts?

Every tool has a twin on the command line with the same fields: defendingo status, apps, now, history, check, explain, run, packets and export, all with --json. See the command line reference.